← MendingMap

Privacy Policy

v9 · 2026-09-07

MendingMap Privacy Policy

Summary

This policy covers the MendingMap app, which uses an anonymous account, and the mendingmap.com website. We do not sell personal data or use account credentials or recovery values for advertising or cross-app tracking.

Mobile anonymous account

  • iOS and Android: the app creates a random install credential, anonymous account ID, access token, and refresh token. The install credential, account ID, and refresh token are kept in device-protected secure storage; the access token is memory-only. Access tokens last 15 minutes and refresh tokens last up to 30 days. For install/recovery credentials and session tokens, the server stores only one-way hashes: purpose-separated HMACs for install/recovery values and SHA-256 hashes for high-entropy session tokens.
  • Profile: your chosen name and optional bio are stored in Cloudflare D1. The name, bio, profile version, and an authenticated avatar copy may also be cached in app-private local storage for offline display and performance. Delete account and Start fresh clear that cache, with cleanup retried if it fails.
  • Optional profile photo: the app produces one 512 × 512 JPEG, limited to 512 KB, and rejects EXIF, XMP, ICC, IPTC, and comment metadata. The object is kept in a private Cloudflare R2 bucket and returned only to the authenticated account. The gallery picker is used only when you choose a photo.
  • iOS reinstall: iOS may preserve Keychain items after uninstall and reconnect this account after reinstall, but Apple does not guarantee that behavior. Uninstalling alone does not delete server data. Use Delete account before transferring or resetting a device when possible.

Android reinstall recovery

On Android only, the app can calculate an app-scoped recovery value from the device SSAID. The raw SSAID stays on the phone. Only a MendingMap package-scoped SHA-256 derived value is sent over HTTPS, and the server stores a versioned HMAC of that value. Its sole purpose is to reconnect the same anonymous account after reinstall within the same device, Android user, and signing scope. This scope identifies neither a person nor the current device owner: someone who later uses that same Android user and device could reconnect the profile after reinstall. Before sharing or transferring the device, use Delete account and then follow the device maker’s reset guidance. It is not an advertising ID or cross-app tracker. Recovery is best effort and may stop working after a factory reset or a signing, device, or Android-user change, or when SSAID is invalid or unavailable.

Mobile location (optional)

  • The map has a My location control. Nothing is read until you tap it and accept the in-app explanation, so the app never asks the system for your location on its own.
  • The app requests foreground permission only ("while using the app"). It does not request background or always-on location.
  • Each tap takes a single reading. That coordinate moves the map and is sent to the MendingMap API as the centre of that one search, together with the radius the screen is showing. The discovery request carries no account credential, so the coordinate is not connected to your profile.
  • The coordinate is not written to your phone’s storage and is not stored in the app database or in server logs as a location record; the server uses it only to compute that response.
  • You can refuse, or withdraw permission later in system settings. The map keeps working: you can pan it anywhere in the covered area.

Places you add, and their photos

  • When you add a place in the mobile app, what you write — its name, neighbourhood, street address, category, the point you put on the map, and one dish with its price — is sent to MendingMap and appears on the map straight away, marked “not confirmed yet” until three people who have been there confirm it.
  • Anyone can see it from that moment, and a person on our side reads every new place afterwards; if it is taken down, you see the reason. You can take a place down yourself until it is confirmed. Places sent through a form that says so are credited to you by your profile name — the form tells you before you send, and places sent before that disclosure existed carry no credit. Deleting your account removes the credit with the name.
  • A photo is optional. Your phone converts it to one 1024 × 768 JPEG of at most 1 MB, rebuilding the pixels into a new image so that the location it was taken at, the time, the camera, and every other metadata field is discarded before it leaves the device. The server rejects any image that still carries metadata.
  • Place photos are kept in a private Cloudflare R2 bucket, separate from profile photos, and are served only through MendingMap. A photo is public while its place is on the map, and it stops being public if the place is later hidden.
  • The camera and photo-library pickers are used only when you choose to add a photo.

