MendingMap — cheap eats in Jakarta, mapped by the people who eat there

Summary

This policy covers the MendingMap app, which uses an anonymous account, and the mendingmap.com website. We do not sell personal data, show advertising, or use account credentials or recovery values for advertising or cross-app tracking. What you post — places, prices, opening hours, reviews, five-second clips and photos — is public; what you look at, and what you send us privately, is not.

Mobile anonymous account

iOS and Android: the app creates a random install credential, anonymous account ID, access token, and refresh token. The install credential, account ID, and refresh token are kept in device-protected secure storage; the access token is memory-only. Access tokens last 15 minutes and refresh tokens last up to 30 days. For install/recovery credentials and session tokens, the server stores only one-way hashes: purpose-separated HMACs for install/recovery values and SHA-256 hashes for high-entropy session tokens.
Profile: your chosen name and optional bio are stored in Cloudflare D1. The name, bio, profile version, and an authenticated avatar copy may also be cached in app-private local storage for offline display and performance. Delete account and Start fresh clear that cache, with cleanup retried if it fails.
Optional profile photo: the app produces one 512 × 512 JPEG, limited to 512 KB, and rejects EXIF, XMP, ICC, IPTC, and comment metadata. The object is kept in a private Cloudflare R2 bucket and returned only to the authenticated account. The gallery picker is used only when you choose a photo.
iOS reinstall: iOS may preserve Keychain items after uninstall and reconnect this account after reinstall, but Apple does not guarantee that behavior. Uninstalling alone does not delete server data. Use Delete account before transferring or resetting a device when possible.

Android reinstall recovery

On Android only, the app can calculate an app-scoped recovery value from the device SSAID. The raw SSAID stays on the phone. Only a MendingMap package-scoped SHA-256 derived value is sent over HTTPS, and the server stores a versioned HMAC of that value. Its sole purpose is to reconnect the same anonymous account after reinstall within the same device, Android user, and signing scope. This scope identifies neither a person nor the current device owner: someone who later uses that same Android user and device could reconnect the profile after reinstall. Before sharing or transferring the device, use Delete account and then follow the device maker’s reset guidance. It is not an advertising ID or cross-app tracker. Recovery is best effort and may stop working after a factory reset or a signing, device, or Android-user change, or when SSAID is invalid or unavailable.

Mobile location (optional)

See your position and estimated accuracy on the map, with the approximate straight-line distance to a place you select. After you open the location explanation and choose to start, the app uses location while the app is open and requests permission only if it has not already been granted. It does not request background or always-on location.

Location updates continue while this map is visible. They stop when you stop live location, switch to the list or another tab, open place details or another screen over the map, leave the app, or do not interact for 10 minutes. Returning to the map does not restart them; you choose to start again. Dragging the map turns off following you while location updates continue. The distance is an estimate in a straight line, not a route or travel time.

The live position, estimated accuracy, and displayed distance are held in memory for the location session, rather than saved as a movement history. When the session stops, the app clears this live-position display state.

Starting live location and receiving location updates do not themselves run nearby searches. When you manually move or zoom the map and a search is triggered, or you choose a nearby search, the search centre and radius are sent over an encrypted connection and processed by MendingMap and Cloudflare. That discovery request carries no account credential. Displaying the map, including following your position, can also request map data for the area shown from MendingMap's map host on Cloudflare. The security and processor section explains how service requests are handled.

The location button in the add-place form keeps its separate explanation and reads your position once to move the place pin. A place you choose to submit includes its selected map point, as described in the places section. You can decline location access or withdraw it in system settings and continue browsing by moving the map.

