Privacy Policy
Last updated: September 1, 2026 · Effective: June 4, 2026
🛡️ Our Privacy Commitment — Things We Will Never Build
Even for a premium subscription or any payment, we will never
offer the following features on Mapsgram. These features either violate
user privacy or expose the data of users and non-user third parties to
unjustifiable risk:
| Feature | Why we won't build it |
|---|
| Profile visitor list | Violates the visitor's own privacy rights (KVKK Art. 4 / GDPR Art. 5) |
| Friend radar history ("who passed near me") | Exposes others' location history (KVKK Art. 6 sensitive data / GDPR special category) |
| Demographics under 5 users | Violates k-anonymity; small samples can re-identify individuals |
| Hiding DM read receipts | A feature designed to deceive the other party |
| DM screenshot warnings / blockers | Compromises evidence integrity in judicial processes |
| Anonymous story viewing (stealth) | Violates the story owner's right to know "who viewed?", enables stalker culture |
This list only grows; we never shrink it. Privacy review
is performed before adding new features, and these items will not be added
even at the premium tier.
1. Data Controller
This Privacy Policy describes how Mapsgram ("App", "Service") processes your personal data.
- Data controller: Mapsgram
- Legal contact: kadir.yetis@mapsgram.com (postal address provided upon request)
- Email: kadir.yetis@mapsgram.com
- Web: https://mapsgram.com
Mapsgram processes data in accordance with the General Data Protection Regulation (GDPR — 2016/679, EU) and the Turkish Personal Data Protection Law (KVKK — Law No. 6698).
2. Data We Collect
2.1 Account information (Google Sign-In)
- Email address
- Name (from your Google profile)
- Profile photo (Google avatar URL)
2.2 Profile information (you provide)
- Username (@username)
- Display name
- Bio (optional)
- Age and gender (optional, for demographic aggregation)
- Secret word (stored as hash)
- Avatar
2.3 Location data
- Precise GPS location (only while the app is in the foreground — no background location collection)
- Story verification (to confirm you are at the venue)
- Friend proximity notifications
- Venue recommendations
- Demographic aggregation (anonymized)
- Old location records are automatically deleted after 24 hours
- District/city label: a "District/City" tag (e.g. "Beşiktaş/Istanbul") derived on-device from your location, attached only to stories in regional features (e.g. "DijitalCafe"); your full address/neighborhood is never sent to our server
2.4 Content
- Story photos and videos (Cloudflare R2)
- DM messages, photo attachments
- Check-in records
- Story reactions (emoji), comments, view records
2.5 Friendship information
- Friendship requests (sent + received)
- Accepted friends list
- Block list
2.6 Device information
- Push notification token (Expo Push)
- App session info
- Crash logs (for technical debugging)
2.7 Contact matching (fully optional)
If you choose to use the "In My Contacts" feature on the Explore page:
- Your phone number is verified via a code sent over WhatsApp. After verification, your raw number is never stored — only a one-way SHA-256 hash is written to our database.
- Your phone contacts, if you grant permission, are read from your device and hashed on-device the same way; only the list of hashes is sent to our server — raw contact data never reaches or is stored on our servers.
- Matches only surface registered Mapsgram users whose hash was previously saved (i.e., who also opted into this feature).
- No phone/contact data is processed unless you use this feature.
3. Purposes of Data Use
| Purpose | Data | Legal basis |
|---|
| Account creation and login | Google OAuth, username | Performance of contract |
| Story / photo sharing | Media, location | Explicit consent |
| Friend matching | Location, friend graph | Explicit consent |
| Venue recommendation | Location, age/gender (anonymized) | Explicit consent |
| Messaging | DM content | Performance of contract |
| Push notifications | Push token | Explicit consent |
| Security | Usage logs | Legitimate interest |
4. Data Sharing (Third Parties)
We share data with the following service providers:
- Cloudflare R2 (photo/video storage, EU/US)
- Railway (application server, US)
- Google (OAuth, Maps SDK, Places API)
- Google Analytics (GA4) (app usage/engagement statistics — event data that does not directly include your identity)
- Ticketmaster (receives event data, no user data is shared)
- Expo Push (push notifications)
- WhatsApp Business (Meta) / Telegram (temporarily relays your phone number solely to deliver a verification code — message content is not stored)
- Open-Meteo (only location coordinates are sent to show weather in DijitalCafe; no user identity is shared)
We do not sell your data to ad networks and do not share with marketers. The "Sponsored Venues" feature provides venue owners with anonymous aggregate statistics, not your personal data.
5. Data Retention
| Data type | Retention period |
|---|
| Account data | As long as the account is active |
| Story | 24 or 48 hours (you choose) |
| Message | Until you or the recipient deletes |
| Location (ping) | Auto-deleted after 24 hours |
| Check-in | Auto-deleted after 24 hours |
| Phone hash (contact matching) | While account is active; deleted on account deletion |
| After account deletion | Permanently deleted from DB |
6. Data Subject Rights (GDPR Art. 15-22 + KVKK Art. 11)
- Right to know: Learn which data is being processed
- Right to access: Request a copy of your data
- Right to rectification: Correct inaccurate/incomplete data
- Right to erasure: From within the app: Settings → Danger Zone → Delete My Account, or via this page
- Right to restrict processing
- Right to data portability
- Right to object
- Right to withdraw consent
To exercise these rights, email kadir.yetis@mapsgram.com. We respond within 30 days.
Under GDPR you also have the right to lodge a complaint with your local data protection authority. Under KVKK you may file a complaint with the Personal Data Protection Authority of Türkiye.
7. Children's Data
Mapsgram is not designed for users under 13. Accounts identified as belonging to users under 13 are deleted immediately.
8. Security
- All traffic is encrypted via HTTPS
- Passwords are hashed (bcrypt + salt)
- JWT tokens valid for 7 days
- Database access is restricted to authorized personnel
In case of a data breach, we notify users and authorities within 72 hours as required by GDPR and KVKK.
9. International Data Transfer
Some of our service providers are located outside the EU: Google (US), Railway (US), Cloudflare (Global). These transfers are safeguarded by Standard Contractual Clauses (SCC) or equivalent mechanisms.
10. Cookies and Similar Technologies
The mobile app does not use traditional web cookies. Data stored on your device:
- JWT session token (AsyncStorage)
- User preferences
- Notification history
This data stays only on your device.
11. Policy Changes
For significant changes, we will send an in-app notification and update the "Last updated" date.
12. Contact
- Email: kadir.yetis@mapsgram.com
- Postal: Provided upon written request to the email above.