Spot is operated by Nick Squared LLC. To run the product we use the companies below. If you coach on Spot, you are the controller of your clients' coaching data and we process it on your instructions — these are your sub-processors, and our data processing agreement commits us to telling you before this list changes.
Last updated 17 September 2026
Processors
These companies process data on our instructions, under a data processing agreement.
Cloudflare
Infrastructure and email-routing provider
What for
Domain security and forwarding support/privacy email
What they see
Network request metadata; sender/recipient details and forwarded email contents
Where
Global infrastructure; no EU-only processing promise
Programme drafting and coach-requested check-in summaries
What they see
Coach-supplied briefs, selected programme structures and exercise lists; selected current and previous check-in answers when a coach requests a summary. No photos, videos or connected-device records are submitted by these coach tools.
Where
Processing follows the configured Anthropic API service; EU-only processing is not promised
Recording and validating in-app subscriptions bought through the App Store or Google Play, and telling our servers when one starts, renews, lapses or is refunded
What they see
A Spot account identifier, the subscription product bought, its status and renewal date, and the store's own transaction identifiers. No card or bank details reach Spot or RevenueCat: Apple and Google take the payment and are the merchants of record.
Where
Processing follows the configured RevenueCat service; EU-only processing is not promised
Everything the app serves; photos, PDFs and voice notes in Blob
Where
Application functions configured for the United States (Washington, D.C.); file storage (Blob) configured for Frankfurt; delivery, logs and support depend on the Vercel service configuration
Expo (Expo Application Services), with Apple APNs and Google FCM
Processor, and their own sub-processors for delivery
What for
Push notifications to the phone app
What they see
Device push tokens, notification titles and bodies, navigation links and record identifiers. Alerts can include a coach's first name, an exercise name or check-in status and may reveal training-related information. Private message text is not included in message alerts.
Stripe has both processor and controller roles. Optional connected consumer services operate under their own terms and permissions; connecting one is not required to use Spot.
Oura (optional)
Connected service under its own terms
What for
Daily health summaries from an account you connect
What they see
Authorised daily activity, sleep, heart and readiness summaries; connection tokens
Spot’s application servers and database are in the United States, and uploaded files are stored in Frankfurt. Video, email account data, push delivery and provider support also involve the United States or other countries. Restricted transfers require applicable safeguards, which may include adequacy decisions or contractual safeguards. Ask [email protected] for the safeguards relevant to your data. This page does not represent that Nick Squared LLC holds a Data Privacy Framework certification.
Apple Health and Android Health Connect, where supported, exchange permitted data through your device. Imported summaries then pass through Spot’s hosting and database providers. Oura imports use its cloud API; Strava receives workouts only after export permission and connection. Disconnecting does not delete copies already sent to an external service. See our Privacy Policy for the fields transferred, and our Data Processing Agreement for coach terms.