Maeplet
Privacy policy
Last updated 25 October 2026
- Other people see your alias, your animal, your part of town and the photos you choose to post. Never your phone number, your birthday or where you are.
- Photo location data is stripped. Finds are pinned to a landmark or an area, and your exact position is never stored.
- An AI service checks photos and messages for safety. People, not the AI, decide anything that affects your account.
- We don't sell your data or use it for advertising, and we don't track you across other apps.
- You can delete your account in the app at any time (Me, then Delete account), and your photos, posts, finds and chats go with it.
Who we are
Maeplet is run by Maeplet Ltd, a company registered in England and Wales (company number 17306612), registered office 44 George Arthur Road, Birmingham, B8 1LW, United Kingdom. We are the controller of your personal data. Contact us about anything in this policy at ceo@maeplet.com.
What we collect
| What | Where it comes from and what it's for |
|---|---|
| Phone number | You give it to sign in. A text message service sends and checks a one-time code. We use it to keep your account yours and to stop duplicate and fake accounts. It is never shown to anyone. |
| Date of birth | You give it at sign-up. Used only to check you are 18 or over. Never shown to anyone. |
| Town and part of town | You choose them. Your town decides your daily quest and who you can meet; your area is shown next to your photos. |
| Alias and animal | We give you a random alias such as "Velvet Fox". This is how others see you. |
| Photos | Quest photos, bingo squares, field guide stamps and finds you take in the app, with any caption, note or label you add, and the results of our automated checks. Location data in the photo file is removed when it reaches us. |
| Your location, for finds only | When you post a find, the app reads your phone's location once. We use it to pin the find to the nearest landmark or part of town, then throw the coordinates away. We never store your exact location, and the app doesn't use location at any other time. |
| Messages | Messages you send in chats, and whether our checks flagged them (for example as a request for money). |
| Calls | Who called whom, when, and for how long. Voice calls go directly between phones through our call provider; we never record or store the audio. |
| Activity | Waves, Sparks, Echoes, blocks and reports you make or receive, and your settings (such as whether your finds appear on the map). |
| Device token | A token from Apple and Firebase that lets us send you notifications, if you allow them. |
| Technical data | Your IP address and request details, used to keep the service secure, apply rate limits and fix problems. |
| Waitlist (website) | If you join the waitlist on maeplet.com: your email address, the town you chose, when you agreed, and a scrambled (salted hash) version of your IP address to spot abuse. |
| Receipts (Basket) | Only if the Basket feature is available to you and you use it: receipt photos are read to list the items. The photo isn't kept. |
We don't ask for your name, your gender, your sexual orientation, your face or your contacts, and we don't collect them.
Why we use it (our lawful bases)
- To provide Maeplet (contract): your account, quests, the feed, Sparks, chats, calls, finds and the map.
- To keep people safe (legitimate interests): checking photos and messages, stopping scams and fake accounts, rate limits, investigating reports, suspending accounts that break our rules, and keeping evidence when someone is reported.
- With your permission (consent): notifications, your phone's location when you post a find, and waitlist emails. You can withdraw this at any time in your phone's settings or by contacting us.
- When the law requires it (legal obligation): for example, responding to valid requests from the police or courts.
Automated checks
We use an AI service, TypeSafe Jev, to check that photos show the day's quest, contain no recognisable faces and nothing unsafe, to judge whether two photos show the very same thing (which is how Sparks and Echoes work), and to flag messages that ask for money or invite someone to a private place. A photo that fails a check isn't posted, and you can try again. Flagged messages are shown with a warning and reviewed by a person. People, not the AI, make every decision to suspend or remove an account. The app tells you about these checks before your first photo and your first message.
What other people see
Your alias and animal, your part of town, your photos with their captions and notes, your finds (shown at a landmark or part of town, with a rough time such as "this afternoon", and never sooner than an hour after you took them), and your messages to the people you chat with. You can keep your finds off the map in Me. Blocking someone hides you both from each other everywhere in the app.
Who we share it with
We don't sell personal data. We use these service providers, who process data for us under contract and only for the purposes above:
| Provider | What for |
|---|---|
| DigitalOcean | Hosting our servers and database, in London. |
| Twilio | Sending and checking sign-in codes by text. |
| TypeSafe (Jev) | Automated photo and message checks. |
| Agora | Carrying voice calls between phones. |
| Google Firebase and Apple | Delivering notifications. |
| MapTiler | Map images in the app. MapTiler sees your IP address and which part of the map you're viewing. |
| Anthropic | Reading receipts, only if you use Basket. |
| Cloudflare | Directing web traffic to our servers (DNS). |
We may also share information if the law requires it, to protect someone's safety, or if Maeplet Ltd is sold or reorganised (in which case this policy still applies).
Some providers process data outside the UK, mainly in the United States. When they do, we rely on safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.
How long we keep it
- Your account and everything in it: until you delete your account. Deleting it removes your profile, photos, posts, finds, Sparks, chats and calls straight away.
- Reports: when someone is reported, a copy of the reported photo or message is kept for the review, even if the account is later deleted, and for up to two years so repeat abuse can be spotted.
- Backups: our backups are kept for up to five weeks, so deleted data disappears from them within that time.
- Waitlist emails: until Maeplet launches in your town or you ask us to remove you.
- Technical logs: only as long as needed to run and secure the service.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email ceo@maeplet.com from anywhere, or delete your account in the app. We will reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Keeping it secure
All traffic is encrypted. People's photos can only be opened through private links that expire within two hours. Our servers accept only secure connections, and our admin panel needs a password and a second-factor code. No system is perfectly secure, but we work to protect your data and will tell you and the ICO if a breach puts you at risk.
Age
Maeplet is for people aged 18 and over. We check your date of birth at sign-up and delete accounts we find belong to anyone younger.
Cookies
The app doesn't use cookies. Our website uses only the cookies it needs to work (to keep the waitlist form secure). No advertising or tracking cookies.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect. The date at the top shows when it last changed.