Privacy Policy

App / service name: SpotMesh
Package: in.spotmesh.app
Website: https://spotmesh.in
Privacy contact: privacy@spotmesh.in
Support: support@spotmesh.in

SpotMesh is a hyperlocal thought-sharing product for neighborhoods (primarily India and other regions we may support).

Depending on how you use the Service, we may collect the following. We limit collection to what is needed to operate SpotMesh.

• Account & identity: display / mesh name; if you sign in with Google — Google subject ID, name, email (if provided by Google), and avatar URL. Guest or session identifiers when you use guest mode.
• Location (precise, when in use): device coordinates while you use nearby feed, posting, map, or related features. We request location while using the app (not continuous background tracking for ads). Exact map pins on posts are shown to others only when your status is Online; Away / Ghost keep pins private (feed relevance may still use location you provide while using the app).
• User-generated content: posts, hashtags/tags, likes, comments, replies, reports, fulfilment status, and related metadata (timestamps, expiry / TTL, boost flags).
• Device & app technical data: IP address, device/OS/app version, approximate network info, crash and diagnostics (e.g. via Sentry when enabled), and optional push notification tokens (FCM / Expo).
• Purchase & entitlement data: product IDs, entitlement status, and purchase tokens / receipts processed via Google Play Billing and RevenueCat. We do not store full payment card numbers or government ID numbers.
• Communications: messages you send to support, privacy, or via in-app / web contact forms (processed with our email provider).

We do not collect phonebook/contacts, SMS, call logs, microphone, camera, Health Connect data, or an inventory of other apps on your device for SpotMesh features. We do not collect persistent hardware identifiers such as IMEI, IMSI, or SIM serial numbers, and we do not link such identifiers to your account or location. We do not use the Android Advertising ID to sell ads in SpotMesh today.

• Provide the hyperlocal feed, search radius, map pins, and live updates.
• Authenticate you and secure sessions (signed JWT — httpOnly cookie on web; Bearer token on mobile).
• Process Premium and one-time purchases and unlock entitlements.
• Send optional push / in-app alerts (e.g. tag alerts) that you configure.
• Moderate abuse, spam, fraud, illegal content, and safety risks.
• Improve reliability, fix bugs, and understand aggregate product usage.
• Respond to support and privacy requests; comply with law and enforce our Terms.

Legal bases may include: performance of a contract (providing the Service), consent (e.g. OS location / notification permissions and certain optional features), legitimate interests (security, abuse prevention, product improvement), and legal obligations.

SpotMesh is location-based. Location is core to showing nearby posts. Before Android grants access, the system shows a runtime permission. By allowing location and using the Service, you agree that we may process precise location while you use the app to show nearby content and to attach location metadata to posts you create. You control map-pin visibility via Online / Away / Ghost. Do not use Online if you do not want a shareable map pin on new posts. Denying location may limit or break core features; a fallback/demo location may be used only where disclosed in-product.

Location can reveal sensitive patterns (home, work, routines). Use Ghost/Away when appropriate. We are not responsible for how others use information you choose to make public on posts.

We do not sell personal or sensitive user data (including for monetary consideration). We share data only as needed to run SpotMesh, with:

• Other users — content and profile information you publish (including Online map pins).
• Google — Google Sign-In / Identity; Google Play for distribution and Play Billing.
• RevenueCat — purchase / entitlement infrastructure on mobile.
• Cloud hosting & database — e.g. Google Cloud Run and managed PostgreSQL/PostGIS for the API and data storage.
• Resend — transactional email (support / account deletion confirmations).
• Expo / Firebase Cloud Messaging — optional push delivery when you enable notifications.
• Sentry — crash and error diagnostics when enabled in a build.

These parties process data on our behalf or as independent controllers where required by their role (e.g. Google as identity/billing provider). We may also disclose data if required by law, court order, or to protect rights, safety, and the Service. If we use additional SDKs later, we will update this Policy and the Play Console Data safety form.

We handle personal and sensitive data with reasonable technical and organizational measures, including transmitting data over HTTPS, access controls, and signed sessions. No method of transmission or storage is 100% secure. You use the Service at your own risk regarding residual security threats.

• Posts expire according to product TTL / intent rules unless extended or removed.
• You may delete your own posts and many comments subject to product limits.
• Account, moderation, and purchase records may be kept as needed for billing, fraud prevention, disputes, security, and legal compliance — as disclosed here — not as a substitute for account deletion.

SpotMesh accounts (Google or guest sessions tied to our servers) can be deleted on request. Account freezing is not offered as a substitute for deletion.

• In the Android app: Account → Delete account (sends a verified request to our privacy inbox).
• On the web (required external resource): https://spotmesh.in/account-deletion
• Or email privacy@spotmesh.in from the same Google account email you use on SpotMesh.

After we verify ownership, we delete or anonymize personal account data associated with the app account within a reasonable period (generally within 30 days), except data we must retain for law, fraud, disputes, security, or accounting (e.g. limited billing tokens / transaction records). Those limited retentions are described in this Policy.

• Sign out; revoke Google access in your Google Account settings.
• Change Online / Away / Ghost; manage OS location and notification permissions (runtime prompts).
• Request access, correction, erasure, or a copy of your data via privacy@spotmesh.in (subject to verification and legal exceptions).
• Depending on applicable law (including India’s Digital Personal Data Protection Act, 2023, where it applies), you may have additional rights and grievance redressal. Contact privacy@spotmesh.in.

SpotMesh is not directed to children under 13 (or the higher age required in your jurisdiction, including 18 where required for certain online services). We do not knowingly collect personal data from children for child-directed experiences. Do not use the Service if you are under the applicable age. If we learn we collected data from a child contrary to this Policy, we will delete it. See also our Child & user safety page.

Servers and vendors may process data in India and/or other countries. Where data is transferred internationally, we take reasonable contractual and technical steps appropriate to the Service’s stage.

Disclosures in the Google Play Console Data safety form for SpotMesh are intended to match this Policy (collection, sharing, security practices, and deletion). If there is ever a conflict, contact us and we will correct the form or this Policy promptly.

We may update this Policy. The “Last updated” date will change; material changes may be notified in-app or on the website. Continued use after changes means you accept the updated Policy.

Terms of Use · Community Guidelines · Child & user safety · Cookie Policy · Account deletion