Spur Privacy Policy

Last updated: August 3, 2026

This Privacy Policy explains how Shotz App LLC, doing business as Spur ("Spur," "we," "us," or "our"), collects, uses, shares, and protects personal information when you use the Spur mobile application, website, and related services (collectively, the "Service").

Spur is a personal action app that helps users choose a direction, set goals, receive practical action recommendations, complete check-ins, and review progress. Depending on how you use the Service, this may involve information about your goals, routines, current circumstances, available time and energy, completed actions, and reflections.

If you do not agree with this Privacy Policy, do not use the Service. If you have questions, contact us at simon@shotzapp.app.

We collect information you provide directly, information collected automatically when you use the Service, and limited information from third parties.

Depending on the features you use, we may collect:

• Account information, such as your email address, password, authentication details, and account identifier.
• Onboarding and profile information, such as your life stage, areas you want to improve, goals, current situation, obstacles, motivation, confidence, preferred support style, available time, energy, setting, and other preferences.
• Planning and progress information, such as your selected 90-day direction, goals, milestones, action recommendations, completed wins, check-ins, streaks, badges, and optional reflections.
• Information you choose to provide about areas such as career, education, health, money, relationships, business, creativity, home, or personal growth.
• Reminder and notification preferences.
• Support and communication information you provide when you contact us.
• Social login information if you choose to sign in with Apple or another supported provider.

Some information you choose to provide may be sensitive or reveal sensitive details about your life. Please do not provide information that you do not want processed as described in this Policy.

Payment processing is handled by Apple through the App Store. We do not store your full payment card number or security code. When the app starts with subscriptions configured, RevenueCat may be contacted to load offerings and entitlement status even if you have not purchased. RevenueCat initially assigns an SDK-generated anonymous identifier; after you sign in, Spur provides your Supabase account identifier as the RevenueCat App User ID. RevenueCat and Apple may process device, app, network, diagnostic, offering, subscription, trial, transaction, renewal, expiration, purchase, and restore information needed to provide and secure subscriptions. Spur does not deliberately send RevenueCat your email address, goals, reflections, or health-related text.

Apple's privacy policy is available at https://www.apple.com/legal/privacy/en-ww/.

We may collect information needed to operate, secure, and improve the Service, including:

• Device, app, operating system, language, region, and network information.
• Log, diagnostic, crash, error, and performance information.
• App activity related to account access, onboarding, feature usage, recommendations, check-ins, completed actions, paywall presentation, purchases, restores, and error handling.
• Reminder and notification settings you choose, and whether notification permission has been granted or denied on your device.
• IP address, app version, usage timestamps, and related technical information.

You can manage notification permission in your device settings.

Spur offers a separate, optional choice to help measure and improve Meta advertising campaigns. The choice is off by default and is not required to create an account, use the app, or purchase a subscription. If you select it, iOS presents Apple's App Tracking Transparency permission request. Mobile advertising measurement activates only when both your Spur choice and the current iOS tracking authorization are affirmative.

When activated, the Meta SDK may receive limited device and app-event information such as an advertising or device identifier, Meta's anonymous app identifier, IP address, device and app information, install or app-activation information, and coarse events such as registration completed, onboarding completed, subscription content viewed, checkout initiated, trial started, subscribed, renewed, or purchased. RevenueCat may provide verified subscription lifecycle and revenue information to Meta, and Apple's privacy-preserving advertising-attribution systems may provide campaign postbacks.

Spur does not send Meta your email address, Supabase account identifier, goals, onboarding answers, reflections, check-in answers, recommendation text, health or fitness information, AI prompts, precise location, contacts, or other user-provided content for advertising. We do not use Meta advanced matching in the mobile app.

You may decline at the initial screen or change the separate Advertising measurement control in the app's Privacy center. You may also change tracking authorization in iOS Settings. If either permission is off, Spur stops sending new mobile advertising events. A withdrawal cannot retrieve information previously received by Meta, Apple, or RevenueCat.

Our website host may process standard technical information needed to deliver and secure the website, such as IP address, browser or device information, requested pages, timestamps, and diagnostic logs.

If you consent to advertising cookies and similar technologies, we use the Meta Pixel on general public marketing pages to send a generic PageView event. We use this information to measure Spur campaigns and personalize Spur ads on Meta services. The Pixel remains off if you select “Reject all” or have Global Privacy Control enabled. It does not fire on our legal or consumer-health privacy pages, and we do not configure it to send goals, reflections, form entries, app activity, consumer health data, or other sensitive app content. See our Cookie Notice and use “Cookie settings” in the website footer to change your preferences.

