the ios app

privacy policy

effective 21 july 2026
covers the Spur mobile application for iOS
looking for the website and waitlist notice? it is here

Spur is provided by Jason Jiang. if you have any questions about this policy or your personal data, contact us at jasonjiangpj@gmail.com. the rest of this document explains each of the points above in full.

1. who we are (data controller)

For the purposes of the EU/UK General Data Protection Regulation ("GDPR") and similar laws, the data controller responsible for your personal data is:

Jason Jiang — contact: jasonjiangpj@gmail.com

2. scope and your agreement

This policy applies to personal data we process through the Spur app. It does not apply to third-party services we rely on (Apple, Supabase, Google), which have their own privacy policies linked in Section 7.

By creating an account, signing in with Apple, or otherwise using Spur, you acknowledge that you have read and understood this Privacy Policy and you agree to the collection, use, and sharing of your information as described here. Where the law requires your consent (for example, for processing that is not strictly necessary to run the app), we ask for it, and you can withdraw it at any time as described in Section 10.

3. information we collect

We collect only what is described below. We do not build advertising profiles and we do not buy personal data about you from third parties.

3.1 account information

When you sign in with Apple, we receive and store:

• An email address. If you choose Apple's "Hide My Email", this is a private relay alias generated by Apple, and your real email address is never shared with us. You can revoke this at any time in your iOS settings.
• A user identifier. An account ID that our systems use to keep your data scoped to you and to no one else.

3.2 your saved activity ("receipts")

The moments and moves you choose to keep in the app (which we call "receipts," including scene readings and the actions you saved) are stored so your history survives reinstalling the app or moving to a new device. This content is hosted on our behalf by Supabase and is readable only by your account.

3.3 camera images

When you use the live lens, a single still frame from the camera is sent to Google's Gemini API so the app can read what is in the scene and suggest a move.

• The frame is held in memory only for the duration of that request.
• It is not saved by Spur: not stored on your device and not stored on our servers.
• We do not perform facial recognition and we do not use the frame to identify you.
• Google processes the frame as our service provider to return a scene reading.
• We use the paid Gemini API. Under Google's terms for paid services, Google does not use your frames or the responses to train or improve its models. Google logs them for a limited period only to detect abuse of its policies and to meet legal obligations, and processes them under its data-processing terms.

3.4 technical and connection data

When the app communicates with our servers and service providers, certain technical data is processed automatically to deliver your requests, keep the service secure, and prevent abuse. This includes your IP address and basic request metadata, which we and our providers use to route requests and to enforce rate limits (for example, to stop automated abuse of the AI service). We do not use this data to track you across other services or to build an advertising profile.

3.5 diagnostic events

When something in the app fails in a way you might not notice, for example your saved activity cannot be backed up to our servers, or your history cannot be restored, the app sends us a short diagnostic record so we can find and fix the problem. Each record contains only the type of failure, a short technical reason, your app and iOS version, the time, and your account identifier so we can tell whether one person is affected repeatedly or many people are affected once. These records contain none of your saved content, no camera data, and no message from you. They are deleted automatically after 90 days, and immediately if you delete your account.

3.6 usage events (how the app is used)

To understand whether the app actually helps, for example how many people who are shown a pair of moves go on to complete one, and at which step people give up, the app sends us a short record of what happened during a catch. Each record contains only the type of event (a pair of moves was shown; a move was started, completed, skipped, or put off; a receipt was kept; the catch was abandoned), a short technical label such as which of the two moves was chosen and whether the AI or the on-device fallback produced it, your app and iOS version, the time, and your account identifier.

These records contain none of your saved content: not the words read from your scene, not the description of your moment, and not the text of any move. They tell us that a move was skipped, never what the move was or what you were looking at. We use them only in aggregate, to improve the app. They are deleted automatically after 90 days, and immediately if you delete your account.

3.7 what we do NOT collect

We do not collect: your precise or coarse location; advertising identifiers (IDFA/IDFV); your contacts, calendar, health, or financial data; or biometric identifiers. Spur contains no third-party advertising or analytics SDKs: the usage events in Section 3.6 are recorded by us, on our own servers, and are never handed to an analytics company or used to track you across other apps or websites.

4. how we use your information

We use the information above to:

• create and secure your account and sign you in;
• provide the app's core features, including reading a scene from a camera frame and generating a suggested move;
• store and sync the moments and moves you choose to save, so your history follows you across reinstalls and devices;
• keep the service reliable and secure, prevent abuse, and enforce rate limits;
• understand in aggregate how the app is used, so we can see what works and improve it (Section 3.6);
• respond to your requests and support questions; and
• comply with our legal obligations.

