Privacy Policy

Last updated 12 August 2026 · privacy@on-the-spot.app

OnTheSpot is a daily task app: one task or question a day, dropped to everyone at the same moment and answered in one take. This page lists everything we hold about you, in plain words. It is written from the actual database, not from a template — if something is stored, it is on this page.

01What we collect

Your account

• Email address. Your login. We send a one-time code — there are no passwords, and we never ask for a phone number. If you use Sign in with Apple or Google we receive the verified address they hand us and nothing else from that account; with Apple’s Hide My Email, all we ever see is the relay address.
• Username, and the date you last changed it.
• Date of birth. Asked once to check you are 16 or over. We keep the date rather than only the answer, so that an account can be re-checked if its age is ever disputed.
• Optional profile details: a photo, and a one-line bio.
• Your time zone, so a task drops at a sensible hour where you are rather than at 3am.
• Whether your account is public or private, and the date and version of the Terms you accepted.

What you make

• Your videos, and their captions.
• Text you write: comments, the tasks you set if you win a round, league names, and quest suggestions.
• Who you follow, what you liked, and which leagues you are in.
• Private messages you send to other members, including reactions and whether a message has been read. These are stored so they can be delivered; they are not used for anything else.
• Applications to run an organisation league, if you make one — the organisation name and the contact details you give us.

Your device

• A push notification token, if you allow notifications. It identifies the app on your phone so a task drop can reach it. Turn notifications off and it stops being used.

How the app is used

• Which attempts you have watched, counted so we can tell a league that is alive from one that is not, and choose what to show next.
• A handful of events per day — opening the app, finishing signup, joining a league, following an invite link. These are linked to your account.

This is our own counting, kept on our own servers. There are no third-party analytics, advertising or tracking SDKs in the app — not Google, not Facebook, not anyone. Nothing here follows you to other apps or websites.

Safety records

• Reports you file and people you block.
• Automated moderation decisions — what was checked and whether it was allowed. We keep these to spot a filter that is failing, and to act on repeat offenders.
• A record when a post is deleted — which account, which task, and why. This is what stops a deletion from erasing the evidence for a report already filed about it.

Before you install

• If you gave us your email on the website to be told when the app launched, we hold that address and the league code you scanned, so we can email you once and put you in the right group. It is deleted once used.

02What we do not collect

No location. No contacts — we never read or upload your address book. No health, financial, or payment data. No browsing history. No advertising identifiers. We do not sell data, we do not share it for advertising, and we run no third-party trackers.

03How it is used

• To run the app: showing your attempts to the audience you chose, counting likes, crowning winners, delivering messages, and sending the notifications you asked for.
• Safety screening: text and sample video frames are checked automatically before publication, to block dangerous, hateful or sexual content. This uses OpenAI’s moderation service as a processor — content is checked, not used to train models, per OpenAI’s API terms. Nobody listens to the audio of your clips.
• To keep the game honest: the counting described above decides which clips surface and whether a league is still running.

04Who else touches it

Only these, and only to do the job named:

• Supabase — hosting, database and video storage, on servers in the EU (Frankfurt).
• OpenAI — automated moderation of text and video frames.
• Our email provider — delivering your login code.
• Expo — delivering push notifications to your device.
• Apple and Google — only if you choose their sign-in button.
• Cloudflare — serving this website.

05Who can see your content

You choose at signup, and any time afterwards in Settings: public (anyone in the app can watch your attempts) or private (only followers you approve). Videos are delivered via public storage URLs so the app can play them — treat anything you post as potentially shareable. Private messages are visible only to you and the person you sent them to.

06Where it lives, and who can reach it

Data is stored with Supabase on servers in the EU (Frankfurt, eu-central-1). Access is restricted at the database by row-level security: only you can modify your own rows, and only designated admins can act on reported content.

07Reports and moderation

When you report content we keep the report — what, why, who filed it — to review it within 24 hours and to act against repeat offenders. Content that is illegal, dangerous, hateful or sexual is removed and can lead to account removal. Content involving the exploitation of minors is reported to the relevant authorities (NCMEC).

08Keeping and deleting

Settings → Delete account removes your profile, your videos, your captions and comments, your messages, and your follows from our servers. Two things intentionally survive it: safety records about reports others filed, and the deletion record described above — both without your profile attached, because otherwise deleting an account would be a way to erase a complaint about it.

You can also email us to request deletion, or a copy of your data, and we will answer within 30 days.

09Your rights

If you are in the EU or UK, the GDPR applies: you may ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Our legal basis is performing the service you asked for, and our legitimate interest in keeping it safe. Email the address below and we will answer within 30 days. You may also complain to your national data protection authority.

10Age

OnTheSpot is for ages 16 and up. If we learn an account belongs to someone under 16, it will be removed.

11Changes & contact

If this policy changes materially we’ll note it in the app. Questions or requests: privacy@on-the-spot.app