Contact Us

Privacy Policy

Effective date: September 23, 2026 · Provider: Dua Software LLC

Our Approach to Privacy

SpotCache is a personal possessions and finances tracker built to be private by design. Your inventory, photos, and records are stored locally on your device — not on our servers. We do not sell your personal information, we do not show advertising, and we do not build advertising profiles. This Privacy Policy explains what limited information we do collect, why, and the choices you have.

This policy applies to the SpotCache mobile application for Android and iOS (the “App”), provided by Dua Software LLC (“we,” “us,” or “our”).

1. Information Stored Only on Your Device

The content you create in SpotCache is stored in a local database and file storage on your device. We do not receive, access, or store this content on our servers. It includes:

  • Your inventory: storage boxes, locations, items, quantities, notes, and location-map photos;
  • Your collections: collectible items, grades, purchase prices, values, and valuation history;
  • Lending records, warranty records and receipt photos, gift records and wishlists, and big-purchase expense records;
  • All photos you capture or attach in the App;
  • Your app PIN, which is stored only as a cryptographic hash in your device’s secure storage (Android Keystore / iOS Keychain), and your app preferences;
  • A local record of which storage boxes you have generated a printable QR label for. This is used only to apply the free label allowance, stays on your device, and is not included in backups.

If you delete the App without creating a backup, this content is permanently deleted and cannot be recovered by us.

1.1 QR box labels and camera access

SpotCache can generate a printable QR label for a storage box. The QR code encodes only an internal box identifier used by the App (for example, spotcache://box/42). It does not contain your name, the contents of the box, its location, or any other personal information. Labels are produced on your device; saving a label as an image or sharing it with another app is always your choice, and once you share a file it travels wherever you send it.

The App uses your device camera in two ways: to photograph items, boxes, locations, and receipts, and to scan QR box labels so the App can open the matching box. Camera frames used for scanning are processed on your device as you point the camera and are not stored or transmitted. Camera access is optional — you can attach photos from your gallery instead, and scanning is never required to use the App.

2. Information We Collect

2.1 Account information

When you first launch the App, an anonymous account identifier is created through Firebase Authentication (operated by Google LLC). You can use the App without ever providing your name or email address. If you choose to create an account (for example, to keep using AI scanning beyond the free monthly allowance, to turn on the app lock and recover a forgotten PIN, or to print labels for more boxes), we collect your email address and a password. The password is handled by Firebase Authentication; we never see or store your password in plain text.

2.2 AI scanning

When you choose to use the “Scan with AI” feature, the photo you select is downscaled on your device and transmitted over an encrypted connection to our cloud function, which forwards it to Google’s Gemini model for processing. The photo is used only to generate the scan result returned to you; we do not store the photo or the result on our servers, and we do not use them to build a profile about you. AI scanning is entirely optional — if you never use it, no photos leave your device.

To enforce usage limits (a free monthly allowance without an account, and a daily limit with one), we store a usage record associated with your account identifier. It contains only the count the limit needs — your scans this month without an account, or today with one — and when that count expires. It never contains your photos, your scan results, or a history of your scans. Our cloud function also writes operational logs — your account identifier, the scan type, and whether the scan succeeded or failed — which we use to detect errors and abuse.

2.3 Usage analytics

We use Google Firebase Analytics to understand how the App is used in aggregate, so we can improve it. This includes events such as which screens are viewed, which features are pinned to or unpinned from the navigation bar, when you reach a free-tier limit (the AI scan allowance, the printable-label allowance, or the maximum number of pinned features), and whether AI scans succeed or fail (error codes only, never the content of your data or photos), together with device model, operating system version, app version, and pseudonymous identifiers generated by Firebase.

2.4 Crash reports and diagnostics

We use Google Firebase Crashlytics to collect crash reports and handled-error reports (such as the type of error and a technical message) along with device state information. This helps us find and fix bugs.

2.5 Push notifications

If you allow notifications, the App registers a push token with Firebase Cloud Messaging and subscribes to a general announcements topic so we can send occasional broadcast updates about the App. Reminders — warranty expiry, loan due dates, and any custom reminder you set on an individual item or box — are scheduled locally on your device and do not involve our servers.

2.6 App integrity checks

When the App calls our cloud function — for example, to run an AI scan or delete your account — it attaches an attestation token from Firebase App Check, which uses the Google Play Integrity API on Android and Apple’s DeviceCheck on iOS. This tells us the request came from a genuine, unmodified installation of the App rather than an automated script, and is used only to protect the service from abuse. It does not identify you personally and carries none of your content.