Places you add, and their photos

When you add a place in the mobile app, what you write — its name, neighbourhood, street address, category, the point you put on the map, and one dish with its price — is sent to MendingMap and appears on the map straight away, marked “not confirmed yet” until three people who have been there confirm it.
Anyone can see it from that moment, and a person on our side reads every new place afterwards; if it is taken down, you see the reason. You can take a place down yourself until it is confirmed. Places sent through a form that says so are credited to you by your profile name — the form tells you before you send, and places sent before that disclosure existed carry no credit. Deleting your account removes the credit with the name.
A photo is optional. The app asks for the camera only when you take one in the app, and for the photo library only when you choose one. Your phone converts it to one 1024 × 768 JPEG of at most 1 MB, rebuilding the pixels into a new image so that the location it was taken at, the time, the camera, and every other metadata field is discarded before it leaves the device. The server rejects any image that still carries metadata.
Place photos are kept in a private Cloudflare R2 bucket, separate from profile photos, and are served only through MendingMap. A photo is public while its place is on the map, and it stops being public if the place is later hidden.

Reviews and five-second clips

A review is words, a clip of up to five seconds, or both. It is public on the place's page and, for clips, in the Today feed. A person on our side reads reviews; the first review from a new account waits until it is read, and every clip waits until it is read.
The app asks for the camera and the microphone only while you record a clip in the app. A clip keeps its sound. Clips are recorded in the app and never taken from your photo library, and the app does not add your location to them. The server checks the clip's length from the file itself and stores the file as your phone recorded it, so ordinary recording details such as the time it was made may remain in it; a clip that carries a location is refused.
Clips are kept in a private Cloudflare R2 bucket, separate from photos, and are served only through MendingMap. Deleting a review deletes its clip.
Ratings, worth-it answers, votes on dishes, and confirmations that a place exists are linked to your anonymous account so each person counts once. Only totals are shown; nobody else can see how you voted.

Photos of a place

Anyone can add photos of a place — the front, the menu board, the food — after it is on the map. They go through the same pipeline as a place's first photo: rebuilt on your phone so no location, time or camera details leave it, and refused by the server if any remain.
A photo from an account that has been around shows straight away; the first photo from a new account waits until a person reads it. Photos can be marked helpful, reported, or taken down by the person who added them.

Reports, hiding, and feedback

A report you send (the reason you pick and any note) is read by a person on our side and stays linked to your account. Reporting a review hides it from you straight away. People whose reviews you hide are listed in Profile, and you can bring them back.
Feedback you send from the app — your words, any screenshots you choose to attach, and what your phone reports about itself (device model, system version, app version and build, language, and the screen you were on) — goes to our own feedback service, Echoback, which runs on Cloudflare. It is linked to your anonymous account so you can read our replies in the app. It is kept until you ask us to delete it: contact@mendingmap.com.

The website

mendingmap.com introduces the app and publishes these documents. Besides those pages, a link someone shares from the app (mendingmap.com/p/…) opens a small page showing that place's public details — name, main dish, price, neighbourhood — with a button to open the app; it runs no scripts and is not indexed by search engines. There is no map, no account, nothing to post and nothing to submit.

It keeps one thing in your browser — which of the three languages you picked — and choosing a language sends nothing anywhere. The pages carry no advertising, and no third-party fonts or map tiles.

One script does come from elsewhere: Cloudflare Web Analytics, which our host injects at the edge to count page views. Measured on 24 August 2026, it sets no cookie and writes nothing to your browser's storage. Loading it does disclose your IP address to Cloudflare, as fetching any file from anywhere does.

Until 24 August 2026 the website was the product. People used it with a guest ID kept in the browser, a nickname and avatar colour, and what they posted: places, reviews, votes, photos, reports and feedback. That collection has stopped. What was sent before is still held in the website's database — it was not deleted along with the pages — and none of it is published anywhere now. To ask what is held about you, or to have it removed, write to contact@mendingmap.com.

A WhatsApp webhook stays registered with Meta so the number keeps its subscription. The website sends no WhatsApp messages and there is no longer any way to sign in with a phone number on it; the endpoint receives only Meta's own delivery callbacks and a STOP or START keyword.

