Privacy policy
This is our own draft, not legal advice. We wrote it ourselves, by reading our own code, because we would rather publish something accurate than something that sounds lawyerly. It has not been reviewed by a lawyer yet. If you need a formal guarantee about how a particular law applies to you, ask us and we will get a proper answer rather than improvise one.
MMF is a private map of friends you already have. This page describes exactly what the app holds, where it holds it, and what you can do about it. Where the honest answer is uncomfortable, it is written down anyway.
1. The short version
The things that are unusual about MMF, and true:
- No pin is ever more precise than about 1.1 km. Every coordinate in MMF is cut to two decimal places before anything is saved or sent — on the device, again on our server, and again by the column types in the database. There is no setting that makes it finer, because there is no code that could produce a finer value.
- The app works fully without an account. You can open it, search cities and build a whole map without signing in. Those pins, their notes and their photos stay on your phone.
- Your address book is never uploaded. If you use "find friends", we read only the phone-number field, never names, and only one-way hashes of the numbers are ever sent. We do not store the hashes.
- Your private note about a friend is yours. No other user can read it, and no part of our API returns it to anyone but you.
- Your location is never read in the background. Background location is blocked at the app-manifest level, so it is not a promise, it is a missing capability.
- There is no chat, no feed, no strangers and no live tracking. MMF cannot show you people you do not already know.
And the parts we are not proud of, stated up front:
- Analytics are on by default. You can switch them off in Settings, but nothing asks you first. See §13.
- Deleting your account does not erase absolutely everything. Four things survive, and they are listed in §17.
- Our access rules currently let a friend you accepted reach more of your profile record than any screen shows them. See §10.
- Most of the people on MMF maps never signed up for anything. See §7.
2. Who we are
MMF (Map My Friends) is made and operated by Zenemix Labs. For anything about this policy, your data, or a request to have something removed, write to zenemixlabs@gmail.com. A person reads it.
3. Using MMF without an account
MMF opens straight onto the map. You can search cities, create pins, write notes and attach photos without ever signing in. Those pins, notes and photos stay on your device — they are written to the phone's own storage and no part of the app sends them anywhere while you are signed out.
Three things do leave your phone even while you are signed out, and you should know about them:
- City searches go to Mapbox. Typing a city name sends that text to Mapbox so it can suggest matches, and drawing the map fetches map tiles from Mapbox. Mapbox sees those requests and, as with any web request, your IP address.
- Product analytics start at first launch. Counts and screen names are sent to our analytics service from the moment the app opens, with no account attached, until you switch them off in Settings. What is and is not in them is set out in §13.
- Support messages reach us. If you write to support from inside the app while signed out, the message and its diagnostics are stored on our server, deliberately, so that a person with a broken app is not told to register first.
One clipboard read, on the first launch only
If you installed MMF by following an invitation link, the app store often drops the invitation on the way. To recover it, MMF reads the clipboard once, ever — on the first launch after install, and only if the clipboard is not empty. If what it finds is one of our invitation links, it uses it and clears the clipboard. If it is anything else, it is ignored and left alone, and nothing is sent anywhere. iOS shows its usual "pasted from" notice when this happens, which is why we are telling you.
4. What changes when you sign in
Signing in is the moment your local map becomes cloud data. It is worth being blunt about it: when you sign in, the pins you created while signed out are adopted into your account and uploaded on the next sync — including the private notes and the photos you attached to them. They stop being device-only.
We do this because otherwise signing in would appear to erase the map you just built. But if you built a map you never intended to send us, sign-in is the point to stop and think, not later.
We never ask for or store a password. Signing in is Google, Apple, or a one-time link emailed to you.
5. What we hold, and why
Everything below is either on your device, on our server, or both. "Our server" means our Supabase project — see §14.
- What
- For each person on your map: the name you gave them, their city and country, coordinates cut to ~1.1 km, their status (Resident, Temporary, Traveling), their availability (Open to plans, Coffee, Busy), a public note, tags, and where the pin came from.
- Where
- Your device while signed out; your device and our server after you sign in.
- Why
- This is the map. It is the product.
- What
- The free-text note only you see, separate from the public one on the pin.
