Privacy

SpotOwl lets you know when an appointment opening is available on a booking platform. The service is designed to work without an account: we never ask for your name, email or phone number. This policy explains what the app and this website process, why, with whom and for how long.

Who is responsible

SpotOwl is run by Antoine, an individual, who is also the person in charge of the protection of personal information. For any question or request: antoine@spotowl.app.

In short

• No account, no identity information.
• Your alerts are tied to an anonymous installation of the app on your cell phone.
• Your position is only used to find nearby locations: it is not recorded in our database.
• Nothing is sold, nothing is used for advertising.
• You can erase everything at any time, from the app.

What the app processes

Your installation

When you first open the app, it creates an anonymous installation: a random identifier and a secret that stays on your cell phone (our server only keeps a fingerprint of it). The server also records the type of phone (Android or iOS), the app version, its language, the notification permission status, and the creation and last-opened dates.

The notification token

To send you notifications, the app gets a token from Google’s notification service (Firebase Cloud Messaging, which goes through Apple’s on iPhone). This token is recorded with your installation.

Your alerts

An alert is one service followed at one specific location, with its status (active, paused, expired) and dates. A service may reveal information about your health (a medical test, for example): this is why your alerts are not tied to any identity.

Notifications and your answers

We keep a record of the notifications sent and when they are opened (the date, without any IP address). After a notification, the app may ask whether you got the appointment; your answer helps measure how useful the service is.

Your position

If you choose “Use my position”, the app reads it once, with reduced accuracy, rounds it to about 1 km and sends it to our server to search for nearby locations. The server does not record it in its database. If you enter a postal code, your phone converts it into coordinates. The app never reads your position in the background.

Anonymous measurement

To fix errors and improve the app, it sends anonymous usage and crash measurement to PostHog: a random identifier specific to the app, with no IP address kept and no location, and nothing about your alerts, your locations or your position. This measurement is on by default; you can turn it off in the settings (“Help improve the app”).

IP address

Like any online service, our server receives your phone’s IP address. It is only used, for a few moments, to limit abuse (number of requests); it is not recorded in our database.

What this website processes

This website uses no cookies, no measurement tools and no third-party services in your browser: fonts and images are served by the website itself. The host may keep technical logs of visits.

If you write to us, for example with the “Suggest a platform” button, we receive your email address and your message. They are only used to answer you and look into your suggestion, and are kept as long as needed.

Contributions are made on a Stripe page, which processes the payment under its own policy. Stripe sends us the payment information (amount, date, and the details you enter there). The app itself does not know who contributed.

What we do not do

• We do not sell or rent any data.
• No advertising, no profiling.
• No data is shared with the booking platform: it is queried with nothing about you. When you open its booking page from a notification, you are on its website, under its own terms.

Service providers

These providers process data to run the service, each for its own part:

• Render (United States): hosting of the server, the database and this website.
• Google Firebase: sending notifications and checking that requests really come from the app. The content of a notification (service, location, days) passes through Google, and through Apple on iPhone, to reach your phone.
• Apple and Google: app integrity checks (App Attest, Play Integrity).
• PostHog (United States): anonymous usage and crash measurement.
• Stripe: payment of contributions, on its own pages.
• Google: inbox of the contact address.

The service’s data is therefore hosted in the United States, outside Quebec.

Retention periods

• Alert: it expires after 60 days without the app being opened; you are notified a few days before, and you can reactivate it.
• Installation: after 90 days without the app being opened, it is deleted with all its data (alerts, token, notifications).
• Deleting an alert: immediate.
• “Delete everything”: immediately erases your installation and all its data, on the server and then on your phone.
• “Did you get your appointment?” answers: once your installation is deleted, they are only kept detached from it, for statistics.
• The host’s backup copies, if any, disappear as they are renewed.

Your rights

You can request access to your information, its correction or its deletion, and withdraw your consent. The app already lets you pause or delete an alert, turn off anonymous measurement and erase everything. Since no identity is recorded, we may need information from you to find your installation. For any request: antoine@spotowl.app.

If you are not satisfied with the answer, you can contact the Commission d’accès à l’information du Québec.

Changes

This policy may change along with the service. The last update date is shown at the top of the page.