We may receive limited information from third parties, including:

• Apple or another supported identity provider when you use its sign-in service.
• Apple and RevenueCat for subscriptions, billing status, purchase validation, and restore events.
• Service providers that help us operate authentication, cloud infrastructure, storage, security, or AI-assisted features.

The information we receive depends on the third party, the feature you use, and your settings with that provider.

We use personal information to:

• Create, authenticate, maintain, and secure your account.
• Save and sync your onboarding answers, goals, settings, recommendations, check-ins, completed actions, and progress.
• Generate, size, explain, and improve action recommendations.
• Provide reminders, subscriptions, account controls, and support.
• Process entitlement checks, purchases, trials, renewals, and restores.
• Personalize the Service based on information you have provided and choices you have made.
• Analyze product performance, reliability, safety, and aggregate usage trends.
• Measure website reliability using necessary operational information.
• Measure advertising campaigns only when you accept optional advertising technology.
• Attribute app installs, registrations, trials, subscriptions, and related revenue to Meta campaigns, and optimize those campaigns, only when optional mobile advertising measurement and required platform permission are active.
• Detect abuse, prevent fraud, troubleshoot problems, and protect users and the Service.
• Send service-related notices, updates, and policy changes.
• Comply with law and enforce our legal terms.

We do not sell your personal information for money.

Spur may use OpenAI to synthesize onboarding information and create or word personalized goals and next-action recommendations. This sharing is off by default. It occurs only after the app presents a separate AI-personalization request and you affirmatively select “Use AI personalization.” Spur records your current choice, the disclosure version, and the time it changed.

When enabled, an OpenAI request may include information you provided and related state derived from your use of Spur, including:

• Your direction, goal, milestone, success signal, goal category, and current milestone phase.
• Your life stage, change mode, current situation or progress, blocker, normal capacity, aspiration text, and boundaries.
• Your currently available time, energy, focus need, resources, and relevant current-context details.
• Recent action information, including action titles, action type, target, output, and outcome, plus labels for completed outputs.

These fields may contain consumer health data or other sensitive information if you entered such information into Spur. They are sent to OpenAI only to generate the requested synthesis or recommendation; Spur does not attach your password, email address, or Supabase user identifier to the OpenAI request.

Spur sends OpenAI API requests with storage disabled for application state. OpenAI states that API data is not used to train its models by default. However, unless Spur's OpenAI project has an approved stricter retention control, OpenAI may retain prompts, responses, and related metadata in abuse-monitoring logs for up to 30 days, and longer where required by law or reasonably necessary to prevent harm. “Storage disabled” is not the same as Zero Data Retention.

AI sharing is optional. If you decline, Spur uses deterministic features and wording instead. You can withdraw the preference in the app at any time. The server uses its stored consent record—not a client-provided flag—to decide whether a new request may use OpenAI. Withdrawal stops future OpenAI requests; it cannot recall a request that was already transmitted or content retained by OpenAI under its applicable retention rules.

Do not submit information you do not want processed by an AI provider. AI outputs may be incomplete or inaccurate and should not be treated as professional advice.

If you are in the EEA, UK, or Switzerland, we process personal information where we have a valid legal basis, including:

• Your consent.
• Performance of a contract with you.
• Our legitimate interests, such as operating, securing, and improving the Service.
• Compliance with legal obligations.
• Protection of vital interests where applicable.

If you are in Canada, we may process information with your express or implied consent, or where otherwise permitted by law.

We may share personal information:

• With service providers that help us operate, host, secure, support, or improve the Service.
• With Apple, RevenueCat, or an identity provider when needed for login, subscription processing, purchase validation, restores, or platform compliance.
• With Meta, Apple, and RevenueCat for optional mobile advertising attribution and campaign optimization when you have enabled the feature and required platform permission is active.
• With OpenAI when you use an AI-assisted feature and the applicable permission or other lawful basis is present.
• If required by law, subpoena, court order, or similar legal process.
• To protect the rights, safety, security, or integrity of Spur, our users, or others.
• In connection with a merger, financing, acquisition, reorganization, or sale of assets.

We require service providers to process personal information only for authorized purposes and to protect it appropriately.

Our providers may include:

• Supabase for authentication, database, backend infrastructure, and cloud services.
• Apple for Sign in with Apple, App Store billing, subscription processing, and related account events.
• RevenueCat for offerings, subscription management, entitlement status, purchases, restores, and customer support tools; it may be contacted before a purchase and receives the account identifier described above after sign-in.
• OpenAI for optional AI-assisted features after separate consent, including the data categories and retention described in Section 3.
• Website hosting and infrastructure providers.
• Meta Platforms, Inc. for optional website Pixel measurement and, when separately enabled in the mobile app and authorized through iOS, limited mobile install, funnel, and subscription attribution. Meta does not receive Spur goals, reflections, health information, email, account identifiers, or other user-provided app content from this integration.

