1. Who we are
SPONTO LTD (“Sponto”, “we”, “us”, “our”) is an independent developer and publisher of software applications for Apple platforms, including iPhone, iPad, Apple Watch, Mac, Apple TV and Apple Vision Pro (together, the “Apps”), and operates this website at sponto.top (the “Site”).
For the purposes of the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“GDPR”) and similar laws, SPONTO LTD is the controller of the personal information described in this policy, unless we tell you otherwise for a specific App. You can contact us about anything in this policy at [email protected].
2. Scope
This policy applies to all Apps published by SPONTO LTD on the Apple App Store and to the Site. Some Apps may have an app-specific privacy notice (linked from the App Store listing or in-app) describing additional features; where it does, that notice supplements this policy and prevails for that App if the two conflict.
This policy does not cover third-party services we don't control, such as Apple's App Store, iCloud, Apple Health or websites linked from our Apps. Their own privacy policies apply. In particular, when you download or purchase an App, Apple processes your payment and account information under the Apple Privacy Policy; we do not receive your card details.
3. Information we collect
Many of our Apps collect no personal information at all and work entirely on your device. What we collect depends on the App and the features you choose to use. It falls into three groups:
3.1 Information you give us
- Support and correspondence — your name, email address and the contents of messages you send us (including attachments such as screenshots), plus any device or app details you include.
- Account information — if an App offers an optional account, the email address or Sign in with Apple identifier you use (which may be a private relay address), a display name, and your preferences.
- User content — notes, text, images, audio, files or other content you create or import. By default this content stays on your device or in your private iCloud account. It reaches our servers only when a feature needs it (for example, cloud backup or an AI feature you've enabled), and we say so in the App.
- Feedback, surveys and reviews — answers you choose to give us.
3.2 Information collected automatically
- Diagnostics — crash logs, performance data and error reports (device model, OS version, App version, timestamps, memory state). These are not used to identify you.
- Usage data — aggregated, de-identified information about how features are used (for example, which screens are opened), where an App includes analytics and, where required, you have consented.
- Technical identifiers — an App-generated random identifier or Apple's identifier for vendor (IDFV), used to keep settings, prevent abuse and connect crash reports. We do not access the advertising identifier (IDFA) unless you allow tracking via Apple's App Tracking Transparency prompt.
- Site data — when you visit the Site, our hosting provider (Google Firebase Hosting) processes standard server logs such as IP address, browser type, requested page and time, for security and delivery. The Site uses no advertising or analytics cookies (see our Cookie Policy).
3.3 Information from third parties
- Apple — transaction confirmations (product purchased, date, country, subscription status and an anonymous transaction ID) so we can unlock purchases. Apple also provides us with aggregated, anonymised App Analytics and sales reports, and crash reports from users who have chosen to share them with developers.
- Sign in with Apple — if used, a stable user identifier, and optionally your name and email (or a private relay address), as you choose.
What we don't collect: we do not collect payment card numbers, precise location in the background, contacts, biometric data (Face ID / Touch ID data never leaves Apple's Secure Enclave), or any information from your device without a clear purpose described here or in the App.
4. App Store privacy labels
Every App's App Store page includes an Apple “App Privacy” label summarising its data practices. We keep those labels accurate and up to date. The table below shows the categories our Apps may use and how. Each App only uses the categories shown on its own label.
| Category | Examples | Purpose | Linked to you? | Used to track? |
|---|---|---|---|---|
| Contact info | Email address, name | Support, account, App functionality | Yes, if you provide it | No |
| User content | Text, photos, audio, customer support messages | App functionality, opt-in AI features | Only when you use a cloud or AI feature | No |
| Identifiers | User ID, device ID (IDFV) | App functionality, fraud prevention | Sometimes | No |
| Purchases | Purchase history, subscription status | Unlocking features, support | Sometimes | No |
| Diagnostics | Crash data, performance data | Fixing bugs, improving stability | No | No |
| Usage data | Product interaction | Analytics, product improvement | No | No |
| Health & fitness | Data read from Apple Health with permission | App functionality only | Stays on device | Never |
5. How we use information and our legal bases
We use personal information only for the purposes below. Where the UK GDPR or GDPR applies, we rely on the legal bases shown.
| Purpose | Legal basis (UK/EU) |
|---|---|
| Providing the Apps and their features, syncing, unlocking purchases and subscriptions | Performance of a contract |
| Responding to support requests and communicating with you about your account or purchases | Contract; legitimate interests in helping our users |
| Running optional AI features you have enabled | Consent (you can withdraw at any time) |
| Crash reporting, diagnostics and keeping the Apps secure and free from abuse | Legitimate interests in reliable, secure software |
| Optional analytics to understand and improve the Apps | Consent where required by law; otherwise legitimate interests, using de-identified data |
| Sending optional news or marketing emails | Consent (unsubscribe in any email) |
| Complying with legal obligations, tax and accounting, responding to lawful requests, enforcing our terms | Legal obligation; legitimate interests |
We do not use personal information for automated decision-making that produces legal or similarly significant effects on you, and we do not sell personal information or use it for cross-context behavioural advertising.
