Last updated 19 October 2026
The short version
You review each garage photo before saving. Marked regions are baked into the saved image. If you explicitly confirm that no regions need blurring, the saved image is not blurred. Camera and library originals may remain in your photo library or temporary device cache.
Nothing is detected for you. You place every blur box yourself, apart from a single suggested box over the licence plate - and you still have to check that one. There is no automatic face detection in OttoSpot.
Without an account, your saved photos stay on your device and are never uploaded. Identifying a car always sends the photo to our identification provider first, account or not - see below. With an account, the blurred photo is also backed up privately so your garage follows you to another device.
We don't use analytics, tracking, or advertising. Nothing in the app reports what you do to anyone. The only servers it talks to are the ones that run it, listed under Where your information is stored.
If the app crashes, it may send us a technical report about the crash itself - never a photo, never your email, and not tied to your account. See Crash reports below.
We do not sell or rent personal information. We share the data needed to operate the app with the service providers described below.
Guests can use manual entry entirely locally. AI identification and optional card rendering send photos through our API to OpenAI; request counters and technical server logs support limits and operation.
Nothing you save is visible to anyone by default. You can create a link for one individual spot if you want to show somebody a car - that is the only way a photo of yours becomes visible to anyone else, it happens only when you ask for it, and you can switch it off again.
If you choose to make your profile public, other signed-in users can see your handle, your name and your garage as cards: what each car is, its rarity, the date, and any garage-card artwork you generated. Never your photos, your notes or where a car was. It is off until you turn it on, and turning it off hides everything again at once.
Identifying a car means sending your photo, unblurred, to our identification provider before you have blurred anything. This happens for every automatic identification; entering a car manually skips it entirely.
If you use multi-angle capture, every photo in the set is sent, not just the one that gets saved. Extra angles are used for identification, are not added to your garage, and are subject to temporary device caching and provider retention.
If you ask for an AI garage card, the already-blurred photo of that spot is sent to the same provider a second time to create the card. This only happens when you tap Generate.
If you join the Leaderboard or a Crew, or make your profile public, the details described below become visible to other signed-in users. Nothing else does, and you can leave or switch off each one at any time.
Who we are
OttoSpot is operated from Ontario, Canada.
You can reach us at hello@ottospot.app about anything in this policy, including a request to see, correct, or delete your information.
What we collect
If you use OttoSpot without an account, your garage is stored only on your own phone, as files inside the app itself. The one record our servers keep is a daily count of identification requests, keyed to a random install id that OttoSpot generates on your device and to your network address, so the daily limit can be enforced. That count is deleted after three days and is never linked to a name, an email, or a garage.
If you create an account, we collect your email address and a password. The password is stored only as a salted hash by our authentication provider; we never see it.
If you create an account, the blurred photo of each spot is stored too, so your garage looks the same on your other devices.
For each car you save while signed in, we store: make, model, generation, trim, approximate model years, the rarity tier, a confidence figure, whether the spot was captured live or imported from your library, any note you add, and the date and time you saved it.
We collect a rough location for a spot only if you turn location on, and only for spots you save afterwards. It is deliberately imprecise - rounded to about a 100 metre block before it is stored, so we never hold the exact address where a car was parked.
Location is off until you switch it on, from either the Map or Settings, and you can refuse and keep using everything else. Turning it off again in Settings takes effect immediately - OttoSpot stops asking for or using location at all, even if your phone's own permission would still allow it.
We do not collect advertising IDs, contacts, or your browsing activity. The random install id described above is generated by OttoSpot itself, is not your device's hardware or advertising identifier, and is used only to count identifications.
Identifying a car sends the photo you just captured - unblurred, because this happens before you have marked anything - to our identification provider. See "Photos and blurring" below for exactly what that provider does and does not do with it.
Multi-angle capture sends every photo in the set. Only the first one is ever saved; the rest are used for the identification and then discarded.
If you join the Leaderboard, we store the display name you chose. Other signed-in users see that name alongside how many cars you have saved and how many were rare, both all time and in the current month, and whether you have OttoSpot Pro. If you create or join a Crew, we store the crew's name and description, your membership, the display name you joined under, and any request to join a crew that asks for approval. A crew's name, description and member count are visible to every signed-in user if its owner lists it on Discover. A listed crew also appears in crew rankings, which show every signed-in user its member count and how many cars, and how many rare cars, its members have saved in total. Inside a crew, the other members can see how many cars, and how many rare cars, each member has saved. A closed crew appears in rankings only to its own members.
If you make your profile public, we store the handle and name you chose and the two switches described under "Public profile and the public map" below. If you follow someone, we store that you follow them; they can see that you did, and both of you see follower counts. If you react to a card, we store which reaction you gave to which card, and its owner sees your handle with it.
