Spot.gg Privacy Policy

This document has been written in plain language to make it easier to understand. It applies to the spot.gg website (including public server pages at spot.gg/s/...), the customer panel, the Spot.gg Mobile App and the Spot.gg Desktop App program.

Pursuant to art. 13 sec. 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as: GDPR), we inform you that:

1. Data controller

The controller of your personal data is InterScript Sebastian Sobieraj, based at Chmielna 2/31, 00-020 Warszawa. For matters related to your data, contact us by e-mail: [email protected].

2. What data we collect

1. Account data: e-mail address, password (in encrypted form), two-factor authentication data and, when you log in with Google, also your Google account identifier.
2. Account settings: language, currency, country, theme and the consents you have selected.
3. Technical data: IP address (including at registration and at the last login), browser or device type, login date.
4. Order and payment data: order history, amounts, payment method, transaction identifiers, wallet and points balance and transaction history. We do not store card numbers; they are handled by payment operators. When you buy points in the Spot.gg Mobile App, we pass to Google a pseudonymous account identifier and the order number, and we receive from Google a purchase confirmation: the purchase token, the Google order number, the purchased product, the price with currency, the subscription status and information about a refund or cancellation of the payment. We do not receive card data or any other payment data from Google Play.
5. Saved payment card (in account settings, in the server panel or when paying by card): card and customer identifiers assigned by Stripe, card brand, last four digits of the number, expiry date and country of issue. The full card data is stored only by Stripe. We show you this information so that it is clear which card will be charged, and we check the country of issue because automatic renewal does not work with cards from some countries.
6. Consent to automatic card renewal: the text of the consent in the language in which you give it, the date it was given and withdrawn, IP address, server number, period, amount and currency up to which you agree to be charged, and the last four digits of the card.
7. Server data: configuration, files, backups, profiles, logs, console and the history of actions on the server.
8. Content you provide to us: chat conversations, tickets, attachments, photos, survey responses and reasons for cancelling the service.
9. Acquisition source: campaign parameters (UTM), ad click identifiers, the page from which you come to us, referral code and, in the app, information about the installation source from Google Play.
10. Referral program: your referral code, information about who referred you and the status of the referral reward. If you create an account with a referral code, the referrer sees on their Points page the masked e-mail address of your account (e.g. ja***@g***.com), the registration date, the date of your first payment and the reward status.
11. Data from the mobile app described in point 5.
12. Data from the Spot.gg Desktop App described in point 6.
13. Report of server page content (also without an account): the reason and description of the report, your name and e-mail address if you provide them, IP address, browser type and a copy of the reported content. The server owner does not receive your data - they only receive information about the decision and its justification.

3. For what purpose and on what basis

1. Creating an account and providing services, including handling servers, payments, points, the referral program, automatic card renewal, support and the operation of the Spot.gg Desktop App (art. 6 sec. 1 lit. b GDPR).
2. Settlements, accounting and tax obligations (art. 6 sec. 1 lit. c GDPR).
3. Security, prevention of abuse, protection against claims (including proof of consent to automatic card renewal in the event of a chargeback dispute with the bank) and development of services (art. 6 sec. 1 lit. f GDPR, i.e. our legitimate interest).
4. Messages about news and promotions, statistics and ad measurement, only with your consent (art. 6 sec. 1 lit. a GDPR).

Providing data is voluntary, but without an e-mail address and password or a Google account you cannot create an account, and without one we cannot provide services.

4. E-mail messages

We send service-related messages, for example about server expiry or payments, to every customer. We send messages about news and promotions only to people who have consented to this during registration or in account settings. You can withdraw your consent at any time in account settings.