We and our service providers may process information in the United States and other countries where we or our providers operate. Those countries may not provide the same level of legal protection as your home jurisdiction. Where required, we use appropriate safeguards, such as contractual protections.

We keep personal information for as long as reasonably necessary to provide the Service, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service.

In general:

• Account and app data may be retained while your account remains active.
• Subscription and transaction records may be retained for accounting, fraud prevention, legal compliance, and audit purposes.
• Meta and RevenueCat may retain optional advertising-attribution and subscription-event information under their respective policies after it is transmitted; turning the feature off stops future sharing but does not recall prior events.
• Operational logs and isolated backups may remain for a limited period after account deletion and are not used to provide or personalize the Service.
• OpenAI may retain content from consented API requests in abuse-monitoring logs for up to 30 days unless a stricter approved project setting applies, subject to the exceptions described in Section 3.
• A minimal account tombstone and legal-acceptance record may be retained to document deletion, consent, security, fraud prevention, or legal compliance.
• De-identified or anonymized information may be retained where permitted by law.

When information is no longer needed, we will delete, anonymize, or securely isolate it unless retention is required by law.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. However, no system is completely secure, and we cannot guarantee absolute security.

You should protect your device and login credentials and use available device-level security protections.

Spur is not intended for children under 18, and we do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take reasonable steps to delete it. If you believe a child has provided information to us, contact us at simon@shotzapp.app.

Depending on where you live, you may have rights to:

• Access personal information we hold about you.
• Correct inaccurate personal information.
• Delete personal information.
• Obtain a copy of your personal information.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.
• Appeal certain decisions about privacy requests.
• Opt out of certain uses, sharing, or targeted advertising where required by law.
• Lodge a complaint with a data protection authority.

We do not sell personal information for money.

If you consent to the Meta Pixel or optional mobile advertising measurement, that use may constitute targeted advertising, tracking, or sharing under some laws. You may opt out of website measurement through “Cookie settings” and mobile measurement through the app's Privacy center and iOS Settings. Spur also treats Global Privacy Control as an opt-out for website advertising cookies and similar technologies.

To exercise privacy rights, use the Privacy center and account controls in the app, review our account and data deletion instructions, or contact us at simon@shotzapp.app with “Privacy request” in the subject. We may need to verify your identity before completing a request. We generally respond within 45 days; if reasonably necessary and allowed by law, we may extend once and explain why. You may designate an authorized agent where permitted by law. If we deny a request, you may appeal by replying with “Privacy appeal”; the appeal will receive a fresh review.

If you are a resident of a US state with applicable privacy laws, you may have rights to know, access, correct, delete, or obtain a copy of personal information and to exercise other rights provided by state law.

Categories of personal information we may collect include:

• Identifiers, such as email address, account identifiers, and IP address.
• Customer record and profile information you provide.
• Commercial information related to subscriptions and transactions.
• Internet or network activity information.
• Inferences and preferences used to personalize recommendations.
• Sensitive personal information you choose to provide, including account login information or details related to health, finances, relationships, education, or other life circumstances.

We use sensitive personal information only for permitted purposes or with consent where required. We do not use it to infer characteristics for advertising.

Information about health, wellness, energy, physical constraints, or related inferences may be “consumer health data” under state law even though Spur is not subject to HIPAA for ordinary consumer-app operations. Our Consumer Health Data Privacy Policy describes the categories, sources, purposes, processors, consent choices, and Washington-specific rights that apply.

The Service may link to or rely on third-party services. Their handling of your information is governed by their own privacy policies, not this Policy.

Some browsers offer a "Do Not Track" setting. Because there is no universally accepted standard for responding to that setting, we do not currently respond to it. We do respond to Global Privacy Control by keeping optional website advertising technology off. Mobile tracking choices are controlled separately in Spur and through Apple's App Tracking Transparency settings.

We may update this Privacy Policy from time to time. If we make material changes, we may notify you by updating the date above, posting a notice in the app or on the website, or using other appropriate means.

If you have questions or requests about this Privacy Policy, contact us at:

Shotz App LLC 1040 Spring Street Apt D Madison, WI 53715 United States Email: simon@shotzapp.app

You may review or update some account information inside the app. You may also request access, correction, or deletion by emailing simon@shotzapp.app.

We may retain certain information where required or permitted by law, including for fraud prevention, legal compliance, accounting, dispute resolution, and enforcement of our agreements.