Privacy Policy
This policy explains what the SpawnPoint Android app (studio.esgr.spawnpoint) and its service do with your data. SpawnPoint is operated by ESGR Studios Private Limited.
Note to the owner (shown only while the draft banner is on). Crash reporting (Firebase Crashlytics), Firebase App Check and Firebase Remote Config are written into section 3 but switched off in site-config.json (optionalSdks). Switch each one on in the same release that ships it in the app, and update the Play Console Data safety form in that release. The hosting provider, the addresses and the effective date are placeholders. Counsel must review the whole text, including the sections on rights and international transfers.
1. Who we are and how to contact us
ESGR Studios Private Limited ("we") operates SpawnPoint and decides how the data described here is used.
- Address
- WeWork Olympia Cyberspace, No. 21/22, Alandur Road, Guindy Industrial Estate, Chennai, Tamil Nadu 600032, India
- Privacy contact
- spawnpoint.app@esgr.studio
- Complaints and grievances
- See Grievance and contact.
2. The short version
- Your account is your phone number. There is no email, password or social sign-in.
- The content of your messages and the files you attach are end-to-end encrypted: they are encrypted on your phone and we cannot read them. We do hold some information about them, listed in section 3.
- Reading your phone's contacts is optional. If you allow it, phone numbers (never names) are sent to find people who use SpawnPoint, and that list is not stored on our servers.
- The app shows no ads and we do not sell personal data.
- You can delete your account in the app or on this site.
3. The data we use, feature by feature
Your account: phone number
To create an account you enter your phone number and confirm it with a code sent by SMS. The verification is done by Firebase Authentication, a Google service: Google receives the phone number and information it uses to tell real devices from abuse, sends the SMS, and keeps a sign-in record for the number. We store your phone number with your account. It identifies the account, lets people who already have your number find you (if you allow that), and is used to prevent abuse. Your carrier may charge for SMS.
If you set a two-step verification PIN, we store only a salted, one-way hash of it, never the PIN itself.
Your profile
A display name is required. You may add an About text, game IDs and a profile photo. Your name, About text and game IDs are stored in a form our service can read, and they are shown to other people who can see your profile. Your profile photo is stored as an encrypted file. We also store your settings, such as whether people can find you by phone number, whether read receipts are sent and whether your online status is visible, and the version of the Terms you accepted and when.
Finding people you know: your contacts (optional)
The app asks for Android's contacts permission only when you choose "Find people you know", and it explains this before the system asks. If you allow it:
- the app reads the phone numbers in your phone's contacts and sends the numbers, without names, to our service over an encrypted connection, in batches of at most 100 numbers and at most 1,000 numbers an hour;
- the service checks which numbers belong to SpawnPoint accounts that allow being found and that have not blocked you, and answers with those accounts;
- the list of numbers is used for that check only and is not stored on our servers. Contact names never leave your phone. The app remembers the numbers it already checked in memory for up to one hour, so it does not send them again.
If you refuse or later withdraw the permission in Android settings, the rest of the app keeps working and you can still add people by typing a phone number. People you choose to save as SpawnPoint contacts are stored with your account as a list of account IDs.
Messages, attachments and voice notes
Message text, attachments, voice notes, statuses, looking-for-group posts and media shared in communities are encrypted on your device before they are sent, with keys that stay on the devices of the people in the conversation. Our servers store and deliver the encrypted data and cannot decrypt it.
To deliver messages and run the service, our servers do hold information about them that is not end-to-end encrypted:
- which account and device sent a message, to which conversation, and when;
- whether a message has an attachment, which message it replies to, and whether and when it was edited, deleted or set to disappear;
- emoji reactions and read receipts;
- who is a member, administrator or owner of each group and community, and when they joined or left;
- the names of groups, communities and media collections;
- for each uploaded file: its size, when it was uploaded and by which account;
- for a status or looking-for-group post: who posted it, who may see it and when it ends.
The app uses the microphone only while you record a voice note, and stops recording when the app leaves the foreground. Files you attach are chosen with Android's system picker, so the app does not get access to your whole photo library.
Devices, sessions and notifications
For each phone signed in to your account we store a device ID, the platform, when it was added, its public encryption keys and its session. If you turn notifications on, we also store the push token that Firebase Cloud Messaging (a Google service) gives the app. A push message only tells the app to wake up and fetch new events; it never contains message text or sender names. If you turn notifications off, the app asks Google to delete the token.
Like every internet service, our servers and our network provider see the IP address your phone connects from. We use it to route traffic and to limit abusive request rates.
Paid plans
Plus, Pro and Max are bought through Google Play. Google handles the payment; we never receive your card or bank details. To switch a plan on, the app sends us the purchase token Google Play issued, and we ask Google Play for the state of that subscription (which plan, whether it is active, when it ends, whether it renews). We store that state and the token with your account. The purchase is tied to your account using a one-way hash of your internal account ID, not your phone number.