We keep notifications for you inside the app: who followed you, who reacted to one of your cards, and who asked to join a crew you own. They are stored on our servers so you see them on any device, and are only ever shown to you.
Lock-screen alerts for these are off until you turn them on in Settings, one switch for each kind. When you turn one on, we store your choices and your phone's push address, a code from Apple that lets an alert reach this phone and nothing else. The alert says who did what, for example that someone started following you. It is sent through Expo's push service and then Apple's. Signing out removes this phone's push address from your account, and turning the switches off stops the alerts.
If you report a name or a crew, we store your report and the reason you wrote. If you block someone, we store that you did, along with the name they were using at the time, so we can keep hiding them from you.
Streak reminders are scheduled by the app on your own phone. Nothing is sent to us to make one happen and no server is involved, so there is nothing about your reminders for us to hold, lose, or hand over. They do not use the push address described above.
The Map's background is Apple Maps. Your phone asks Apple for the map directly, under Apple's own privacy policy, and we receive nothing about where you looked or what you zoomed into. We do not send Apple your spots or anything else about you.
Photos and blurring
With your explicit permission, automatic identification sends the primary photo and extra angles to OpenAI before privacy review. You can decline or withdraw permission in Settings and use manual entry instead.
Multi-angle capture sends up to three photos in one identification. Extra angles are not added to the garage. They can exist in temporary device caches and on the provider under its retention rules.
We use OpenAI API services. API data is not used for training by default. Identification requests disable saved Responses history; separate abuse-monitoring retention may still apply. We do not promise zero retention or immediate deletion from provider systems.
Before a spot is saved, you review the photo and cover the licence plate, and any faces, with blur boxes. That blur is burned into the image itself. Your marked regions are removed from the saved image pixels. This does not delete the source from your photo library or guarantee removal from device caches or provider systems.
If you are not signed in, the blurred photo stays on your phone and is never uploaded. It is a file inside the app itself, and it is removed if you delete the app. A photo kept only there has no copy anywhere else - if you want it backed up, sign in.
If you are signed in, the blurred photo is uploaded so your garage can follow you to another device. It is the blurred image that is uploaded, never the original. It goes into private storage that only your account can read: it has no public address, it cannot be reached by a link, and other users of OttoSpot cannot see it, list it, or replace it.
We can technically reach files in that storage, because we operate it. We do not look at them, and nothing in the app makes them visible to anyone but you.
To keep photos off our services, use manual entry without an account and do not generate AI cards. Guest AI identification still sends photos off the device.
There is no automatic face detection in OttoSpot. You mark every region yourself, apart from the suggested plate box described below, and nothing is blurred that you did not blur. We would rather say that plainly than let you assume a face was caught for you when it was not.
When identification is turned on, the same request that identifies the car also estimates where the licence plate is, and the app starts your blur box there. That is a suggestion from reading this one photo, not a guarantee and not a promise of accuracy. You are the one who must check it, and move, resize, or add to it until the plate and any faces are actually covered, before continuing. Leaving whatever box the app placed does not shift that responsibility off you.
You can add, move or remove blur regions. Saving with none requires confirmation. Check the saved output before sharing.
If you use the holding bay (Hold on the camera), each photo is kept inside the app on your phone, with the time and, if location is on, the place it was taken, so you can identify it later. Until then it is not blurred, it is not in your photo library and it is never uploaded. It is deleted when you save it as a spot or delete it, and anything left after 30 days is deleted automatically.
An AI garage card is optional artwork. Generating one sends the saved photo to OpenAI. The image may contain unblurred regions you chose not to mark; generated artwork can invent details. Review it before sharing. The generated card is stored with your spot and subject to provider retention.
Sharing one spot with a link
You can turn a single spot into a link you can send to someone. It is off until you ask for it, one spot at a time, and nothing is shared automatically.
Anyone who has that link can see the car: its make, model, generation, trim and years, the rarity tier, the date it was spotted, and the blurred photo. That is all the page shows.
It does not show anything about you. Not your name, not your email, not your other spots, not your streak, not any crew you are in. Someone who receives a link learns about a car, not about the person who photographed it.
It does not include the location, even though your own Map may have one for that spot. A rough position is reasonable on a private map of your own spots; it is not reasonable on something that can be forwarded to anyone.
It does not include your note. You wrote that for yourself.
The photo is still stored privately. The link shows it through an address that stops working within the hour, so a copied image address is not a permanent one.
You can stop sharing at any time from the spot itself. The link then shows nothing to anyone, immediately, including to people you already sent it to.
Anyone with the link can open it - it is not tied to an account and does not require one. Treat it the way you would treat any link: whoever you send it to can send it on.