6. AI features and your consent
Some Apps offer features powered by artificial intelligence, such as summarising, rewriting, generating images, transcribing audio or answering questions. We handle these with particular care:
- On-device first. Where possible, AI runs entirely on your device (for example, using Apple Intelligence or Core ML) and your content never leaves it.
- Explicit permission before sharing. Before any App sends your personal data or content to a third-party AI provider, it will clearly tell you what data will be shared, who it will be shared with, and why — and will ask for your explicit permission. AI features that rely on third-party processing remain off until you agree.
- No training on your content. We don't use your content to train AI models, and our AI providers are contractually prohibited from using it to train theirs.
- Limited retention. Prompts and outputs are processed to deliver the result and are not kept by us longer than needed. Providers may retain data briefly (typically up to 30 days) solely for abuse monitoring, then delete it.
- Withdraw any time. Turn AI features off in the App's settings to stop future sharing. Withdrawal doesn't affect processing that already took place.
Full details, including provider categories and content rules, are in our AI Use & Consent Policy.
7. Device permissions
Apps only request access to device features when you use a feature that needs them, and always through Apple's system permission prompt. You can change permissions any time in Settings › Privacy & Security or Settings › [App name].
| Permission | Why an App might ask | What happens to the data |
|---|---|---|
| Camera / Photos | Scanning, capturing or importing images you choose | Processed on device; only the items you select are accessed |
| Microphone / Speech | Voice notes, dictation, transcription | On device where possible; sent to a provider only with AI consent |
| Location | Location-based features while the App is in use | Used for the feature only; not stored on our servers or sold |
| Notifications | Reminders and alerts you set up | Scheduled locally or via Apple Push Notification service |
| Health | Reading or writing fitness/health data you authorise | Stays on device; see Section 8 |
| Calendars / Reminders / Contacts | Features that work with your own items | Accessed on device only; never uploaded without telling you |
| Siri & Shortcuts | Voice and automation actions | Handled by Apple under its own privacy terms |
8. Apple services and health data
- iCloud / CloudKit. If you enable sync, your data is stored in your private iCloud database by Apple. We cannot access it. You can manage or delete it in Settings › [your name] › iCloud.
- HealthKit. Data obtained through Apple Health is used only to provide the App's health or fitness features. It is never used for advertising, marketing or data-mining, never sold, never shared with third parties without your express consent, and never stored in iCloud other than through Apple's own Health sync.
- StoreKit. Purchases are handled by Apple. We receive confirmation of what was purchased so we can unlock it, never your payment details.
- Sign in with Apple. You may choose to hide your email; we'll communicate via Apple's private relay address.
9. Analytics and crash reports
To keep the Apps stable, we may use Apple's built-in App Analytics and crash reporting (shared only if you allow “Share with App Developers” in Settings › Privacy & Security › Analytics & Improvements) and, in some Apps, a privacy-respecting crash or analytics SDK such as Google Firebase Crashlytics or Analytics. Where we use one, we configure it to collect the minimum, disable advertising features, and—where the law requires—ask for consent first. You can opt out in the App's settings where available.
10. Advertising and tracking
Most of our Apps contain no advertising. If an App does show ads:
- It will request permission through Apple's App Tracking Transparency prompt before tracking you across other companies' apps and websites or accessing the IDFA. If you choose “Ask App Not to Track”, you'll only see non-personalised ads and the App will still work.
- In the UK, EEA and Switzerland, we use a consent management tool certified under the IAB Transparency & Consent Framework or Google's consent requirements before any personalised ads are shown.
- The ad partners and the data they receive will be listed in that App's privacy notice and App Store privacy label.
11. How we share information
We share personal information only as described below:
- Service providers (processors) who help us run the Apps and Site under written contracts that require them to protect the data and use it only on our instructions — for example, cloud hosting (Google Cloud / Firebase), email and support tools, crash reporting, and AI providers you have consented to.
- Apple, as the distributor of our Apps and processor of payments.
- Publishing partners. Where we publish an App in partnership with its creator, we may share aggregated, non-identifying performance and sales data with that partner. We do not share your personal information with partners unless necessary to resolve your support request and you are told.
- Legal and safety. When required by law, court order or regulator, or to protect the rights, property or safety of our users, the public or Sponto.
- Business transfers. If Sponto is involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner, who must honour this policy.
- With your consent or at your direction, such as when you choose to share content to another app.
We never sell personal information, and we never share it for cross-context behavioural advertising.
