Privacy notice | Map My Friends

Who we are

Map My Friends (mapmyfriends.co.uk) is run from the UK by its owner, who is the data controller for the personal data described here. Contact: hello@mapmyfriends.co.uk.

What we store and why

Data	Why	Lawful basis	How long
Your mobile number — stored encrypted, plus a scrambled (keyed-hash) copy for look-ups. Never shown to anyone; our admin sees only the last 3 digits.	To sign you in with a code; to let people who have your number find you (only if you switch that on).	Contract	Until you delete your account.
Name, username, date of birth, profile picture	To run your account; to check you’re 18 or over. Friends see your name, username and picture — never your date of birth.	Contract; legitimate interests (keeping under-18s off the service)	Until you delete your account.
Posts: photo (with all hidden data such as GPS removed), caption, time, and the location you chose — approximate (centre of a ~1 km square), exact, or none.	To show your posts to your friends.	Contract	24 hours, or 7 days if you choose. Then the post and its files are deleted. A reported post is kept until it has been reviewed.
Privacy zones (centres stored encrypted) and your settings	To apply your privacy choices.	Contract	Until you change them or delete your account.
Friends, requests, blocks, mutes and hearts	To run the friends features.	Contract	Until removed or you delete your account (declined requests: 30 days).
Sign-in sessions: a hashed session code, device type (e.g. “Safari on iPhone”), when you signed in and last used it	To keep you signed in and let you see and sign out your devices.	Contract; legitimate interests (security)	Until you sign out, or 90 days after you last used that device.
Sign-in codes (stored hashed) and code requests, with a hashed IP address and hashed number	To check codes and to stop abuse (rate limits).	Legitimate interests (security, preventing fraud)	Codes: deleted within 24 hours. Rate-limit records: 3 days.
Reports, warnings and moderation records	To keep the service safe and meet our Online Safety Act duties.	Legal obligation; legitimate interests	Reports and decisions: up to 3 years. Warnings: 12 months after you’ve read them.
Removed content	Normally deleted at once. Kept in a restricted area only when needed for an appeal (up to 28 days) or because the law requires it, for example child sexual abuse material reported to the National Crime Agency (1 year).	Legal obligation; legitimate interests	As stated.
Bans and age blocks: a hashed copy of the number only	To stop banned people and under-18s signing up again.	Legitimate interests	Bans: until lifted. Under-18 blocks: 12 months.

We don’t ask for special category data (such as health or religion), but photos can reveal it — please think about what you share. We don’t sell data, show adverts, profile you for marketing or use automated decision-making.

Who can see your data

Your accepted friends see your posts while they last, your name, username and picture.
People you send requests to, or who look up your username, see your name, username and picture.
Our admin (the owner) can see account basics (username, name, the last 3 digits of your number, join date and counts), reported posts and reports. The admin cannot browse private photos that haven’t been reported.
Service providers who process data for us: our web hosting provider; and the text-message provider we use for sign-in codes (sign-in isn’t switched on yet; this notice will name the provider when it is). The provider receives your number and the code message only.
The police, the National Crime Agency or other authorities where the law requires it (for example, reports of child sexual abuse).

Security

Everything is sent over an encrypted connection. Numbers and zone centres are encrypted at rest; IP addresses are never stored in readable form; photos are stored outside the public web folder and only sent after a permission check. Our web server also keeps basic technical logs (such as IP address, page requested and browser type) for security and troubleshooting.

Your rights

Access and portability: download everything we hold about you from Me → Download my data (a .zip with your data and photos). For safety the full mobile number isn’t written in that file — ask us if you need it.
Correction: change your name, username and picture in the app; email us for anything else.
Erasure: Me → Delete my account removes your account straight away.
Objection and restriction: email us.

Email hello@mapmyfriends.co.uk to use any right. We’ll reply within one month. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO).

Children

Map My Friends is for adults (18+). If we learn that a user is under 18, we close the account.

Cookies

We use essential cookies only — see our cookie notice.

Changes

We’ll update this notice if what we do changes, and tell you in the app if it’s significant.