5. Mobile app

1. Push notifications: if you agree to notifications on your phone, we save the device token together with the operating system, device name, app version and the date of last use. We send notifications about your servers (e.g. about the approaching end of the period, a server being started from the queue, the end of a free activation), about replies to tickets and about new posts on the Spot.gg blog, and if you have agreed to messages about news and promotions - also such messages. We deliver notifications via a push notification service provider and the Google Firebase Cloud Messaging service. You can turn them off in your phone settings. We delete the token when you log out in the app, after a password reset, when it stops working (e.g. after the app is uninstalled) and together with the account.
2. Photos and camera: the app uses them only when you yourself choose a photo or take one in order to send it in the chat.
3. Anonymous counter: the app sends us the name of a step (for example, opening the registration screen), the operating system and the app version. We save only the daily total, without identifiers and without attribution to a person, which is why this counter also works without consent.
4. App and ad measurement: only with your consent does the app use the Google Analytics for Firebase service. Google then receives information about actions in the app (for example, account registration), the app instance identifier, the advertising identifier (Advertising ID) and device data. We pass them on in order to count app usage and measure the effectiveness of ads, including in Google Ads. We do not use this data for remarketing or ad personalisation. We do not add the e-mail address or account identifier to events.
5. Without consent, measurement is disabled and the app does not read the advertising identifier. You can change your consent at any time in the app settings. We save the date the consent was given and withdrawn as proof that it was obtained.

6. Spot.gg Desktop App

1. Login: in the program you log in with your e-mail address and password or with a Google account. When you log in with Google, the program opens a Google page in your browser. Google passes to the program a login confirmation with your e-mail address and Google account identifier, and the program sends them to us. We do not receive your Google account password.
2. Remembered session: if you leave the "Remember me on this computer" option checked when logging in, the program saves a session key on your computer, encrypted with a Windows mechanism tied to your system user account. The session is valid until you log out in the program, change or reset your password or delete your account. After you log out, we also invalidate it on our side.
3. World search: it takes place only on your computer. The program reads the folders of the game Minecraft and of the CurseForge and Modrinth App programs, the settings files of these programs (only in order to find these folders) and information about worlds, such as the name, game version and date last played. We do not send the search results to ourselves.
4. Uploading a world: we receive only the world you yourself choose, together with the profile name, game version, number and size of files and checksums. The world becomes a profile or server files and we store it in the same way as other server data (point 2.7). World files may contain data of players who played in it, for example their in-game identifiers, inventory and statistics.
5. Downloading a profile: the profile files, including the server database, are saved on your computer, in the "Spot.gg Desktop App" folder in Documents. They may contain data of your server's players - from the moment of download you are responsible for securing it.
6. Data saved on your computer: program settings (language and enabled features), hashes identifying the worlds found (in order to mark new ones), the remembered session, downloaded profile files and temporary files, which the program deletes after uploading or downloading is completed. We do not send this data to ourselves.
7. Connections: the program connects to us (login, list of servers and profiles, uploading and downloading files, AI Assistant, checking for and downloading updates) and to Google, only when logging in with Google. With each connection we receive your IP address and technical information about the program, such as its name and the operating system.
8. The AI Assistant in the program works in the same way as on the website (point 8.4).
9. The program does not contain analytics or advertising tools and does not send us error reports or usage statistics. Notifications about completed uploading or downloading are displayed by Windows on your computer.
10. By default, the program starts together with the system and searches for worlds at startup. You can turn off both features, as well as notifications, in the program settings.
11. Uninstalling removes the program. Downloaded profile files remain in Documents, and the settings and remembered session in the %APPDATA%\Spot.gg Desktop App folder - before uninstalling, log out in the program or delete this folder.

7. Cookies

Our website uses cookies for the purpose of:

1. Tailoring the content of the website to your preferences.
2. Enabling login and keeping you logged in on subsequent subpages.
3. Preparing website usage statistics using Google Analytics (Google) and Microsoft Clarity (Microsoft), only after you consent in the "Analytics" category.
4. Measuring the performance of advertising campaigns using Google Ads (Google) and Reddit Pixel (Reddit), only after you consent in the "Campaign performance" category. These tools may receive information about the pages you visit and the actions you take, such as creating an account, activating a server or paying for its renewal.

You can change or withdraw your consent to analytics and advertising cookies at any time using the "Cookie settings" link in the website footer.