12. International transfers
Our service providers may process data in countries outside the UK or EEA, including the United States. When we transfer personal information internationally, we use appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, adequacy decisions (including the EU–US Data Privacy Framework and UK Extension, where the recipient is certified), and supplementary measures where needed. You can request more information by contacting us.
13. Data retention
| Data | How long we keep it |
|---|---|
| On-device and iCloud data | Controlled by you; removed when you delete it or the App |
| Account data | While your account is active; deleted within 30 days of an account deletion request |
| Support emails | Up to 24 months after the conversation ends, then deleted |
| AI prompts and outputs on our servers | Not stored beyond processing, unless you save them in the App |
| Crash and diagnostic data | Up to 90 days (aggregated statistics may be kept longer) |
| Purchase and tax records | As required by law (typically 6 years in the UK) |
| Site server logs | Up to 30 days, or as retained by our hosting provider for security |
14. Security
We use administrative, technical and physical safeguards appropriate to the risk, including encryption in transit (TLS) and at rest, least-privilege access controls, multi-factor authentication on administrative accounts, keychain storage for secrets on device, and regular review of third-party SDKs. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
15. Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy;
- Correct inaccurate or incomplete information;
- Delete your personal information (“right to be forgotten”);
- Port your data to another service in a machine-readable format;
- Object to or restrict certain processing, including processing based on legitimate interests;
- Withdraw consent at any time where we rely on consent (including for AI features and marketing), without affecting earlier processing;
- Opt out of the sale or sharing of personal information, targeted advertising and profiling (we don't do these);
- Not be discriminated against for exercising your rights;
- Complain to a data protection authority.
These rights apply under laws including the UK GDPR and Data Protection Act 2018, the EU GDPR, Swiss FADP, California CCPA/CPRA and other U.S. state privacy laws, Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, Japan's APPI, South Korea's PIPA and others.
How to make a request: email [email protected] with the subject “Privacy request” or use the contact form. Tell us which App(s) and which right you want to exercise. We may need to verify your identity (for example, by confirming the email or account identifier you use). We respond within one month (UK/EU) or 45 days (U.S. states), and may extend this where permitted. You may use an authorised agent; we'll ask for proof of authorisation. If we decline a request, you may appeal by replying to our decision with “Appeal” in the subject line.
To delete data quickly, see Data Deletion.
16. U.S. state privacy notice (including California)
This section supplements the policy for residents of California and other U.S. states with comprehensive privacy laws. In the past 12 months we may have collected the following categories of personal information, for the business purposes described in Section 5, from the sources described in Section 3:
| Category (CCPA) | Collected? | Disclosed for a business purpose to | Sold or shared? |
|---|---|---|---|
| Identifiers (email, user ID, device ID) | Yes | Service providers | No |
| Customer records (name, contact details) | Yes, if provided | Service providers | No |
| Commercial information (purchase history) | Yes | Apple; service providers | No |
| Internet or network activity (App interaction, diagnostics) | Yes | Service providers | No |
| Audio, visual or similar (content you submit) | Only with consent | AI and hosting providers | No |
| Geolocation, biometric, protected classifications | No (location used on-device only) | — | No |
| Sensitive personal information | Only health data on-device, with permission | Not disclosed | No |
We do not sell or “share” (for cross-context behavioural advertising) personal information, including that of consumers under 16, and we do not use sensitive personal information to infer characteristics about you. We retain information as described in Section 13.
17. Children's privacy
Our Apps are generally designed for a general audience and are not directed at children under 13 (or the minimum age in your country, such as 16 in some EU member states). We do not knowingly collect personal information from children without verifiable parental consent. Our AI features are not intended for users under 13 and, where required, require users to confirm they meet the minimum age.
If an App is offered in the App Store's Kids Category, it will not include third-party advertising or analytics, will not transmit personal information to third parties, and will place links out of the App, purchases and requests for data behind a parental gate, in line with Apple's Guidelines, the U.S. Children's Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code.
If you believe a child has provided us with personal information, please contact [email protected] and we will delete it promptly.
18. Do Not Track and Global Privacy Control
Because we don't sell personal information or track you across third-party websites, our Site does not change its behaviour in response to Do Not Track signals. Where required by law, we treat a Global Privacy Control (GPC) signal as a valid request to opt out of sale or sharing — which, again, we don't do.
19. Changes to this policy
We may update this policy as our Apps, the law or best practice change. We'll post the new version here with an updated “Last updated” date and, for material changes, notify you in the App or by email before they take effect. If a change requires your consent (for example, sharing new data with an AI provider), we will ask for it.
20. Contact and complaints
Questions, requests or concerns? Contact our privacy team:
SPONTO LTD
Email: [email protected]
Web: sponto.top/contact
If you're not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EEA, you can contact the data protection authority in your country of residence. We'd appreciate the chance to resolve your concern first.