spontio.app

How Spontio protects your data, documented in the open.

Where Spontio runs, who processes data for us, how we encrypt and what of it is finished. What is still in progress, we say just as clearly.

As of 10 November 2026

  • Hosted in Germany

    Our own server in Augsburg. No cloud services from the USA.

  • No Google services

    No Google Maps, no reCAPTCHA, no Analytics, no fonts from other servers.

  • End-to-end encryption

    Push notifications are encrypted today. Chats, pins and Orbit follow in steps.

  • GDPR from the start

    Only the data a feature needs, deletion and export for everything, statistics only in aggregate.

Status:DoneIn progressPlanned

Hosting and data

Everything that makes Spontio runs on servers we operate ourselves.

  • Own server in Augsburg

    Done

    The app, its database, sign-in, map and place search run on our own server in Germany.

  • Map and place search run by us

    Done

    Map data from OpenStreetMap, delivered by our server. The search service does not learn who is searching.

  • Nightly backups

    Done

    All databases and uploaded files are backed up every night and kept for 7 days. After that, data you deleted is gone from all backups too.

  • Move to a German data centre

    Planned

    Before the public launch, Spontio moves to Hetzner in Germany. The data stays in Germany.

End-to-end encryption

Private content is encrypted on your device. The server then only stores and forwards data it cannot read. We use MLS (RFC 9420) through the open-source library OpenMLS.

  1. HTTPS and encrypted push notifications

    Push services from Apple, Google and others only see “New activity in Spontio”.

    Done

  2. Foundation

    Keys on the devices, device list, recovery. Not yet visible to you.

    In progress

  3. Pin chats

    Messages in a pin's chat.

    Planned

  4. Pins, answers and circles

    Place, time, note, votes, checklists.

    Planned

  5. Orbit and rides

    Who is nearby, who gives whom a lift.

    Planned

  6. Everything private only in the app

    After this, the full claim applies: private content is end-to-end encrypted.

    Planned

  7. Independent audit

    An external audit of the encryption. We only say “independently audited” after it.

    Planned

We only call a part “encrypted” once it is really live. No back door, no stored copies of keys, only published standard algorithms.

Data protection

Spontio collects only what a feature really needs.

  • Phone number only as a check value

    Done

    We never store the number itself. Names and numbers from your address book never leave your phone.

  • Locations expire

    Done

    Pins are deleted after their retention period.

  • Deletion and export

    Done

    Every kind of personal data is removed when you delete your account and is part of the data export.

  • No content in logs

    Done

    Places, notes and names are not written to server logs. Statistics are aggregated, never per person.

  • No cookies, no tracking

    Done

    This page and spontio.app set no cookies and use no analytics services.

Privacy policy of the app

Service providers

Who besides us processes data, what for and where.

ProviderPurposeWhereBasis
UD MediaDomain, DNS, e-mail mailboxGermanyContract
seven.io (seven communications)SMS codes to confirm a phone numberKiel, EUData processing agreement (Art. 28 GDPR)
Push services of Apple, Google, Mozilla, MicrosoftDelivering encrypted notifications; chosen by your deviceAlso USAEncrypted content only; Data Privacy Framework or standard contractual clauses

Security in operation

  • Two-factor sign-in for admins

    Done

    Admins sign in only with a one-time code. Every admin action is logged.

  • Regular security scans

    Done

    Weekly scans with OWASP ZAP, Trivy and Semgrep. Hardened servers with firewall and automatic updates.

  • Software bill of materials (SBOM)

    Done

    For every version, in CycloneDX 1.6, on request.

  • Captcha without Google

    Done

    Registration is protected by ALTCHA, without tracking and without other servers.

Reporting vulnerabilities

  • Coordinated disclosure

    Done

    Confirmation within 3 working days, a fix within 90 days, at once if it is being exploited. No legal action for good-faith testing.

  • Cyber Resilience Act

    In progress

    Reporting channels and processes under the EU Cyber Resilience Act, before the apps are offered commercially.

Security policy

Apps and export control

  • iOS: encryption declared

    Under review

    The app uses published standard algorithms in its own libraries. Classified as mass-market software (ECCN 5D992.c); documents submitted to Apple.

  • Android

    Done

    Google Play asks no separate questions; the same classification applies.

Documents

Questions?

Report security vulnerabilities to security@spontio.app

Questions about data protection, contracts and documents to info@spontio.app