The website

mendingmap.com introduces the app and publishes these documents. It is four pages of text: no map, no account, nothing to post and nothing to submit.

It keeps one thing in your browser — which of the three languages you picked — and choosing a language sends nothing anywhere. The pages carry no advertising, and no third-party fonts or map tiles.

One script does come from elsewhere: Cloudflare Web Analytics, which our host injects at the edge to count page views. Measured on 24 August 2026, it sets no cookie and writes nothing to your browser's storage. Loading it does disclose your IP address to Cloudflare, as fetching any file from anywhere does.

Until 24 August 2026 the website was the product. People used it with a guest ID kept in the browser, a nickname and avatar colour, and what they posted: places, reviews, votes, photos, reports and feedback. That collection has stopped. What was sent before is still held in the website's database — it was not deleted along with the pages — and none of it is published anywhere now. To ask what is held about you, or to have it removed, write to contact@mendingmap.com.

A WhatsApp webhook stays registered with Meta so the number keeps its subscription. The website sends no WhatsApp messages and there is no longer any way to sign in with a phone number on it; the endpoint receives only Meta's own delivery callbacks and a STOP or START keyword.

Security, rate limits, and processors

  • Cloudflare processes requests and provides Worker hosting, D1, private R2, CDN, and DDoS protection.
  • The request IP reaches the edge for security and rate limiting. The mobile identity database stores only an IP-derived HMAC counter, never the raw IP. Counters become eligible for deletion after 48 hours; a bounded scheduled cleanup removes up to 500 expired rows every 15 minutes, so a backlog can retain them longer. Where Workers Logs are enabled, the current Cloudflare Free plan retains them for up to 3 days.
  • The website reports its own unhandled server errors to Sentry, with user data disabled, and loads Cloudflare Web Analytics from static.cloudflareinsights.com. There is no advertising, and no external font or map provider.

Access, correction, and deletion

You can edit the mobile name, bio, and photo from Me. Delete account revokes your sessions, your install credential, and the Android recovery binding, so that account can never be signed into again. It cannot be undone.

What happens to your access and what happens to your information are different. Your name, bio, and photo stop being shown: everywhere you appeared before — on a review, on a place you added, on a reviewer profile — you appear as a deleted account with the default picture, and your name is no longer sent to the app at all. What you contributed stays: the places you added, what you wrote about them, any clip you sent, the prices and opening hours you corrected, your ratings and your votes. They remain part of the map and keep counting towards it, no longer shown with a name.

We keep the underlying records, including the profile details that are no longer shown, so the map stays consistent and past decisions stay traceable. To ask about those records, or to ask for them to be removed, write to contact@mendingmap.com. Start fresh creates a separate empty account only after local secrets and cached profile data are cleared.

For access, correction, portability, or another privacy request, write to contact@mendingmap.com.

Retention and backups

  • Active account and profile data remain while you use the service or until deletion.
  • Access tokens expire after 15 minutes; refresh tokens after up to 30 days. Mobile rate-limit counters become eligible for deletion after 48 hours and may remain longer while a cleanup backlog is processed.
  • Cloudflare D1 Time Travel is always on. On the current Free plan, recovery copies may contain data for up to 7 days before rolling off. Workers Logs, where enabled, are retained for up to 3 days on that plan.
  • R2 avatars are removed asynchronously as soon as cleanup succeeds. Mobile deletion tombstones currently have no automatic expiry.

Choices and contact

The mobile app asks only for photo-library access when you pick a profile photo and, optionally, foreground location when you use My location. It does not request camera, microphone, background location, tracking, contacts, or advertising-ID permission. Delete the account from Edit profile. The minimum age is 13; users aged 13–17 require parent or guardian consent. Questions: contact@mendingmap.com.

*Version 9 — a place you add is on the map at once, marked until three people confirm it; the earlier promise that nothing shows until a person has reviewed it no longer applies.*

NLAP · contact@mendingmap.com