- Where
- Your device while signed out; after sign-in, also a column on our server that no other user and no part of our API can read.
- Why
- So it survives a reinstall and appears on your second device.
- What
- Email, phone, Instagram, LinkedIn, Telegram, WhatsApp, and any other network you add yourself.
- Where
- Your device while signed out; our server after sign-in, indexed in a normalised form so that matching can work.
- Why
- Opening WhatsApp, Instagram, Telegram or LinkedIn straight from a pin, and recognising that person if they later join MMF themselves.
- What
- A picture of another person, taken or picked by you.
- Where
- Always your device. After sign-in, also a private storage bucket on our server that only your account can read.
- Why
- So the photo survives a reinstall and appears on your other device.
- What
- Display name, email address, profile picture URL, phone number if you add one, your city and country, coordinates cut to ~1.1 km, your status, availability and note, your social handles, your language and your theme preference.
- Where
- Our server, from the moment your account is created.
- Why
- It is your account record, and it is your own pin on your friends' maps.
- What
- One-way SHA-256 digests, generated automatically from the address and number on your account.
- Where
- Our server, as part of your profile.
- Why
- So a friend who already has your number can find you without either side sending the number itself. Turn off "allow smart matching" and they stop working.
- What
- The push token issued by your phone's operating system.
- Where
- Our server, only for a signed-in account that granted notification permission. If the permission is withdrawn, the token is cleared.
- Why
- Telling you a friend request arrived or was accepted.
- What
- Each time a pin on your map moves to a different country, we record the pin, the new city and country, the ~1.1 km coordinates, the previous country and the date. A redeemed invitation adds a row too.
- Where
- Our server. It is written by the database itself, never sent up by the app.
- Why
- It exists to support country-change alerts. Today the alerts you actually see are worked out on your own phone from pins it already has, and nothing in the app reads this log back. Nothing prunes it either — it is deleted when your account is deleted.
- What
- Who asked whom, when, and the outcome; the resulting friendship; and a small outbox row per notification. An outbox row carries the other person's display name only when they accepted your request — for an incoming request no name is sent at all.
- Where
- Our server, readable only by the two people involved.
- Why
- Friendship is the consent step that lets two accounts see each other at all.
- What
- A count of how often an account called a protected operation. For a support message sent without an account, the counter is keyed to an identifier derived from your IP address by hashing it — the address itself is never stored.
- Where
- Our server. No user can read this table.
- Why
- Stopping abuse of the few operations that are open to people without accounts.
- What
- Theme, language, onboarding flags, filters, recent searches, the last map position, your location-precision choice, country alerts, the sync marker, and your signed-in session token in a separate encrypted store.
- Where
- Your device only. Anything that could name a person or a place is filed under the account it belongs to and is never inherited by the next account to sign in on the same phone.
- Why
- Working offline, and keeping one account's data out of another's.
6. Your location
Automatic location is off until you switch it on, and nothing reads the GPS while it is off. When it is on:
- The app asks for a low-accuracy fix, and prefers one your phone already has.
- The fix is cut to two decimal places immediately — about 1.1 km — and that cut value is held in memory only. It is never written to disk.
- What gets published depends on your precision setting. "City" is the default: we publish the geocoder's centre point for that city, which is identical for everyone in it, and there is no fallback to your own cell if the city is not recognised. "~1.1 km" publishes the cut cell instead.
- There is deliberately no option finer than that, and switching back to "City" takes effect the moment you tap it, not at the next detection.
- Location is foreground-only. Background location is not merely unused, it is blocked in the app's manifest on both platforms. MMF cannot follow you around.
Reverse geocoding — turning a position into a city name — sends Mapbox the cut ~1.1 km value. Mapbox never receives a raw fix from MMF.
7. People who are not MMF users
Most of the people on MMF maps never agreed to anything. That is the honest shape of this product and we are not going to bury it.
When you add a pin, you can type in another person's name, city, country, an approximate position, a photo, a public note, a private note, their email, their phone number and their social handles. That person usually has no MMF account and was never asked. Those identifiers are then indexed and hashed so that, if they ever do join, their pin and their account can be matched up.
You decide what goes in. A pin needs nothing but a name and a city. Everything else is optional and every field you leave empty is a field we never hold. Please only enter what you would be comfortable that person knowing you entered.
