Privacy Policy

1. Overview

HotSpotz (“we,” “us”) is a location-based discovery service operated by FindHotSpotz.com LLC (hello@findhotspotz.com). This Privacy Policy explains what information we collect when you use HotSpotz websites and applications, and how we use it.

TODO — legal/owner review: Legal entity name is configurable via Platform settings (`legal.entityName`). Brand remains HotSpotz.

2. Information we collect

Account and profile

When you create an account we store information such as email address, password (stored as a secure hash — we do not store plaintext passwords), display name, and roles associated with your account (for example member and/or business).

Business information

If you list a business, we store listing content you provide, which may include business name, description, categories, address and location coordinates, hours, contact details, photos and other media, offers, menus or experiences, and related profile fields.

Location

HotSpotz uses location to show nearby places. Depending on how you use the product, this may include a location you set in your profile or an approximate location obtained from your device (for example via browser geolocation when you allow it). Location is used for discovery ranking and distance display — not to sell a live tracking feed of your movements.

Saved content and ratings

• Favorites (places you save)
• Offers saved to your wallet
• Star ratings you submit for places

Usage and activity

We may record product activity such as impressions (when a place appears in discovery), profile views, offer saves, favorites, and similar engagement events used for product features and business dashboard metrics.

Authentication and sessions

When you sign in we create a session record and set an HTTP-only session cookie (hotspotz_session). Sessions typically last up to 30 days unless you sign out or the session is invalidated. We also use a separate discover cookie (hotspotz_discover) to associate anonymous discovery/impression activity with a browser session.

Payments

Business billing may involve payment processors (for example Stripe). HotSpotz may store references such as customer or payment-method identifiers and billing status. Card details are handled by the payment processor according to their terms — HotSpotz is not designed to store full card numbers.

TODO — legal/owner review: Confirm which payment processors are live in production and whether any card data ever touches HotSpotz servers beyond Stripe identifiers.

Communications

We may send transactional email such as password-reset messages. Email delivery may use a third-party email provider configured for HotSpotz.

TODO — legal/owner review: Confirm the production email provider (e.g., Resend) and From address for the final policy. Default From in code is noreply@findhotspotz.com; public contact is hello@findhotspotz.com.

3. How we use information

• Provide discovery, accounts, favorites, offers, ratings, and business tools
• Authenticate you and keep you signed in
• Show approximate distances and nearby results
• Operate business dashboards and engagement metrics
• Process business billing where enabled
• Send account-related messages (such as password reset)
• Moderate listings and offers, including admin review workflows
• Secure, troubleshoot, and improve HotSpotz

We do not sell personal information as a product offering based on current application design.

TODO — legal/owner review: Confirm “do not sell” language under applicable state privacy laws (definitions of “sale” / “share” vary). Confirm advertising/analytics vendors if any are added later.

4. Cookies and similar technologies

• Session cookie for signed-in access (HttpOnly; Secure in production; SameSite=Lax; host-only)
• Discover session cookie for anonymous discovery/impression association
• Browser storage may be used by the web app for ordinary client functionality

The installable HotSpotz experience (service worker / web app) is intended for the application host. Marketing pages are not intended to register the HotSpotz service worker.

5. Sharing

We share information with service providers that help us operate HotSpotz (for example hosting, database hosting, email delivery, and payment processing), and when required by law or to protect HotSpotz, our users, or the public. Business listing content you publish is visible to HotSpotz users according to product rules (including after admin approval where applicable).

TODO — legal/owner review: List production subprocessors for the final policy (Railway, Supabase/Postgres host, Stripe, email provider, CDN if any).

6. Retention and security

We retain account, listing, engagement, and session data as needed to operate HotSpotz and meet operational requirements. Session records expire according to their expiry time. Passwords are stored hashed. We take reasonable administrative and technical measures appropriate to a web application, but no method of transmission or storage is completely secure.

TODO — legal/owner review: Confirm retention periods, backup practices, and whether a formal security program statement should be added. Do not claim specific certifications (SOC 2, ISO, etc.) unless obtained.

7. Your choices

• Update profile and location settings in the app where available
• Sign out to end the current session cookie
• Adjust browser permissions for location
• Request password reset via the sign-in flow

TODO — legal/owner review: Self-service account deletion does not appear as a completed consumer feature in the current product. Confirm how users request deletion or data export (email process vs in-app) and document timelines.

8. Children

HotSpotz is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

TODO — legal/owner review: Confirm minimum age (13 vs 16 vs 18) and whether business accounts have a higher eligibility age.

9. Changes

We may update this Privacy Policy as HotSpotz evolves. We will post the updated draft or final policy on this page with a revised date. Material changes may also be communicated by other reasonable means when required.

10. Contact

Privacy questions: hello@findhotspotz.com