3. Cloud Backups Go to Your Own Cloud, Not Ours

You can optionally enable cloud backup. A backup is a ZIP archive containing your database and photos, whose payload is encrypted with AES-256 using a key built into the App. That prevents casual inspection — anyone who opens the file in another app sees unreadable bytes — but because the key ships inside the App it is not a secret unique to you, and it is not protection against someone who deliberately extracts the key from the App. Treat a backup file as sensitive. Backups are stored in your own cloud storage: a hidden, app-private area of your Google Drive account on Android (using the drive.appdata scope) or your iCloud account on iOS. Backups are stored under your account with Google or Apple, not on servers we operate, and we cannot access them. Your use of Google Drive or iCloud is governed by Google’s or Apple’s own terms and privacy policies.

You can also export a backup to a file you save or share yourself, and import one back into the App. An exported file is protected in the same way as described above. Once you save or send it, the file is under your control and we have no access to it.

4. How We Use Information

  • To provide App features you request, such as AI scanning and account sign-in;
  • To enforce fair-use limits on metered features (the monthly and daily AI scan limits);
  • To understand aggregate usage and improve the App;
  • To detect, investigate, and fix crashes, errors, and abuse;
  • To send you push notifications you have opted into;
  • To comply with legal obligations.

We do not use your information for third-party advertising, and we do not sell or rent personal information to anyone.

5. How We Share Information

We share information only with the service providers that make the App work, and only to the extent described above:

  • Google LLC — Firebase Authentication, App Check, Cloud Functions and Cloud Logging, Firestore, Analytics, Crashlytics, Cloud Messaging, the Play Integrity API, and the Gemini AI service, each acting as our service provider; and Google Drive, acting as your own storage provider for backups you enable;
  • Apple Inc. — iCloud, acting as your own storage provider for backups you enable on iOS, Apple push notification services, and DeviceCheck.

We may also disclose information if required by law, to protect our rights or the safety of users, or as part of a merger, acquisition, or sale of assets (in which case this policy will continue to apply to previously collected information until updated).

6. Data Retention

  • Content on your device remains until you delete it or uninstall the App;
  • Backups in your Google Drive or iCloud remain under your control in your own account;
  • Account information is retained until you delete your account in the App or ask us to delete it;
  • The AI usage record is deleted automatically when its limit period ends (the end of the month without an account, the end of the day with one), usually within a day of that, and sooner if you delete your account;
  • Cloud function logs are kept for about 30 days;
  • Crash reports are kept for up to 90 days, and analytics data is retained according to Firebase’s standard retention periods, after which it is deleted or aggregated.

7. Security

Information transmitted to our service providers is encrypted in transit using TLS. Your PIN is stored only as a hash in hardware-backed secure storage on your device. Backup files are encrypted with an app-embedded key before they leave your device, which stops casual inspection but, as explained in Section 3, is not a user-specific secret. No method of transmission or storage is completely secure, but we design the App so that the most sensitive information — your actual records and photos — never needs to leave your device at all.

8. Your Choices and Rights

  • You can use the App without creating an account or providing any contact information;
  • You can decline to use AI scanning, in which case no photos are ever transmitted;
  • You can disable push notifications and reminders at any time in the App or in your device settings;
  • You can enable, disable, and delete cloud backups in your own Google Drive or iCloud account;
  • You can delete all local data by deleting it in the App or uninstalling the App;
  • You can delete your account and its server-side records (your sign-in and your AI usage record) at any time in the App under Settings → Data and Privacy → Delete account; you can also request deletion by contacting us at support@spotcache.ai (see spotcache.ai/delete-account). Deleting your account does not remove the records stored on your device, which stay until you delete them or uninstall the App.

Depending on where you live, you may have legal rights to access, correct, delete, or receive a copy of personal information we hold about you, and to opt out of certain processing. Residents of California and other U.S. states with comprehensive privacy laws may exercise these rights by contacting us at support@spotcache.ai. We do not sell or share personal information for cross-context behavioral advertising, and we do not discriminate against you for exercising your rights. If you are located in the European Economic Area or the United Kingdom, you may also have rights under the GDPR / UK GDPR, and may lodge a complaint with your supervisory authority.

9. Children’s Privacy

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us at support@spotcache.ai and we will delete it.

10. International Data Transfers

We are based in the United States, and the limited information described in this policy is processed on infrastructure operated by our service providers, which may be located in the United States or other countries. Where required, transfers rely on appropriate safeguards implemented by our service providers.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you in the App or by other reasonable means before the changes take effect. The “Effective date” above shows when this policy was last revised.

12. Contact Us

Dua Software LLC
Email: support@spotcache.ai