Privacy Statement

1) Controller and contact

• Controller: SPOTLIGHT VENTURES LTD.
• Company number: 17076611.
• Registered in England and Wales.
• Privacy and support contact: info@spotlightventures.co.uk.

2) What Autoimmune Compass does

Autoimmune Compass is an offline-first practical support app for people navigating Crohn’s disease, ulcerative colitis, and related bowel conditions. It helps users discover food places that may better match their individual needs, understand and translate food-trigger preferences, find useful toilets, save fallback places, and use dignity-support tools during urgent moments.

The first public release keeps strong on-device defaults while live accounts, moderated submissions, and account deletion support are enabled through Supabase.

3) Data categories

• Location and place-search data, including precise or approximate current location when permission is granted, map bounds, searches, selected places, and directions handoff requests. The current release does not collect continuous background location or keep route or movement history.
• Device and app data such as app version, platform, notification token when enabled, IP address, timestamps, request and diagnostic information, persistent app request device ID, and App Attest or Play Integrity challenge results and related security signals where configured.
• Contribution and moderation data such as toilet, access and meal reviews, ratings, trigger-food verdicts, low-FODMAP notes, new or missing-place submissions, duplicate checks, corrections and reports, recipes, What’s On events, menu evidence, photos and captions, upvotes, reports, blocks, moderation notes and decisions, contribution outcomes, points, and community reputation.
• Account data such as sign-in identifiers, profile details, public nickname submissions and approval records, subscription entitlement and verification evidence, store/product/transaction identifiers and purchase-token hashes, points or reputation records, non-essential email preferences and audit evidence, support messages, and account deletion requests. Apple or Google handles payment-card details.
• Optional food-preference account sync data, including food-trigger preferences, separately selected UK regulated-allergen preferences, strict gluten-free, may-contain, dedicated-fryer, and separate-preparation preferences, plus the consent version and grant or withdrawal timestamps needed to demonstrate and honour the user’s choice.
• Advertising and consent data where advertising is enabled, such as consent or privacy-choice status, advertising identifiers or SDK-generated identifiers where allowed, ad impressions, clicks, delivery, frequency-capping, fraud-prevention, diagnostics, and performance data.

4) What stays on-device and what uses the network

• Saved places, events and recipes; language choice; food-trigger, regulated-allergen and preparation preferences; dignity-tool preferences; companion names, phone numbers and messages; review activity; queued submissions and copied pending photos; session material; notification state; and a security device identifier are designed to stay on-device by default where practical.
• A signed-in user can separately and explicitly consent in Settings to an optional hosted account copy of food-trigger, regulated-allergen, and preparation preferences. Turning it off stops sync and requests deletion of that hosted preference copy while keeping the on-device choices.
• If hosted preference deletion cannot finish immediately, account sync remains off and the app keeps a minimal device-bound pending-withdrawal marker containing only a one-way hash of the account ID and the request time. It contains no food-preference selections and lets the app retry while the session is available and when the same account next signs in.
• The app uses the network for live place refresh, moderated submission flows, optional device registration, app/device integrity checks, account sign-in, email-preference changes, optional consented food-preference sync, account deletion, and advertising or consent requests where those services are configured and available.
• Where the device supports it, sensitive local preferences are stored using secure device storage.
• Logout and successful in-app account deletion clear the Supabase session, access/profile state, persistent client request device ID, push registration cache, saved items, food preferences, review activity, queued contributions and copied pending photos, and sound-cover companion-plan data on the current device. A pending hosted-preference withdrawal marker may survive logout only so deletion can be retried; it is removed after confirmed withdrawal, successful in-app account deletion, or app-storage clearing. App language may remain as a device accessibility preference.

5) Maps and device integrity

• The mobile app uses platform-native maps: Apple Maps on iOS and Google Maps on Android, with directions handed off to the user’s installed map apps where supported.
• Map providers may process IP address, device and request metadata, service or SDK identifiers, supplied location, map interactions, and diagnostic or crash information under their own privacy terms.
• The v1 release does not depend on paid geocoding or directions APIs for core operation.
• App/device integrity checks, such as Apple App Attest or Google Play Integrity where enabled, are security controls used to protect accounts, uploads, submissions, admin/provider actions, and abuse prevention.
• Integrity checks are not used for advertising, sponsor targeting, health profiling, food-trigger profiling, or personalised marketing.

6) Sponsorship and advertising

• The current production configuration does not request Google Mobile Ads, use the Android Advertising ID, or perform cross-app tracking. Autoimmune Compass may show Google AdMob or Google Mobile Ads banners and clearly labelled first-party sponsored placements only after that feature is enabled and privacy, consent, and store declarations have been updated where required.
• Advertising and sponsored content are commercial content. They are not allergy guidance, medical advice, allergy-safe certification, dietary-safety certification, venue certification, or a guarantee that a place or food item is suitable.
• Advertising should be contextual, non-personalised or limited first, and consent-gated where required by law or platform rules.
• We do not use diagnosis, condition, symptoms, food-trigger preferences, dignity-tool usage, sound-cover usage, saved places, urgency, subscription state, account identity, App Attest, Play Integrity, request metadata, precise location, or movement history to target ads or sponsored placements.
• Where Google AdMob or Google Mobile Ads is enabled, Google and its advertising/consent services may process advertising identifiers, app and device information, coarse location or contextual signals where supplied by the SDK or platform configuration, product interaction, advertising data, usage data, diagnostics, and performance data for ad delivery, consent management, fraud prevention, frequency capping, aggregate reporting, and ad measurement.
• Users should check current restaurant information, ask venue staff about ingredients, allergens, preparation, and cross-contamination risk, and make their own decision before consuming food.

