Privacy Policy

Last updated: July 8, 2026

Spotatrain.com is owned and operated by Geospotter Studios, based in Canada. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal and non-personal data when you use our website and services.

1. User Accounts and Contributions

When creating an account on Spotatrain.com, we collect your email address and chosen username. As a registered user, you may upload photos, contribute spotting locations, leave ratings, and create favorite lists. These contributions are associated with your account and stored in our database.

Legal basis (GDPR Article 6): Processing is based on your consent (for account creation) and our legitimate interest in operating the platform (for contributions).

2. Website Analytics

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. This service is provided by Google LLC. Data collected includes:

• Pages visited and time spent on each page
• Type of device and browser used
• Approximate location (country, region, city)
• Referring source (e.g., search engine or link)

We have also activated Google Signals, which may associate your visit with your Google account (if signed in) to include aggregated demographic and interest data (such as age and gender).

Legal basis: Your explicit consent via our cookie consent banner. Analytics data is only collected after you grant permission.

3. Advertising (Google AdSense)

We use Google AdSense to display advertisements on our website. Google AdSense may use cookies and web beacons to serve ads based on your prior visits to our website or other websites on the internet.

Google, as a third-party vendor, uses cookies to serve ads on Spotatrain.com. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the internet.

Types of ads: We may display both personalized and non-personalized advertisements. Personalized ads are only shown if you consent to marketing cookies via our cookie consent banner. Non-personalized ads do not use cookies for ad targeting but may still use cookies for frequency capping, aggregated ad reporting, and to combat fraud and abuse.

You can opt out of personalized advertising by visiting: Google Ad Settings. You can also visit www.aboutads.info to opt out of third-party cookies for personalized advertising.

Legal basis: Your explicit consent via our cookie consent banner.

4. Cookies and Consent Management

On your first visit, we display a cookie consent banner allowing you to accept or reject different categories of cookies. You may choose to:

• Accept All – enables all cookie categories
• Reject All – only essential cookies remain active
• Customize – choose specific categories

Cookie categories:

Your preferences are stored for 12 months. You can change or withdraw your consent at any time — and as easily as you gave it — by clicking “Cookie preferences” in the site footer, which re-opens this banner so you can adjust each category. Withdrawing consent stops the associated cookies and third-party scripts from that point forward.

5. Google Consent Mode v2

We implement Google Consent Mode v2, which ensures that no personal data is collected by Google Analytics, Google Ads, or Google AdSense until you explicitly grant permission through our cookie consent banner. By default, all consent signals are set to "denied" until you make a choice.

The following consent signals are managed:

• ad_storage – Controls storage (cookies) for advertising
• ad_user_data – Controls sending user data to Google for advertising
• ad_personalization – Controls personalized advertising
• analytics_storage – Controls storage for analytics
• functionality_storage – Controls storage for site functionality
• personalization_storage – Controls storage for personalization
• security_storage – Controls storage for security purposes

6. Data Retention

Analytics data. Google Analytics 4 automatically deletes analytics data according to the retention periods configured in our account: event data after 2 months, and user-level data after 14 months (the 14-month window restarts each time the same visitor returns to the site). Only aggregated, non-identifying figures — such as a page's total view count — are kept beyond these periods.

Account data. Information tied to your account is kept for as long as your account remains active. You may request deletion of your account and associated data at any time by contacting us (see “Contact Us & Privacy Officer” below); on request we remove it from our live database.

User-uploaded photos. When you delete a photo, it is hidden immediately and permanently purged from our database by an automated cleanup process within 30 days.

7. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States (for Google services) and Canada (where our servers are hosted). These transfers are protected by appropriate safeguards, including the EU-U.S. Data Privacy Framework for transfers to Google LLC.

8. Third-Party Services

We use the following third-party services that may process your data:

• Supabase – Database and authentication (stores account data)
• Google Analytics 4 – Website analytics (with your consent)
• Google AdSense – Display advertising (with your marketing consent)
• Google Tag Manager – Tag management (with your marketing consent)
• Travelpayouts – Travel affiliate monetization tag (loaded only with your marketing consent)
• Stay22 – Third-party lodging map embedded on some spot, experience, and journey pages (loaded only with your marketing consent, or when you explicitly click to load it)
• Flickr API & Wikimedia Commons / Openverse – Photo integration (publicly available images; your IP address is visible to these image hosts when photos load)
• Map tile providers – OpenStreetMap Foundation, CARTO, Esri, and OpenTopoMap serve the interactive map tiles; your IP address is visible to the tile host when a map loads
• YouTube (Google LLC) – Embedded videos and live cams on some pages
• Vercel – Website hosting and cookieless performance analytics (Speed Insights)

Each service has its own privacy policy governing the use of your data. We encourage you to review their respective privacy policies. Advertising, affiliate, and embedded-map scripts (Google AdSense, Travelpayouts, Stay22) are loaded only after you grant marketing consent.

9. Children's Privacy

Spotatrain.com is not directed at children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete such information from our records.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

For EU/EEA residents (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

For California residents (CCPA/CPRA):

• Right to know what personal information we collect
• Right to delete your personal information
• Right to opt out of the sale or sharing of personal information
• Right to non-discrimination for exercising your rights

For Quebec residents (Law 25 — Loi 25):

Spotatrain.com is operated from Quebec, Canada, so we are subject to Quebec's Act respecting the protection of personal information in the private sector, as modernized by Law 25. In addition to the rights listed above, Quebec residents have:

• The right to access the personal information we hold about you
• The right to have inaccurate, incomplete, or outdated information corrected
• The right to withdraw your consent to the processing of your personal information
• The right to data portability — to receive the computerized personal information you provided in a structured, commonly used technological format
• The right to request that we cease disseminating your personal information, or to de-index a hyperlink to it, where dissemination causes serious injury (the “right to de-indexing”)
• The right to be informed when a decision about you is based exclusively on automated processing (we currently make no such decisions)
• The right to file a complaint with the Commission d'accès à l'information du Québec (CAI)

Data breach commitment. If a confidentiality incident involving your personal information occurs and presents a risk of serious injury, we will take reasonable measures to reduce the risk, notify you and the CAI as required by Law 25, and record the incident in a register of confidentiality incidents.

We do not sell your personal information. To exercise any of these rights, please contact our Privacy Officer using the information below.

11. Contact Us & Privacy Officer

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact our Privacy Officer — the person in charge of the protection of personal information (responsable de la protection des renseignements personnels) as required by Quebec's Law 25:

Geospotter Studios
Attn: Privacy Officer
Email: contact@spotatrain.com
Website: https://www.spotatrain.com
Contact page: https://www.spotatrain.com/contact/

12. Updates to This Policy

This Privacy Policy may be updated occasionally to reflect new legal requirements or changes in our practices. The latest version will always be available on this page with an updated "Last updated" date.