Privacy Policy

1. Controller

Contracting party and personal-data controller: Ratomski Maksim, a natural person, operator of the Spotbook service (trade name: Spotbook). There is no registered company.

Location: Batumi, Georgia.

Contact: spotbook.support@gmail.com.

Privacy requests can be sent to spotbook.support@gmail.com or through the Support space in your Spotbook workspace.

2. What this policy covers

It covers data processed to run accounts, captures, solutions, sharing, groups, chats, Support, Desktop Connect, voice transcription, security, and (when enabled) first-party product analytics. It does not cover poker rooms, solver vendors, Google/Discord/Telegram as independent controllers of their own accounts, or websites we link to.

3. Data we process

We process only what is needed for the product you actually use:

• Account: internal user ID; nickname; optional avatar image; optional “about me”; onboarding completion time; last-seen time for presence; optional email when Google or Discord supplies a verified address (Telegram typically has no email).
• Sign-in identity: provider name (google / discord / telegram) and the provider’s account ID. Providers are not linked to each other.
• Sign-in audit: provider, IP address, user agent, and time of successful sign-in, kept about 90 days for security and lawful requests.
• Your study content: table and lobby images, notes, hashtags, folders, comments, HRC/solver files and derived viewer data, share records and grants, group catalogues.
• Social graph: contacts and contact requests; groups you own or join; roles and membership; direct and group chat messages and reactions; Support messages if you post there; file attachments.
• Devices: Desktop Connect sessions, connected-device records, and hashes of API tokens (the raw nvn_… token is shown only at issuance).
• Voice: audio is sent for transcription and is not stored by Spotbook after the request; we store only device credentials (hashed secret), last-seen time, and duration telemetry without transcript text. If you save the returned text as a note, that note is User Content.
• Security throttles: limited IP and attempt counters for TOTP, Desktop Connect codes, and voice-device registration.
• Staff-only: encrypted TOTP secrets and hashed recovery codes for allowlisted admin/support accounts; administrative access audit records (about 365 days).
• Product analytics (only if ANALYTICS_ENABLED is turned on in deployment): authenticated user ID, an in-memory session UUID (not a cookie), allowlisted event type (dashboard viewed, capture opened, solution opened), product context, cache hit/miss, duration, timestamp. Never message text, screenshots, solution payloads, emails, IPs, tokens, or arbitrary URLs.

4. Purposes and legal bases

• Contract (providing the Service you requested): account, content hosting, sharing, chats, desktop pairing, displaying presence to people in the same thread.
• Legitimate interests: keeping the Service secure (sign-in logs, throttles, token hashes, malware/image checks), operating Support, understanding product reliability through the limited analytics above, and defending legal claims. You may object where the law gives you that right.
• Consent: you choose to sign in with a provider, to upload content, to enable voice notes, and to connect a desktop device. You can withdraw by stopping that feature, revoking the device, or deleting the account, without affecting processing already completed.
• Legal obligation and public-authority requests: we may retain or disclose data when any applicable law requires or permits it, including a request from a public authority of Georgia or of any other country, as described in section 6.

5. Who can see your data

• People you share with: contacts, group members, and anyone you grant a share to can see the spots and discussions you made available to them. Nickname, avatar, and presence can be visible in those contexts.
• Support space: signed-in users can read public Support channels; staff with extra rights (gated by two-factor authentication) can moderate.
• Processors who host the Service under our instructions: database and application hosting; Cloudflare R2 (or compatible object storage) for images, solutions, avatars, and attachments; Google, Discord, and Telegram for authentication; OpenAI for voice transcription when you use that feature; a self-hosted Soketi realtime server we operate on Fly.io to push chat and presence events to open clients. Realtime payloads can include message DTOs so the other participant’s client can update. We do not fully control those parties; an incident on their side is a risk you accept.
• We do not sell personal data and do not use it for advertising networks.

6. Authorities and compelled disclosure

By using the Service you acknowledge that we may provide data to a court, police, prosecutor, regulator, or other public authority of Georgia or of any other country, or to a person with a court or similar order, when we in good faith believe we should. We may do so without prior or subsequent notice to you unless a mandatory rule that cannot be waived requires notice. We have no contractual duty to resist the request. Details are in the User Agreement. This Policy does not create extra duties beyond what the law already imposes on us as controller.

7. International transfers

Servers and processors may be located outside Georgia (including the EU, the United Kingdom, and the United States). Where a transfer needs a safeguard under Georgian or EU rules, we rely on the processor’s contractual terms and, where used, standard contractual clauses or an adequacy decision. OpenAI transcription and OAuth providers typically process data in the United States.

8. Retention

• Account and User Content: until you delete the item or the account. Account deletion removes database rows we hold for you (cascading captures, solutions, owned groups, memberships, chats tied to the account, tokens, devices) and then deletes the corresponding object-storage prefixes.
• Sign-in audit: about 90 days.
• Analytics events: about 90 days, and immediately with the account.
• Admin access audit: about 365 days.
• Voice duration events: kept for operational statistics; no audio or transcript is stored on our side.
• Backups and logs may lag deletion by a short operational window.
• We do not keep raw product analytics to satisfy accounting retention. Accounting records, if we have any, follow a separate schedule.

9. Cookies and local storage

We use an essential session cookie (Auth.js JWT, about 30 days, refreshed while you use the site) so you stay signed in. There are no advertising cookies. The analytics session UUID lives in memory only and is not written as a cookie.

The browser may store on your device: UI language, workspace layout (open folders, last selected spot, chat scroll), and unread markers. That data stays in the browser unless you clear it; it is not our server-side profile.

10. Security

We apply ordinary technical measures that fit a small MVP (access control, hashed API tokens, encrypted staff TOTP secrets, TLS in transit, time-limited signed URLs, image checks, zip limits, AES-256-GCM for chat bodies at rest with a server-held key). These measures are best-effort only. They are not a warranty and do not create a higher duty of care than the law already requires. Encryption at rest is not end-to-end encryption: we can decrypt messages to run the product and, if we decide to comply, to an authority. Do not treat Spotbook chats as a sealed messenger. You accept the residual risk of a leak, intrusion, or processor incident.

11. Your rights

Subject to Georgian (and, where applicable, GDPR) limits, you may request access, correction, deletion, restriction, objection to processing based on legitimate interests, and a copy of data you provided in a commonly used format. You can correct nickname, avatar, and about-me in Settings, revoke devices, remove shares, and delete the account yourself.

Privacy requests can be sent to spotbook.support@gmail.com or through the Support space in your Spotbook workspace. We may need to verify that the request comes from the account holder. We handle statutory rights only to the extent the law requires, in the time the law requires, and not beyond. Some data must be kept if the law requires it, if an authority has asked for it, or if it is still needed to establish, exercise, or defend legal claims. If you object to disclosure to authorities or to the residual risk of a leak, stop using the Service and delete your account.

12. Children

The Service is not directed at children under 18. We do not knowingly create accounts for minors. If you believe a minor is using Spotbook, contact us and we will delete the account.

13. Changes

We may update this Policy when the product or the law changes. The effective date is shown at the top. We may, but are not obliged to, mention a change in the product. Continued use after the effective date means you have read the updated Policy.

14. Complaints

You may lodge a complaint with the Personal Data Protection Service of Georgia (personaldata.ge). If GDPR applies to you, you may also contact your local supervisory authority.