8. Who we share data with

We do not sell your data. We share it only with companies that help us provide services, and only to the extent necessary:

1. Hosting and infrastructure: providers of servers, data storage and network protection.
2. Payments: Przelewy24, PayPal, Stripe, Google Play. When you pay by card or save one, Stripe also receives your e-mail address and your Spot.gg account number.
3. Messages: providers of e-mail and push notification delivery.
4. AI Assistant: OpenAI. It receives the content of the conversation, attached photos and the server information needed to respond. Do not enter passwords or sensitive data in the chat. Conversations may also be read by our staff in order to check the quality of responses.
5. Login, form protection and website fonts: Google (including Google Fonts) and the website security provider.
6. Statistics and advertising, only with your consent: Google, Microsoft, Reddit.

We may also disclose data to public authorities if required by law. We store server data in the location you choose.

If you enable a public server page (spot.gg/s/...), anyone who knows its address will see the profile name and icon, description, server address and status, and the number of players online. We do not show your account data on it. Do not enter personal data in the description. The page stops being available once it is disabled or the server is deleted.

9. Transfer of data outside the European Economic Area

Some of these companies, including Google, Microsoft, OpenAI, Reddit, Stripe and PayPal, may process data outside the European Economic Area, in particular in the USA. This takes place on the basis of a European Commission decision finding an adequate level of protection or standard contractual clauses. If you choose a server location outside the European Economic Area, that server's data will be stored in that location. You can obtain more information at [email protected].

10. How long we store data

1. Account data: until the account is deleted.
2. Order and payment data: 5 years from the end of the tax year in which the tax obligation arose. After the account is deleted, it is no longer linked to it.
3. History of actions on the server: 1 month, and payment entries until the server is deleted.
4. Server files and backups: in accordance with the rules described in the Terms of Service, and after the server is deleted we delete them.
5. Server profiles: up to 6 months from last use. We notify you of the deletion by e-mail 14 days in advance.
6. Tickets and attachments: until the account is deleted.
7. Chat conversations: 30 days from the last activity, and after the account is deleted we delete them immediately together with the attached photos.
8. IP address data from network protection systems: 30 days, and data about security incidents 180 days.
9. Data in Google Analytics: up to 14 months.
10. Data processed on the basis of consent: until it is withdrawn, and the record of the consent being given until the account is deleted.
11. Saved payment card data: until the card or the account is deleted (in which case we also delete the card in Stripe).
12. Record of consent to automatic card renewal: until the account is deleted, and after the account is deleted up to 6 years from when the consent was given (the limitation period for claims). After the account is deleted, the record is not linked to the account.
13. Points history, Google Play purchases and referral program data: as for order and payment data (point 2).
14. Push notification tokens: until you log out in the app, reset your password, until the notification service reports the token as invalid (e.g. after the app is uninstalled), or until the account is deleted.
15. Spot.gg Desktop App session: until you log out in the program, change or reset your password or delete your account. Worlds uploaded from the program are stored in the same way as server profiles and files (points 4 and 5).
16. Reports of server page content: 2 years from the report, and unresolved reports until a decision is made.

11. Your rights

You have the right to access your data, to rectify it, erase it, restrict its processing and to data portability, as well as the right to object to processing based on our legitimate interest. You can withdraw your consent at any time. This does not affect the lawfulness of processing carried out before its withdrawal.

For matters concerning your data, write to [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.

12. Deleting the account and data

You can delete your account yourself in the account settings on the spot.gg website (after logging in: https://spot.gg/user/settings) or in the Spot.gg Mobile App settings. You can also request this at [email protected].

Together with the account, we delete the account data, servers with their files, profiles, tickets and chat conversations. We retain only the data from point 10 that we must store for longer, in particular order and payment data and the record of consent to automatic card renewal. Remember that deleting the account means cancelling our services, and the wallet balance and points are forfeited in accordance with the Terms of Service. Deleting the account cancels the points subscription in Google Play - it will not renew after the current period, and any refund for that period is decided by Google under the Google Play rules.

To delete some of your data without deleting the account, write to [email protected].

13. Changes to the policy

We announce changes to the policy on this page. You can find previous versions in the list of versions below the document.