Reports, safety decisions and appeals
When you report a person, a message, a status, a group or a community, we store the report: the category you chose, anything you wrote, the messages you chose to attach (up to five, which your app decrypts and includes), and a snapshot of what our service can read about what you reported, such as a display name or a group name. Reporting a person or a message also blocks that person for you unless you choose otherwise. The person you report is not told who reported them.
For each account we store its safety standing: strikes, restrictions, the rule that led to them and any appeal you send, including your statement. Some of these decisions are made automatically; see the Community Rules.
Chat backup to Google Drive (optional)
If you turn on chat backup, the app encrypts your chat history on your phone with a password or a 64-digit key that only you hold, and saves the encrypted file in a hidden app folder of your own Google Drive. We do not receive the backup, the password, the key, or the identity of the Google account. We cannot reset a forgotten password or key. Google stores the file under its own terms; turning backup off leaves the last file in your Drive until you remove it.
Data kept on your phone
Your readable message history, your keys and your drafts are stored in the app's private storage on your phone. The app is excluded from Android's automatic cloud backup. Uninstalling the app removes this local data but does not delete your account.
Support
If you email us, we receive your email address and whatever you write, and use it to answer you.
Diagnostics and app integrity
The app does not contain a crash-reporting tool today.
Crash reports: the app uses Firebase Crashlytics (Google). When the app crashes, it sends Google a crash report with the technical trace of the error, the app version, the device model, the Android version, the time and an installation identifier created by Crashlytics. Crash reports do not include your messages. We use them only to find and fix faults.
App integrity: the app uses Firebase App Check with Google Play Integrity. Google checks that requests come from a genuine copy of the app on a genuine device and gives the app a short-lived token that it sends to our service. For this, Google processes information about the device and the app installation.
Remote settings: the app uses Firebase Remote Config (Google) to fetch settings that switch features on or off. For this, Google processes a Firebase installation identifier, the app version, the language and the country of the device. We do not use it to profile you.
Firebase Analytics collection is switched off in the app.
4. What we do not collect
- The content of your messages, attachments and voice notes (we hold only encrypted data).
- The names in your phone's contacts.
- Your location, your SMS inbox or your call log. The app does not request those permissions.
- Payment card or bank details.
- An advertising ID. The app contains no advertising SDK and shows no ads.
The Android permissions the app declares are: internet access, notifications, contacts (optional, for finding people) and microphone (optional, for voice notes).
5. Why we use data
- To provide the service: create and secure your account, deliver messages and media, show your profile to people you talk to, run groups and communities, and send notifications you asked for.
- To help you find people you know, if you allow contacts.
- To provide paid plans you bought through Google Play.
- To keep people safe and prevent abuse: handle reports, apply the Community Rules, limit spam and enforce bans.
- To meet legal obligations and answer lawful requests.
We do not sell personal data, we do not use it for advertising, and we do not build interest profiles from your conversations, which we cannot read.
6. Who else processes or sees data
We use these companies to run the service. They process data on our instructions for the purposes shown.
| Company | What for | Data involved |
|---|---|---|
| Google (Firebase Authentication) | Verifying phone numbers by SMS | Phone number, sign-in record, device and abuse-prevention signals |
| Google (Cloud Firestore) | The service's database | Account, profile, membership, encrypted messages and the other server-side records in section 3 |
| Google (Firebase Cloud Messaging) | Delivering notifications | Push token; a wake-up signal without message content |
| Google Play | Selling and managing paid plans | Purchase token and subscription state. Google is an independent seller for payments |
| Backblaze (B2 Cloud Storage) | Storing uploaded files | Encrypted files only; Backblaze cannot read them |
| Cloudflare | Network delivery and protection | IP address and the encrypted traffic between your phone and our service |
| Hetzner | Running our servers | The traffic our servers handle |
Data is also seen by:
- Other users: the people you talk to see your messages, your profile and, depending on your settings, your online status and read receipts. Members of a group or community can see that you are a member.
- Authorities: we disclose data when a valid legal order requires it. Because of end-to-end encryption we cannot provide message content. What we can provide is the server-side data described in this policy, including the phone number.
- A successor: if the service is transferred to another company, account data moves with it under this policy, and we will tell you first.
Our providers may process data in countries other than yours. [Counsel: add the transfer safeguards that apply.]
7. How long we keep data
| Data | Kept for |
|---|---|
| Account, profile, settings, saved contacts, memberships | Until you change them or delete your account |
| Phone numbers sent for finding people | Not stored on our servers |
| Encrypted messages and files | Until they are deleted by the sender, a disappearing-message timer ends, the conversation is removed, or the uploader's account is deleted |
| Statuses | 24 hours, then removed within about a day |
| Looking-for-group posts | At most 6 hours |
| The list of updates waiting for your devices | 30 days |
| Sessions and their tokens | A session ends after 30 days without use; its records are removed 30 days later |
| Push token | Until you turn notifications off, sign out, or the token is replaced |
| Purchase records | Until you delete your account |
| Safety reports and their evidence | 180 days after the report is closed; longer while a report is preserved for an authority; open reports are kept until closed |
| Records of automatic safety decisions | 180 days |
| Strikes, restrictions and bans | Strikes lapse after 90 or 180 days depending on the rule; the most serious do not lapse; a ban has no end |
| Expired invitations | About 1 day after they expire |
What happens to each kind of data when you delete your account, including what is kept afterwards and why, is listed in section 10 and on the account deletion page.