7) Why data is processed

• To provide food-place discovery, toilet discovery, saved-place, and offline support features.
• To store user preferences and offline support data, and sync the reviewed preference subset only after explicit consent.
• To moderate community submissions before publication.
• To prevent abuse and protect the integrity of write endpoints.
• To validate and restore subscriptions, maintain point and reputation records, provide support, and send essential account or service communications.
• To display, limit, measure, and secure advertising where advertising is enabled.
• To meet support, legal, and security obligations.
• To send non-essential email only where the account has opted in and to remember or honour opt-out choices.

8) Legal bases and explicit consent

• Where UK data protection law applies, account and requested-service processing relies on Article 6(1)(b) where necessary to provide that service.
• Security, moderation, and proportionate service-improvement processing may rely on legitimate interests under Article 6(1)(f), where those interests are not overridden by the user’s rights.
• Optional features that genuinely depend on the user’s choice may rely on consent under Article 6(1)(a). Legal-obligation processing may rely on Article 6(1)(c).
• Food-trigger, regulated-allergen, strict gluten-free, and preparation preferences may reveal or concern health information. The optional hosted account copy relies on separate explicit consent under UK GDPR Article 9(2)(a), as well as Article 6(1)(a).
• The account-sync consent is specific and versioned. It can be withdrawn in Settings without deleting the account. Withdrawal keeps on-device choices, stops future hosted sync, and requests deletion of the hosted preference copy. It does not affect processing lawfully completed before withdrawal.

9) Account deletion and retention

• The signed-in Delete account action removes the hosted authentication user and account-linked rows controlled by the live deletion flow.
• Directly owned profile, email-preference, active preference-token, push-device, access-grant, contribution, subscription, wallet, upvote, review, access-review, submitted-place, place-correction, recipe, event, and related pending media rows are removed where the database owns them by the deleted account.
• Some operational records are de-identified by removing the account link while retaining the underlying business, moderation, or audit record.
• Limited audit, moderation, abuse-prevention, legal, security, and support records may be retained where necessary.
• Operational deletion audit and security/rate-limit records are normally reviewed or removed within 24 months. Records needed for legal claims, disputes, tax/payment evidence, serious abuse prevention, or regulatory compliance may be retained for up to 6 years where necessary.
• The listed current-device account and preference state is cleared by logout and successful in-app account deletion. Support-assisted deletion cannot clear local data on a device the operator cannot access.
• A minimal account-sync consent grant or withdrawal record may be retained while the account exists to demonstrate and honour the user’s choice. It does not contain the food-preference selections.
• A minimal device-bound pending-withdrawal marker containing a one-way account-ID hash and request time may survive logout until confirmed withdrawal, successful in-app account deletion, or app-storage clearing. It contains no food-preference selections.
• Hosted food preferences are kept until consent is withdrawn, the copy is cleared, or the account is deleted. Moderation and security records are reviewed against continuing need, normally at least every 24 months. Rejected or unsafe media has a default deletion target of 90 days unless safety, appeal, abuse-prevention, or legal needs require longer retention.
• Deleting the account does not cancel an Apple App Store or Google Play auto-renewing subscription. Use Manage subscription in the app or the store account controls to cancel future renewal. You may still delete immediately without cancelling first; cancellation and refund decisions remain subject to the store’s terms.

10) Providers, transfers, and security

• We do not sell personal data. Data is disclosed only as needed to Supabase and related hosting, authentication, database and storage infrastructure; Apple and Google for maps, directions, integrity, push, store distribution and subscriptions; an approved email provider, currently Brevo where enabled; professional, support, security, legal or regulatory recipients where necessary; advertising and consent providers only if advertising is enabled; and the public for approved community content and limited profile context.
• Raw location history, dignity-tool usage, food-trigger preferences, and integrity/security signals are not treated as marketing data sources. Providers are limited to the relevant service and appropriate contractual and security requirements.
• Deleting the hosted account does not directly erase provider-managed App Store, Google Play, email-delivery, operating-system, or similar records. We delete or request deletion from service providers where required and technically available, but providers may retain limited billing, suppression, security, delivery, tax, dispute, or legal records under their own obligations.
• Where UK law requires a safeguard for data processed outside the United Kingdom, we use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another lawful safeguard, together with data minimisation.
• Security measures include encryption in transit, secure device storage where supported, private upload storage and time-limited signed previews, authentication, access controls and row-level security, least-privilege roles, validation, rate limiting, moderation, audit records, and app-integrity checks where enabled. No service can guarantee absolute security.

Approved public profile nicknames, approved contribution counts, and Golden Toilets received from upvotes may be displayed with approved reviews and recipes so other users can understand community reputation context. Public profile surfaces must not show a user’s real/legal name or country.

11) Your rights and complaints

• Where UK data protection law applies, you may have rights to access, correct, erase, restrict, object, receive eligible data in a portable format, and withdraw consent. The current release does not make solely automated decisions with legal or similarly significant effects.
• Some rights are subject to legal conditions or exemptions. We may need to verify identity before acting and will respond within the period required by law.
• Signed-in members can withdraw food-preference account-sync consent in Settings. This keeps on-device choices, stops future hosted sync, and requests deletion of the hosted preference copy. If temporarily offline, the app retains only the minimal pending-withdrawal marker described above so it can retry for the same account.
• Complaints can be sent to the privacy address below. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Privacy questions or requests should be directed to info@spotlightventures.co.uk.

12) Age and policy changes

Autoimmune Compass is intended only for people aged 18 or over and is not designed as a children’s service. We do not knowingly collect personal data from a person under 18. If we learn that an under-18 account or submission exists, we will investigate and delete or otherwise handle it as required by law and the safety process.

We may update this statement when the product, providers, law, or store requirements change. Material changes will be communicated through the app, website, or account contact route where appropriate, and the date above will be updated.