Privacy Policy
Spot Solutions is an open-source tool that helps open-mic comedy curators manage spot requests that arrive on WhatsApp. Spot Solutions is made by Amrit Dash. This policy explains what the hosted app at spot-solutions.web.app stores, where it is stored, and what it never does. The source code is public at github.com/amrit-contour/spot-solutions, so every statement here can be checked.
Who this applies to
- Curators: people who sign in to the app and link their WhatsApp.
- People who message a curator (for example comics asking for a spot). They never use the app, but some of their messages are processed on the curator's behalf, as described below.
- Demo visitors: people who try the demo without signing in.
What we collect and why
| Data | Why | Where it lives |
|---|---|---|
| Your Google account name, email address and profile photo | To sign you in and decide who may use the app (access is invite-only) | Firebase Authentication and Cloud Firestore |
| Your WhatsApp phone number and display name | To show which WhatsApp account is linked | Cloud Firestore |
| Messages that are spot requests, cancellations or questions about your shows, plus the sender's name and phone number. This includes spot requests found when you run "Scan past messages" over your recent DMs | So you can review requests, build lineups and reply | Cloud Firestore |
| Your roster of comics, shows, venues, lineups, message templates and settings | The core function of the app | Cloud Firestore |
| Your WhatsApp Web login session, encrypted | So another of your servers can take over without a new QR scan | On the server computer(s) you run, and an encrypted copy (AES-256-GCM, a separate key per account) in Google Cloud Storage |
| Contacts you choose to import (from WhatsApp, a file, or a group) | To add comics to your roster | Cloud Firestore |
| Push notification tokens for your devices | To send you alerts you turned on | Cloud Firestore |
| If you turn on "Your voice": a short description of how you write and up to 15 messages you sent, picked as examples | So messages to comics are written the way you write | Cloud Firestore. You can read, edit or remove them in Settings → Messages |
| An optional Gemini API key you add | To use Google's Gemini models if you allow them | Cloud Firestore, readable only by the server |
Messages that are not spot requests or related to your shows (personal chats, bank alerts, OTPs and so on) are read only to decide that they are not relevant, and are not stored. Chats from before you linked WhatsApp are only read when you run "Scan past messages" yourself. That scan runs on your own server, sends nothing to anyone, and messages that are not spot requests are not stored.
Firestore and Cloud Storage data is hosted by Google Cloud in the asia-south1 (Mumbai) region.
How messages are processed by AI
By default, messages are read by an open-weight Gemma model running on the curator's own computer, through Ollama. No cloud AI service sees them.
If a curator adds a Gemini API key and chooses "Local first, Gemini as backup", messages may be sent to Google's Gemini API when the local model is unavailable. That processing is covered by Google's Gemini API terms. Curators who choose "Local only" never have messages sent to a cloud model.
Your voice
"Your voice" is off until you choose "Learn my voice". It then reads only messages you sent in your recent WhatsApp DMs and in the groups linked to your shows. Messages from other people are never read for this. Phone numbers and links are removed, and the model writes a short description of your style and picks up to 15 of your messages as examples. Only that description and those examples are stored; the chats themselves are not. The AI model that does this follows your AI models setting: on "Local only" nothing leaves your server.
When it's on, each message to a comic is drafted from the show details, your description and examples, and your own template. A draft that changes or drops a date, time, venue or link is discarded and your template is sent instead. You can switch it off, edit the description, or remove examples at any time.
Google Contacts
If you turn on "Save names to Google Contacts", the app asks Google for permission to manage your contacts (https://www.googleapis.com/auth/contacts). It uses that permission only to:
- read the names and phone numbers in your contacts, to find a contact with the same phone number as a comic;
- create a contact (name and phone number) for a comic you add, or update that contact's name when you rename the comic.
It never deletes contacts and never changes anything other than names and phone numbers. Bulk changes are shown to you for confirmation first. This runs in your browser while you use the app. The access token is kept in memory only and is never stored on our servers, and your Google contact list is not copied to our database.
Spot Solutions' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the feature you asked for, and do not allow humans to read it except with your consent, for security purposes, or as required by law.
What we never do
- Sell or rent your data, or use it for advertising.
- Send WhatsApp messages without your action. Replies, confirmations and regrets go out when you press send. The optional auto-acknowledgement is off by default.
- Use your data to train AI models.
Who can access your data
- You, through the app.
- The people who run the servers your account uses. Servers are ordinary computers run by the project's administrators; whoever holds a server's credentials can technically read the project's data, as with any self-hosted software.
- Google, as the provider of Firebase, Google Cloud and (only if you allow it) the Gemini API, under its own terms.
Demo visitors
The demo signs you in anonymously and gives you a private copy of sample data. Nothing you do there touches real WhatsApp accounts, and demo sandboxes may be deleted at any time.
Keeping and deleting data
Your data is kept while you use the app. You can unlink WhatsApp at any time in Settings, which deletes the login session and its encrypted backup. To have your account and all of its data deleted, ask an administrator or open a request on GitHub; the app has tools to delete everything for an account. You can also revoke the app's Google access at any time at myaccount.google.com/permissions.
Security
Access to data is enforced by Firestore security rules: each curator can read only their own data, and server-only data (such as encryption keys and login backups) is not readable by any app user. WhatsApp login backups are encrypted before upload. See SECURITY.md for details and how to report a problem.
Children
Spot Solutions is not intended for anyone under 18.
Changes
If this policy changes, the new version will be posted here with a new effective date.
Contact
Questions or requests: open an issue at github.com/amrit-contour/spot-solutions/issues.