Privacy policy
A directory has no need to know who is reading it. SpendKoin is built accordingly: no accounts, no advertising trackers, no IP addresses stored. This page does not describe intentions — it describes what the code does, what it keeps, and for how long.
Who runs this site
SpendKoin is an independent project, and the data controller under the GDPR. Any question or request about your data goes to contact@spendkoin.com, with no need to explain yourself.
No accounts, no email addresses
The site has no accounts and never asks for an email address — not even to submit a business or confirm a listing, which are the only two actions that write anything at all. The submission form collects information about the business only: its name, category, location, the currencies it takes, its website and a description. Nothing it sends identifies you.
One cookie, and it only remembers your language
A cookie named “langue” stores the language you picked, so you are not asked again on your next visit. It holds two letters — “en” or “fr” — lasts a year, and is read only to decide which version of the home page to serve. It is the only cookie this site sets: there are no advertising trackers and no social buttons. The audience measurement described below does exist, but it writes nothing to your device — no cookie, and no identifier that would follow you from one visit to the next. That is why you were shown no consent banner: consent covers what is read from or written to your device, and the only thing written here is a cookie strictly necessary for the service you asked for, which is exempt.
What never leaves your device
Your last six searches are kept in your browser’s local storage, so they can be offered back to you next time. They are never sent to the server and are tied to nothing: what someone searches for says a great deal about them, and a business directory has no reason to know it. The “Clear” button under your recent searches removes them at once; clearing this site’s data from your browser does the same. The places you save live there too, in the same way: the bookmark keeps a copy of the listing in this browser — its name, category, address, opening hours, accepted currencies — so the list can render without asking the server for anything. The list does not follow you from your phone to your laptop: that would take an account, and there is none. The “Clear all” button at the top of the Saved page removes it entirely. One exception to this section’s title, named here rather than left to be discovered: when you keep or release a place, the site counts the gesture. What leaves is the listing’s identifier, where you clicked from, and which way the gesture went — nothing else, and certainly not your list. These are counters aggregated by day, kept for ninety days, with no IP address and no identifier, exactly like the search counters described below: we learn that a place was kept, never by whom or alongside which others. They serve two purposes — telling us whether this feature earns the room it takes, and showing which places visitors want to find again, the only signal of its kind the directory has. The “Share” button is counted the same way, and for the same reason: what leaves is the listing’s identifier, where you clicked from, and which route it took — your system’s share sheet, or a copy of the link. Never the destination: the site has no idea who you send an address to, and your browser would not tell it even if it asked.
Your location
“Near me” asks your browser for your position, and only when you click it. Your coordinates sort businesses by distance for the length of that request, then they are forgotten: they are written nowhere, neither to the database nor to a log. Declining costs you nothing important — searching by town name still works in full.
Your contributions: your IP address is never kept
Confirming a listing or submitting a business means recognising a visitor without identifying them, or one person could vote a thousand times. Your IP address is neither stored nor passed to the database: the server derives a SHA-256 fingerprint salted with an application secret, useless for tracing back to you, and only that is recorded. It is erased after sixty days. The free-text note you can attach to a confirmation is never published: it exists for moderation, and for nothing else.
Audience measurement without identifiers
To learn what the search cannot find, the site counts completed searches: the text typed, the language, the mode, whether anything could be offered in reply, and the addresses requested that do not exist. Alongside them, for business owners, sits the listing-claim journey: the site counts how often the “Is this your business?” panel is opened, then the verifications attempted, passed or failed, with the reason why — a domain that does not match, a page that could not be read, a proof that is not there. Nothing else goes with these counters: not the listing concerned, not the website verified, nothing that points to you. They exist to show where the journey breaks, which a total number of claims cannot. Two counters on the map round this off, and they are the leanest of the lot: when a listing opens, the site notes whether the gesture came from the list or from a point on the map, and whether the screen is narrow or wide; and when you raise or lower the results sheet, it notes which stop it reached and whether you dragged the handle or tapped the chevron. No listing, no search, no location travels with them — the question is not about any particular business, but about the balance between two ways of browsing, and about whether a default setting earns its place, which nothing else could tell us. These are counters aggregated by day and kept for ninety days. No IP address, no identifier, no timestamp finer than the day: two searches by the same person cannot be linked to each other, and none can be traced to anyone. One common-sense caveat all the same: the search box does send what you type to the server, so it is not the place for personal details. Alongside these counters sits Vercel’s audience measurement, which answers the one question they leave open: which pages are read, and which are not. It records the page viewed, the page you came from, the country, the device type and the browser. It too uses no cookie and no persistent identifier, and writes nothing to your device.
The services that keep the site running
Four providers are involved. Vercel hosts the site, keeps short technical logs and provides the audience measurement described above. Supabase hosts the business database. Upstash hosts the cache and the counters described above. Finally, the map tiles are served by OpenFreeMap: when the map loads, your browser requests them directly and so hands over your IP address, exactly as it would for any image hosted elsewhere. These providers act on instruction, use the data for nothing else, and transfers outside the European Union are covered by the European Commission’s standard contractual clauses.
Business listings
Listings come from OpenStreetMap, where they are public: business name, address, phone number and website where present. A business owner wanting a correction or a removal can write to contact@spendkoin.com, and it will be made here. Better still is to fix the listing at its source on OpenStreetMap: that is where the other crypto maps and apps start from too, and they will pick the correction up.
Your rights, and their honest limit
You have the right to access, correct, erase, object to and port your data. One limit is better stated than discovered: for audience measurement these rights have nothing to attach to, because none of that data is linked to a person — nothing could pick “your” searches out from everyone else’s, which is exactly the point of building it that way. What these rights do apply to are listings and contributions: write to us and we will answer within a month. You may also complain to your national data protection authority.
A question about your data?
Write to contact@spendkoin.com. Any change to this policy will be published on this page, with its date.
Email usLast updated 14 August 2026.