If you are on someone's map and you want off it
Write to zenemixlabs@gmail.com with enough detail for us to identify the pin — typically the name and the email address or phone number that might be on it. We can remove the copy held on our servers. The copy on that person's own phone is theirs to delete, and we will ask them to. See Delete your data for the full route.
8. Finding friends by phone number
If you let MMF look through your contacts, this is exactly what happens:
- We read the phone-number field only. Names, emails and everything else in the entry are never read.
- Each number is turned into a one-way SHA-256 hash on your phone.
- Up to 2000 hashes are sent to our server in batches of 200. The numbers themselves never leave your device and neither does your address book.
- The server compares them against the hashes of accounts that allow smart matching and returns the matches. It does not store the hashes you sent. The only thing written is a counter recording that your account made the call.
This is pseudonymous, not anonymous, and we want to correct our own wording. Two things are true that "anonymous" would hide. First, the comparison runs under your signed-in session — the server knows it is your account asking. Second, a hash of a phone number is not the same as anonymising it: there are only so many possible phone numbers, and anyone holding a hash and enough patience could work back to the number. The protection here is real — we do not keep what you send, and we never see a name — but the accurate word is "pseudonymous". The permission prompt your phone shows still says "anonymously"; that is our mistake, and we are fixing it.
You can decline the contacts permission entirely. Nothing in MMF depends on it, and the app explains itself before your phone shows its own dialog.
9. Private notes and photos
No other MMF user can read your private note about a person, and no part of our API will return it to anyone but you. That is enforced by two independent database rules, one of which cannot be overridden by adding a new rule later.
What it is not: end-to-end encrypted. Your note is stored in our database in readable form, so we — and Supabase, who run the database for us — are technically capable of reading it. We do not, and we have no tool that does, but we are not going to claim a mathematical guarantee we have not built. If an older version of our text told you a private note never leaves your device, that stopped being true when it started syncing, and this page is the correction.
Photos you attach to a pin go into a private storage bucket. It is created private and re-asserted as private, only image types are accepted, and there are four separate rules plus one overriding rule tying every file to the account that owns it. Not even the person in the photo can read it. The app fetches them through short-lived signed links and keeps a copy on your device.
10. What other MMF users can see
Nobody can see you until you accept them. There is no directory, no search for strangers and no way to appear on someone's map without either being added by them or accepting their request.
When you accept a friend request, MMF shows that person your pin: your name and photo, your city and country, your position at the precision you chose, your status, availability and note.
Your profile record contains more than that, and our access rules are currently too generous with it. The record also holds the email address on your account, your phone number if you added one, the hashes built from them, your notification token and your ~1.1 km coordinates. Today, our rules open that whole record to anyone whose friend request you accepted. No screen in MMF shows it and no part of the app asks for it — but someone who queried our API directly with their own account could reach it. We are narrowing this to the fields the app actually uses. Until then: accept friend requests only from people you would give your email address to.
Ghost mode
Ghost mode hides your location from every friend while you keep seeing all of theirs, and it works backwards as well as forwards: turning it on blanks the city, country and coordinates already copied onto your friends' maps, not just future ones, and keeps them blank. A friendship accepted while you are ghosting copies nothing at all. One exception, by design: if you personally fill in your city through someone's invitation link while ghosting, that one deliberate disclosure stands.
Declining a request
MMF sends no notification when you decline someone — no message, no badge, nothing in the app tells them. To be precise rather than reassuring: the request they sent is their own record, and its status changes to "declined". The app never displays that, but a person querying our API directly could read the status of a request they sent.
11. Invitation links
An invitation link lets a friend put themselves on your map from a web page, with no app and no account. Two facts about it deserve stating plainly:
- Anyone holding the link can add a pin to your map. The page is open to people who are not signed in — that is the whole point of it — so treat the link as something you send to one person, not something you post.
- Your personal invitation link never expires. Links created for one specific person stop working 30 days after you make them, but the permanent personal one is retired only by switching your invite link off in the app, after which it returns nothing at all, not even your name.
We store the invitation itself: its token, the label you gave the person, how you sent it, whether it was used, and, once it is, the city and country they submitted.