Security, rate limits, and processors

Cloudflare processes requests and provides Worker hosting, D1, private R2, CDN, and DDoS protection.
The request IP reaches the edge for security and rate limiting. The mobile identity database stores only an IP-derived HMAC counter, never the raw IP. Counters become eligible for deletion after 48 hours; a bounded scheduled cleanup removes up to 500 expired rows every 15 minutes, so a backlog can retain them longer. Where Workers Logs are enabled, they are retained for up to 7 days under the current paid plan.
The website loads Cloudflare Web Analytics from static.cloudflareinsights.com. There is no advertising, and no external font or map provider.

Crash reports

When the app crashes, or meets an error it cannot recover from, it sends a crash report to Sentry (Functional Software, Inc.), which stores and processes it in the United States under a data processing agreement with us. A report holds the error and where in the app's code it happened, the app version and build, and technical details about the phone at that moment — its model, system version, language and time zone, and the state of its memory, storage and battery.
A report holds no account, no location, no search words, nothing about which places or screens you looked at, and nothing you wrote, photographed or recorded. Before a report leaves your phone, web addresses in it are cut down to the server name. Sentry is set not to store the IP address a report arrives from, and to remove the identifiers its own software adds to a report and the approximate area it works out from that address.
We do this because we have a legitimate interest in knowing when the app stops working on a phone we cannot see, so we can fix it. It is part of how the app works and has no switch. To ask us to stop processing reports from your phone, or to delete them, write to contact@mendingmap.com.
Sentry keeps a report for no more than 90 days.

Access, correction, and deletion

You can edit the mobile name, bio, and photo from Me. Delete account revokes your sessions, your install credential, and the Android recovery binding, so that account can never be signed into again. It cannot be undone.

What happens to your access and what happens to your information are different. Your name, bio, and photo stop being shown: everywhere you appeared before — on a review, on a place you added, on a reviewer profile — you appear as a deleted account with the default picture, and your name is no longer sent to the app at all. What you contributed stays: the places you added, what you wrote about them, any clip you sent, the prices and opening hours you corrected, your ratings and your votes. They remain part of the map and keep counting towards it, no longer shown with a name.

We keep the underlying records, including the profile details that are no longer shown, so the map stays consistent and past decisions stay traceable. To ask about those records, or to ask for them to be removed, write to contact@mendingmap.com. Start fresh creates a separate empty account only after local secrets and cached profile data are cleared.

For access, correction, portability, or another privacy request, write to contact@mendingmap.com.

Retention and backups

Active account and profile data remain while you use the service or until deletion.
Access tokens expire after 15 minutes; refresh tokens after up to 30 days. Mobile rate-limit counters become eligible for deletion after 48 hours and may remain longer while a cleanup backlog is processed.
Cloudflare D1 Time Travel is always on. Under the current paid plan, recovery copies may contain data for up to 30 days before rolling off. Workers Logs, where enabled, are retained for up to 7 days.
R2 avatars are removed asynchronously as soon as cleanup succeeds. Mobile deletion tombstones currently have no automatic expiry.
Recently viewed keeps your most recent 100 places until you clear it or delete your account. Feedback is kept until you ask for it to be deleted. Reports stay with the records they are about.

Choices and contact

The mobile app asks for the photo library only when you pick a profile photo or a place photo, for the camera and microphone only when you record a five-second clip or take a place photo in the app, and for foreground location when you choose to start live location or use the location button in the add-place form after its explanation. It does not request background location, tracking, contacts, or advertising-ID permission. Delete the account from Edit profile. The minimum age is 13; users aged 13–17 require parent or guardian consent. Questions: contact@mendingmap.com.

*Version 11 — adds crash reports from the app, sent to Sentry in the United States, and removes the websites error reporting, which has stopped.*

Owner confirmation requests

To help us check your connection with a place, you can choose to send an owner confirmation request. The name, contact phone number and any note you enter are sent over an encrypted connection and linked to your anonymous account. Our team may contact you using these details to check the request; the request details are not shown publicly. Cloudflare hosts this information for us. The request and review record remain after withdrawal or account deletion and currently have no automatic deletion period. For access, correction or deletion requests, contact contact@mendingmap.com.

Privacy Policy

MendingMap Privacy Policy