We do not use your information for advertising, for sale to third parties, or for automated decisions that produce legal or similarly significant effects about you.

5. legal bases for processing (GDPR)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)) — to create your account and provide the features you ask for, including saving and syncing your activity.
• Consent (Art. 6(1)(a)) — for optional processing, such as sending a camera frame to the AI when you choose to use the live lens. You may withdraw consent at any time by not using that feature and by deleting related data.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and enforce rate limits; and to understand in aggregate how the app is used so we can improve it (Section 3.6). Each is balanced against your rights and freedoms, and the usage records carry none of your saved content.
• Legal obligation (Art. 6(1)(c)) — where we must process data to comply with the law.

6. automated processing

Spur uses an AI model (Google's Gemini API) to read a camera frame and suggest a move. This is a suggestion feature only; it does not make any decision that has a legal or similarly significant effect on you, and you are free to ignore any suggestion.

7. how your information is shared

We do not sell or rent your personal data. We share it only with the service providers ("processors" / "sub-processors") that we need to run the app, and only for the purposes described above. Apple and Google require us to name their services specifically:

• Apple — provides Sign in with Apple (authentication). See Apple's Privacy Policy.
• Supabase — provides authentication and database hosting for your account and saved activity. See Supabase's Privacy Policy.
• Google — provides the Gemini API that reads the camera frame you send. See Google's Privacy Policy.

We may also disclose information if required to do so by law, to enforce our terms, or to protect the rights, property, or safety of our users or others. If Spur is ever involved in a merger, acquisition, or asset sale, we will notify you before your personal data is transferred and becomes subject to a different policy.

8. international data transfers

Our service providers may process your information on servers located in the United States or other countries, which may have data-protection laws different from those in your country. Where personal data is transferred out of the EEA or the UK, our providers rely on appropriate safeguards for such transfers (for example, the European Commission's Standard Contractual Clauses). By using Spur you understand that your information may be processed in these locations.

9. how long we keep your information

• Account and saved activity: kept until you delete them (see Section 10). When you delete your account, your account is deleted immediately and your saved activity is removed from the app straight away. A copy of that saved activity is then held in a restricted archive for up to 30 days and is permanently erased at the end of that period. The archive exists so that the deletion completes reliably across our systems, and so that we can put your history back if you tell us you deleted your account by mistake. It is not reachable from the app, it is not used to build profiles, and it is not analysed for any other purpose.
• Anonymous statistics about deletions: when an account is deleted we keep a short summary of how the app was used: how many items were saved, how many days it was used, and the dates involved. These summaries contain no name, no email address, no account identifier and none of your saved content, and they cannot be linked back to you or to any individual. Because they are anonymous they are not personal data, and we keep them indefinitely.
• Camera frames: not retained by Spur at all. Any handling by Google is governed by Google's terms.
• Technical and connection data: kept only as long as needed for security and abuse-prevention, then discarded or aggregated.
• Diagnostic events (Section 3.5) and usage events (Section 3.6): kept for at most 90 days, then deleted automatically. Deleting your account deletes them immediately.

10. your privacy rights and choices

You can access and delete your data directly inside the app at any time:

• Delete individual items you have saved.
• Clear your entire history while keeping your account.
• Delete your account and all associated data (Settings / the "You" tab). See Section 9 for exactly how deletion completes and what is kept.
• Revoke Sign in with Apple from your iOS settings at any time.

10.1 if you are in the EEA or the UK (GDPR)

You have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local data protection authority.

10.2 if you are in California (CCPA/CPRA)

You have the right to: know what personal information we collect and how we use it; access and delete it; correct inaccurate information; and opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. We honor recognized opt-out preference signals (such as Global Privacy Control) where applicable. We will not discriminate against you for exercising any of these rights.

10.3 how to exercise your rights

Most rights can be exercised directly in the app using the controls above. For anything else, email us at jasonjiangpj@gmail.com and we will respond within the time required by law (generally within 30 days for GDPR requests and 45 days for CCPA requests). We may need to verify your identity before acting on a request.

11. security

We take reasonable measures to protect your information:

• Sign-in tokens are stored in the iOS Keychain, the device's secure store.
• Data is transmitted over encrypted HTTPS connections.
• Access to your saved activity is enforced per account at the database layer (row-level security), so one user can never read another user's data.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work to protect your information and to review our practices.

12. children's privacy

Spur is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. changes to this policy

We may update this policy from time to time. If we make material changes, we will update the "Effective date" above and, where appropriate, surface a notice in the app. Your continued use of Spur after an update means you accept the revised policy.

14. contact us

Questions, requests, or complaints about this policy or your personal data:

Jason Jiang
jasonjiangpj@gmail.com