If you are the guest filling one in: the page asks for your name, city, status, availability and an optional note. Your coordinates are cut to ~1.1 km in your own browser before anything is sent. A photo you pick there never leaves your browser at all — there is nowhere for it to be uploaded to. The page sets no cookies, stores nothing and loads no analytics or third-party fonts; it talks only to our database and to Mapbox for the city search.
12. Support messages
When you write to support from inside MMF, we receive your message (up to 1000 characters), the topic you picked, and a fixed set of diagnostics: app version, operating system, device model, app language, device language, whether you are signed in, and the email address on your account if there is one. Your device's name is deliberately excluded — on iOS it is usually the owner's own name.
Support messages are write-only. There is no way for anyone — you, another user, or a request from our own app — to read them back out; only our own backend key reaches them. That also means we cannot show you a history of what you sent. And see §15: support messages deliberately outlive the account they are about.
13. Analytics
MMF sends product analytics to OpenPanel, running on our own configured instance. We are strict about the contents and loose about nothing else, so here is both halves.
What we do send: event names from a fixed list, screen names, and properties that are only ever counts, yes/no flags, values from a closed set, your language, your theme and the build environment. For example: how many countries your filter covers, never which ones; whether a search returned results, never what you typed.
What cannot get through: properties are checked against an allow-list of names, then against a backstop that rejects anything whose name resembles an email, phone, handle, city, coordinate, name, token or URL, and the event name itself must be on the list. If a payload fails, the whole payload is dropped at the boundary rather than trimmed. The fields for email, first name, last name and avatar are never filled in.
Analytics are pseudonymous, not anonymous, and they are on until you switch them off. Every event carries a stable identifier for your installation, and when you sign in we deliberately link that identifier to your account so the before and after are one trail. There is no consent prompt: analytics are on by default from the first launch. Switching off "Share usage analytics" in Settings → Privacy stops them on that device at once — nothing further is sent, not even a note that you switched them off — and the choice survives erasing local data. If you would rather be asked first, tell us at zenemixlabs@gmail.com.
14. Companies that receive data
MMF is not a "no third parties" app and we will not pretend otherwise. Four services receive data, plus the two sign-in providers and your phone's own operating system.
- Receives
- Everything MMF syncs: your profile, your pins with their private notes and the contact details you entered, your photos in a private bucket, invitations, the country-change log, friend requests and friendships, notification rows, support messages and rate-limit counters.
- Note
- They run the database, so they are technically able to read what is in it. Your private notes are protected by access rules, not by encryption.
- Receives
- Every city name you type into the search, the cut ~1.1 km value when naming the area you are in, map tile requests including the part of the world you are looking at, and your IP address as a consequence of those requests.
- Note
- Their map SDK's own usage telemetry is currently left at its default setting, which means it is on. We should be turning it off; until we have, treat Mapbox as receiving usage telemetry from the map screen.
- Receives
- The pseudonymous event stream described in §13: an installation identifier, then your account identifier once you sign in, plus event names, screen names and allow-listed properties.
- Note
- No consent prompt: on by default, until you switch it off in Settings. How long they keep events is governed by their retention, not ours.
- Receives
- Your device's push token and the text of the notification. For an accepted friend request the text contains the accepter's name; for an incoming request no name is sent.
- Note
- Only reached if you granted notification permission.
- Receives
- Ordinary sign-in traffic when you choose their button.
- Note
- They return your email address and, when available, your name and a link to your profile picture, which we store. Because that picture stays hosted by them, displaying it contacts them.
- Receives
- Nothing today. This is how support messages would be forwarded to our inbox, and it is not switched on, so support messages currently reach only our database. When we do switch it on, they will carry the message and its diagnostics.
- Receives
- The ordinary platform surfaces: the share sheet when you export pins or send an invitation, the keystore protecting your encrypted session, the permission dialogs, and the local country-change alert — which is composed on your phone and sent nowhere.
We do not sell data, we do not run ads, and we do not send anything to advertisers or data brokers.
15. How long we keep things
- On your device: until you uninstall, or until you tap "Erase local data" — which MMF offers only while you are signed out, because with an account every local row is a copy the next sync would bring straight back.
