← sponti

Privacy Policy

This policy explains how we process personal data when you visit our website sponti.fyi and when you use the sponti mobile app(together, the “Service”). We have written it to be transparent and to process as little data as possible. Where a section applies only to the app or only to the website, this is stated.

1. Controller

Cocoa Ventures UG (haftungsbeschränkt)
Auguststr. 87, 10117 Berlin, Germany
represented by Constantin Ehrensberger
Email: support@sponti.fyi

You can reach us for any data-protection matter at support@sponti.fyi. We have not appointed a data protection officer (DPO). Under Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG), a DPO is only mandatory in certain cases — in particular where an organisation constantly employs at least 20 people carrying out automated processing of personal data, or where its core activities involve large-scale or high-risk processing that requires a data protection impact assessment. We meet none of these criteria, so appointing a DPO is not legally required. We state this because Art. 13(1)(b) GDPR requires us to give a DPO’s contact details wherever one exists; as we have none, please direct all data-protection matters to the contact above.

2. The data we process, and why

Below we describe each processing activity, the data involved, the purpose, and the legal basis under the GDPR. We only process data that is necessary for the purpose described.

2.1 Website hosting & server log files

Our website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you access the website, Vercel automatically processes access data in server log files, in particular your IP address, the date and time of access, the page or file requested, and browser, language and device information.

Legal basis: our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel; any transfer to the USA is safeguarded by the EU Standard Contractual Clauses.

2.2 Fonts

We serve fonts locally from our own server. No connection is made to third-party servers (e.g. Google Fonts) and your IP address is not transmitted to third parties for this purpose.

2.3 Waitlist / early access

If you enter your email address in our waitlist form and submit it, we store it to inform you about the launch of sponti and to grant you early access. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future, e.g. by emailing support@sponti.fyi or via the unsubscribe link in any email; we will then delete your address. We delete your address as soon as the purpose no longer applies or you withdraw your consent.

2.4 Account & phone number (app)

To use the app you create an account with your mobile phone number. We verify the number by sending you a one-time code via WhatsApp. We process your phone number to create and secure your account, to sign you in, and to let people you know recognise you (see 2.6). We also store the profile details you choose to add, such as your first name, last name and profile picture.

Legal basis: performance of our contract with you, i.e. providing the Service you signed up for (Art. 6(1)(b) GDPR), and our legitimate interest in account security (Art. 6(1)(f) GDPR). The one-time verification code is delivered through Meta’s WhatsApp Business Platform (WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd.), which processes your phone number and the code solely to deliver the message.

2.5 Profile picture & other content you add

If you upload a profile picture, we store it so that others can recognise you; who can see it is described in section 3. If you add other content (e.g. a note about what you feel like doing), we store it so it can be shown to the people you share it with. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

2.6 Finding people you know (contact matching)

The app helps you find people you already know who also use sponti. This is entirely optional: the app works without it, and it only happens if you actively choose it and grant the relevant permission. Instead of granting access to your whole address book, you can also pick individual contacts, in which case the rest of your address book is never read at all.

The matching works as follows. The conversion into an irreversible cryptographic hash (a one-way “fingerprint”) happens on your device, before anything is sent. Only those hashes reach our server, where they are compared against hashes of numbers already registered with sponti. We use this matching only to show you which of your contacts are on sponti.

We do not upload or store your address book in readable form, we do not use it to contact anyone, and we do not build advertising profiles from it. Hashes are used for the comparison and then discarded — we store neither the hashes that matched nor those that did not, so each check is answered and forgotten. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by revoking the contacts permission in your device settings; and, for people who are matched, our legitimate interest in providing the core friend-finding function of the Service (Art. 6(1)(f) GDPR).

Please note that a phone number is a short piece of information, so a hash of one is not the same as anonymisation — we treat these hashes as personal data and protect them accordingly. We limit how many numbers any one account can check, so the function cannot be misused to work out who is registered with sponti.

