Privacy Policy

AeroSpottle ("we", "us", or "our") operates the website at aerospottle.com. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. By using AeroSpottle you agree to the practices described below.

1. Information We Collect

Account information — When you create an account we collect your email address and the username you choose. These are stored securely via Google Firebase.

Gameplay data — We store your game statistics (games played, wins, streaks), guess history, earned badges, card inventory, and leaderboard entries so you can track your progress over time.

Profile content — If you write a profile bio, that text is stored in our database. All accounts can set a bio; AeroSpottle Pro extends the character limit.

Payment information — If you subscribe to AeroSpottle Pro, your payment is processed by Stripe. We never see or store your card number. We do store your Stripe customer ID, subscription status, plan, and renewal date so we know your account is active.

Technical data — Your IP address may be stored in the following circumstances: when a security event is detected (such as repeated failed login attempts), it is recorded in a security log retained for 30 days; if you submit a DMCA notice, your IP address is stored permanently alongside the notice record; and when rate limiting is applied, usage records keyed by IP are retained temporarily until our weekly cleanup. Your IP address is also logged by our hosting provider (Vercel) as part of normal infrastructure operation.

Push notification data — If you enable web push notifications, your browser's push subscription details (a device-specific endpoint URL and encryption keys) are stored in our database and used solely to deliver game reminders. You can revoke this at any time in your browser or device notification settings.

Browser storage — We use localStorage and sessionStorage to store game state, preferences, and session data locally on your device. Firebase Auth also stores your login session in localStorage. See our Cookie Policy for a full list of keys and their purposes.

2. How We Use Your Information

• To create and manage your account
• To display your stats, streak, badges, and leaderboard rank
• To process Pro subscription payments and confirm your access level
• To enforce our Terms of Service (e.g. detecting cheating or abuse)
• To send you transactional emails, including: account verification, welcome messages, daily game reminders (if opted in), streak warning notifications (if opted in), Pro subscription confirmations and renewal notices, contributor approval notifications, and DMCA correspondence
• To contact you if you reach out to us for support

We do not sell your personal data. We do not use your data for advertising.

3. Third-Party Services

We use the following third-party services that may process your data:

• Google Firebase (Firebase Authentication and Cloud Firestore) — handles account login and stores your game data. Governed by Google's Privacy Policy.
• Stripe — processes subscription payments. Governed by Stripe's Privacy Policy.
• Google Fonts — fonts are loaded from Google's CDN. Google's servers receive your IP address as part of this request.
• Vercel — our hosting provider. Vercel may log request metadata (IP, URL, timestamp) for infrastructure purposes.
• Resend — our transactional email provider. Resend processes your email address and name to deliver account emails (welcome, verification, daily reminders, streak alerts, Pro notifications, and DMCA correspondence). Governed by Resend's Privacy Policy.
• Discord — when you win a game, your in-game username, your answer, your score, and your current streak may be posted automatically to our Discord community server via a webhook. This data is visible to Discord server members. Discord is governed by Discord's Privacy Policy.

4. Data Retention

Your account and associated data are retained for as long as your account is active. You can delete your account directly from your profile page, which will remove your authentication record, public profile, game statistics, and username reservation. Some associated records — including card inventory, earned badges, subscription history, push notification subscriptions, and notification preferences — may remain in our database after a self-service deletion. To request complete removal of all data associated with your account, contact us at privacy@aerospottle.com and we will process your request manually. Some data may persist in our infrastructure backups for a short period before being fully purged.

5. Children's Privacy

AeroSpottle is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it promptly.

If you are located in the European Economic Area, you must be at least 16 years old to use AeroSpottle, unless your country's law permits a lower age with parental consent.

6. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to certain processing of your data

To exercise any of these rights, contact us at privacy@aerospottle.com. You can also delete your account directly from your profile page; for complete data removal, follow up by email as described in Section 4.

7. Security

We use industry-standard practices to protect your data, including Firebase's built-in security rules, encrypted connections (HTTPS), and server-side verification for sensitive operations. However, no system is completely secure. Please use a strong, unique password for your account.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of AeroSpottle after a change constitutes acceptance of the updated policy.

9. Contact