Public profile and the public map
Your profile is private until you turn on "Make my profile public". While it is private, nobody can find you, see your garage, follow you or react to your cards.
A public profile shows other signed-in users your handle, your name, how many cars you have and how many are rare, your follower counts, and your garage as cards. Each card shows the car's make, model, generation, trim and years, its rarity tier, its card number, the date it was saved, the reactions it has had, and the garage-card artwork if you generated one for it.
A public profile never shows your photos. They stay in private storage that only your account can read. Garage-card artwork is a separate image that you chose to create; if you generated one, it is visible on a public profile, so review it before you make your profile public.
A public profile never shows your notes, your email, your streak or where any car was.
The public map is a second, separate switch, and it only works while your profile is public. When it is on, other signed-in users can see your catches on a map with your handle. Each one is held back for at least an hour, its position is rounded to about a kilometre, and it shows the day it was caught but not the time. Only spots that already carry a rough location appear, so if you never turned location on, there is nothing to show.
If you block someone, neither of you can see the other's profile, cards or map points, or follow or react to the other.
Turning your profile off hides your profile, your cards and your map points from everyone immediately. Deleting your account deletes your profile, your follows, your reactions and your notifications with it.
Why we collect it
Your email exists so you can sign in and so your garage can follow you to another device.
Your saved spots exist to be your garage: to show your collection, count your streak, and calculate rarity.
We do not use your information for any purpose other than operating the app.
Where your information is stored
Account details and saved spots are stored using Supabase, our database and authentication provider, in their us-west-2 region. That region is in the United States.
The server that handles identification requests, and the pages at ottospot.app, run on Vercel's global content delivery network. The app is distributed through Apple's App Store and TestFlight; Apple's own privacy policy covers anything Apple collects about that download.
When you use automatic identification, the photo is also sent to OpenAI, our identification provider, for that one request. The same is true of the blurred photo when you generate an AI garage card.
The map's background comes from Apple, as described under What we collect.
If you turn on lock-screen alerts, each alert's text and your phone's push address pass through Expo's push service and Apple's push service to reach your phone.
If crash reporting is switched on for your build of the app, crash reports go to Sentry. See Crash reports below for exactly what is in one.
This means your information is stored and processed outside Canada, and may be accessible to law enforcement or authorities in those countries under their laws. If you would rather not have your information leave Canada, you can use OttoSpot without an account and everything stays on your device.
Crash reports
When the app stops working, we would rather know than not. If crash reporting is switched on for your build, a report is sent to Sentry, a crash-reporting service, describing what the software was doing when it failed.
What a report contains: the error and where in the code it happened, the version of the app, the type of device and its operating system version, and the random install id described under What we collect, so that forty crashes from one phone can be told apart from one crash on forty phones.
What a report does not contain: your photos, your email address, your account, your location, your saved spots, or a screen recording. We do not attach images to crash reports and nothing in the app does so.
Crash reports go to Sentry's servers, which are outside Canada. If crash reporting is not switched on for your build of the app, nothing is collected or sent at all - no report, and no connection to Sentry.
How long we keep it
We keep your account and saved spots until you delete them.
Settings has a Delete account option that permanently removes your account, your saved spots, and any stored files. This is immediate and cannot be undone.
Deleting a spot deletes its uploaded photo along with it.
Deleting the app removes everything it kept on the phone - the photos, the garage, and the working copies made while blurring. That does not touch what is stored under your account on our servers; use Delete account for that.
Your rights
You can see everything we hold about you at any time using Export my data in Settings, which produces a file containing your account email, your streak, and every saved spot - including any rough locations attached to them. If you are signed in, it also contains your profile, who you follow and who follows you (by public handle only), the reactions you have given, your notifications, your leaderboard name, your crews and join requests, and the names you have blocked. Reports you have filed are kept for moderation and are not in the file; email us for a copy.
You can correct an identification yourself from any spot in your garage.
You can delete everything from Settings, without contacting us.
You can withdraw consent by deleting your account. The app will keep working without one.
If you would prefer to make any of these requests in writing, email hello@ottospot.app and we will respond within 30 days.
Security
All traffic between the app and our servers uses encrypted connections.
Database access is restricted by row-level security so that your spots are readable only by your account. Stored files are in a private bucket that is not publicly accessible.
No system is perfectly secure. AI identification sends unblurred photos through our server with your permission, including for guests. Saved account photos use private storage. Review your blur regions and any generated artwork before sharing.
Children
OttoSpot is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.
Changes to this policy
If we change what we collect or how we use it, we will update this page and the date at the top.
Complaints
If you are unhappy with how we have handled your information, contact us first at hello@ottospot.app.
You also have the right to complain to the Office of the Privacy Commissioner of Canada.