2.7 Location & availability (app)

sponti is about seeing who is free and roughly where, so plans can happen. We only process your location while you have set yourself as freeand have chosen to share a live location for that period — never at any other time. While such a free period is active, and only then, the app updates your approximate location from time to time (roughly every few minutes, and only once you have moved a noticeable distance). If you grant the “Always” location permission, these updates can continue while the app is in the background or closed, so your district stays current for your friends; in that case your device shows a system location indicator and the app shows a notice while this is happening. Ending your free period, or removing the shared location, stops all location processing — that is the off switch. Instead of using your device location, you can also simply pick an approximate area yourself.

Before your location is stored, it is deliberately coarsened: it is rounded to an approximately 110-metre grid, so we do not keep your precise position. The people you share it with see an even broader area (roughly a 200-metre halo around that point) — enough to know the district, not your doorstep.

Legal basis: your consent, which you give by setting yourself free with live location sharing (Art. 6(1)(a) GDPR). You can withdraw it at any time by ending your free period, removing the shared location, or revoking the location permission in your device settings.

2.8 Availability entries and, in future, recommendations

When you record when you are free, the plans you create, and the people you meet through sponti, we store this so the Service can work. In the future we intend to use your past availability entries and activity within sponti to make helpful suggestions to you (for example, suggesting a good time or people to reach out to). Any such feature will be limited to improving your own experience within the app.

We do not make decisions that produce legal effects or similarly significantly affect you on the basis of automated processing. Legal basis: performance of the contract for providing the Service (Art. 6(1)(b) GDPR) and our legitimate interest in improving the Service (Art. 6(1)(f) GDPR). Where a future feature would go beyond this, we will ask for your consent (Art. 6(1)(a) GDPR) before enabling it.

2.9 Reaching out and inviting via WhatsApp

When you choose to “ping” someone, or to invite a contact who is not yet on sponti, the app opens WhatsApp with a pre-filled message that you can edit before sending. From that point the conversation takes place in WhatsApp and is governed by WhatsApp’s own terms and privacy policy; we do not receive or store the content of those chats.

It is worth being precise about who is doing what here: sponti never contacts anyone who is not a user. An invitation is sent by you, from your own WhatsApp account, to someone you already have a relationship with — we only prepare the suggested text and the link. We do not send invitations ourselves, and we do not keep a record of the people you invite.

2.10 Push notifications (app)

If you allow notifications, we send you push notifications (for example, when a friend pings you). These are delivered via the operating-system push services of Apple (APNs) and Google (FCM) and, technically, through the Expo push service. You can turn notifications off at any time in your device settings. Legal basis: your consent (Art. 6(1)(a) GDPR).

3. Who receives your data

We do not sell your data, and we do not share it for advertising or with third parties for their own purposes. How your information is visible to other people using the app depends on the type of information:

To operate the Service, we use a small number of carefully selected processors who act only on our instructions under a data processing agreement pursuant to Art. 28 GDPR:

Beyond this, we only disclose data where we are legally required to do so.

4. International transfers

We aim to keep your data within the EU. Where a processor processes data outside the EU/EEA (for example in the USA), the transfer is safeguarded by the European Commission’s Standard Contractual Clauses and, where applicable, additional protective measures.

5. How long we keep your data

We keep your account data for as long as you have an account. Availability entries, plans and related content are kept for as long as needed to provide the Service and are removed in the ordinary course when no longer needed. When you delete your account (see 6), we delete your personal data without undue delay, unless we are legally required to retain certain data for a limited period.

6. Deleting your account

The app is free and you can delete your account at any time — from within the app, or by emailing us at support@sponti.fyi. When you do, we delete your personal data associated with the account without undue delay, subject only to any legal retention obligations.

7. Cookies & tracking

Our website uses no cookies and no tracking. The app contains no third-party advertising trackers and does not track you across other apps or websites.

8. Minimum age

The Service is not directed at children. You must be at least 16 years old to create an account.

9. Your rights

You have the right to:

To exercise any of these rights, contact us at support@sponti.fyi. You also have the right to lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

10. Changes to this policy

We may update this policy to reflect changes to the Service or the law. The current version is always available here, and we will inform you of material changes by appropriate means.

Last updated: July 2026