- Pins you delete: the deletion is recorded first and sent to the server, and the server keeps the row marked as deleted rather than removing it. It stops appearing on every device of yours; it is finally destroyed when your account is.
- Invitations: a one-person link stops working after 30 days, but the record — token, label, and the city and country of whoever used it — is kept until your account is deleted. The permanent personal link does not expire at all.
- The country-change log: kept indefinitely. Nothing prunes it. Deleted with your account.
- Notification rows: kept indefinitely. Delivery stops being attempted after three days or three tries, but the row stays. Deleted with your account.
- Rate-limit counters: one row per account and operation, overwritten in place, never pruned, and not removed when an account is deleted. For anonymous support messages that row is keyed to an identifier derived from an IP address.
- Support messages: kept indefinitely and deliberately survive the deletion of the account they came from — otherwise a message saying "please delete my account" would be destroyed by the deletion it asked for.
- Contact photos on our server: deleted when you delete the pin or replace the photo. Not deleted when the account is deleted — see §17.
- Phone-number hashes sent for matching: never stored. They are compared and discarded.
- Analytics events: retention is set by our analytics provider, not by this codebase.
16. Your controls
- Export your pins. Settings → Your data → "Export my pins" builds a JSON file of the pins on your device, private notes and all, and hands it to your phone's share sheet. It is the pins only — not your profile, invitations, country-change log, friendships or support messages.
- Choose how precisely you are shown. "City" (the default) or "~1.1 km". Nothing finer exists.
- Turn automatic location off. It starts off. Nothing reads the GPS without it.
- Ghost mode. Hides your location from every friend, retroactively, while you still see all of theirs.
- Stop being discoverable. Switch off smart matching and nobody can find you by phone number or email, no matter what they hold.
- Switch off your personal invitation link. A disabled link returns nothing, not even your name.
- Refuse friend requests entirely.
- Control notifications separately for city matches and country matches.
- Switch analytics off. Settings → Privacy → "Share usage analytics". It is on by default.
- Decline any permission. Contacts, location, photos and notifications are each independent, and none of them gates the app.
- Erase local data while signed out — both stores, including the encrypted one. Only your analytics switch is kept, so an erase never turns analytics back on.
- Delete your account — see §17 and Delete your data.
- Write to support without an account.
What you cannot do today, so you are not left guessing:
- Read back or delete a support message you sent.
- Export anything other than your pins.
- Remove your name or photo from another user's map yourself — write to us and we will.
- Erase local data while signed in, because the next sync would restore it.
Depending on where you live you may have statutory rights — to a copy of your data, to correction, to erasure, to object to processing. Ask us at zenemixlabs@gmail.com and we will do it by hand where the app has no button for it.
17. Deleting your account
Settings → Your data → Delete account, behind a confirmation. It deletes your sign-in record, and everything hanging off it goes with it: your profile, your pins and their private notes, your invitations, the country-change log, your friend requests, your friendships and your notification rows. It can only ever delete the account making the request. You are signed out immediately afterwards.
Four things survive it, and we would rather you heard it here:
- Contact photos in our storage bucket. The deletion does not reach stored files today. Delete the pins first if that matters to you, or ask us and we will clear them by hand.
- Support messages you sent. Deliberate: they are kept precisely so a deletion request is not destroyed by the deletion it requested.
- Rate-limit counters. They hold no content, only counts, and are not attached to the account, so nothing removes them.
- Other people's copies of you. If someone added you to their map, their pin is their own data: your name, city, country, approximate position and photo stay on their map after your account is gone. We can remove the copy on our servers if you ask.
Uninstalled the app already? Delete your data explains how to have the account removed by email.
18. Changes to this policy
This page describes code. When the code changes, this page changes with it, and the date at the top moves. If a change makes MMF hold something new about you or share it somewhere new, we will say so in the app rather than leave it here to be discovered.
This page is in English only for now. The app speaks Spanish too, and a Spanish version of this policy is coming; until it is here, the English text is the one that describes the app.
19. Contact
MMF is made and operated by Zenemix Labs. For anything at all — a question, a correction, a deletion request, or a pin with your name on it that you want gone — write to zenemixlabs@gmail.com.
Email us about your data