8. Security
- In transit: the app talks to our service only over encrypted connections (HTTPS/TLS); unencrypted connections are disabled in the app.
- End-to-end encryption: message content, attachments, voice notes, statuses, profile photos and community media are encrypted on the sender's device using the open-source Signal protocol library, and can be decrypted only on the devices of the people they are meant for. This does not cover the information listed in section 3 as held by our servers, your display name, About text and game IDs, or the names of groups and communities.
- Access: the two-step verification PIN, if you set one, is required before a new device can sign in to your account.
- Limits: no system is perfectly secure. End-to-end encryption does not protect a message once it is on an unlocked phone, in a screenshot, or reported by someone who received it. The encryption has not been independently audited.
9. Your choices and rights
- See and correct: your profile and settings are in the app under You, where you can change them at any time.
- Contacts: allow or withdraw the contacts permission in Android settings. Choose whether people can find you by phone number in the app's privacy settings.
- Notifications: turn them on or off in the app or in Android settings.
- Safety decisions: see any restriction on your account and appeal it under You > Safety.
- Delete: delete your account in the app or on this site.
- Copy of your data, objection, or any other request: email spawnpoint.app@esgr.studio from a place where we can confirm that the account is yours. We may ask you to confirm the phone number. Depending on where you live, the law may give you further rights, such as access, correction, erasure, restriction, portability, withdrawing consent, and complaining to a data-protection authority. We honour the rights that apply to you.
10. Deleting your account
You can delete your account in the app (You > Account > Delete account) or on the account deletion page, which works without the app. Deleting is permanent; it is not a deactivation.
After you ask, there is a hold of 30 days during which you can cancel by signing in again. After the hold, your data is erased.
Erasure starts as soon as you confirm.
Erasure is designed to finish within 24 hours of starting.
What is deleted
- Your profile: phone number, name, About text, profile photo, game IDs, settings, plan and your acceptance of the terms
- Your sign-in record with Firebase Authentication (your phone number)
- Your devices, sessions, notification tokens and two-step verification PIN record
- Your saved contacts, chat preferences and online status
- Your event log (the list of updates waiting for your devices)
- Blocks you placed on people, groups and communities
- Your statuses and looking-for-group posts
- Your memberships of groups and communities, and your read receipts
- Media you uploaded, and the stored encrypted files
- The purchase records we hold (this does not cancel the Google Play subscription)
What is kept after deletion, why, and for how long
| What | Why | How long |
|---|---|---|
| An empty account marker: an internal ID and the dates of deletion | So that other people's chats show "deleted account" instead of breaking | No fixed end. It holds no phone number, name or photo |
| Messages you sent to other people, and reactions on them, as encrypted data under your internal ID | They are part of the other participants' conversations | Until those conversations' own rules delete them (for example disappearing messages, or a participant deleting them) |
| Safety reports made by you or about you, the evidence attached to them, and the decisions taken | Safety and legal compliance | 180 days after the report is closed; longer while a report is preserved for an authority |
| Safety standing: strikes, restrictions, a ban, and groups you may not be added to again | Security and abuse prevention, so that deleting an account does not erase a ban | Kept with the reports; a ban has no end |
| A one-way digest of your phone number, only if the account had a ban, a running restriction or strike, or a block placed on it by someone else | Security and abuse prevention, so the ban, restriction or block still applies if the number registers again | Until the restriction or strike ends (a block by someone else: 180 days); a ban has no end. An account with a clean record leaves no such digest |
| Blocks and community bans that other people placed on your account | They belong to the people who placed them | No fixed end |
| The deletion receipt (stored only as a digest) | So you can confirm that the deletion happened | 30 days after the request |
| An audit record that a deletion took place (date and channel; no phone number, name or content) | To be able to show that deletion requests are carried out | 180 days after the deletion was completed or cancelled |
Deleting your account does not cancel a Google Play subscription. Cancel it in Google Play subscriptions.
11. Children
SpawnPoint is not directed at children. You must be at least 13 years old to use it. We do not knowingly collect data from anyone younger. If you believe a child is using SpawnPoint, email spawnpoint.app@esgr.studio and we will act on it. Our Child Safety Standards explain how we deal with child sexual abuse and exploitation.
12. Changes to this policy
When we change this policy we publish the new version here with a new effective date. If a change affects how we use your data in an important way, we tell you in the app before it takes effect.