Privacy Policy

Map'd is operated from the United Kingdom. The app and its database run on a server hosted by Hetzner in Helsinki, Finland — inside the European Economic Area — so your gameplay data does not leave the EEA just by virtue of being stored.

You can play the daily challenge and join multiplayer lobbies without creating an account. The first time you open Map'd, your browser generates a random device identifier and stores it in localStorage. This identifier lets the game remember your daily-challenge streak and past results on that device, without collecting your name, email address, or any other personal detail.

This identifier is tied to your browser, not to you personally. Clearing your browser's site data, or playing from a different browser or device, starts a new, unlinked identifier. If you later create an account from the same device, your anonymous history can be attached to that account, as described below.

The daily challenge allows one guess per device per day. To make that hold, our server also keeps the same random device identifier in a first-party cookie that only the daily challenge uses. It lasts a year and holds nothing else.

When you make a daily guess, we also store a scrambled (keyed hash) form of your IP address and your browser's user-agent string. The scrambling key changes every day, so these cannot be matched across days, and both are deleted after 7 days. We use them only to spot the same person playing the daily twice under different names. A match is looked at by hand; it never blocks a play on its own.

Signing in is optional, and is what puts your name on leaderboards, keeps your history across devices, and lets you add friends. Account sign-in is handled for us by WorkOS, an identity provider based in the United States, which processes your email address and manages the sign-in session (password, one-time email code, or Google, depending on how you choose to sign in).

Once you have an account, we store:

• your email address;
• your display name and friend code;
• your friendships with other players;
• your daily-challenge submissions and survival-mode results; and
• a record of your play history generally.

Your display name is shown publicly on leaderboards and to other players in lobbies and friend lists. Choose one you are comfortable being seen by other players. Your email address is never shown to other players.

If you have an account, we use Resend, a US-based email delivery service, to send account emails (such as password resets and email verification codes) and occasional notifications (such as a friend request). Resend processes your email address and the content of these messages solely in order to deliver them. Notification emails include a one-click link to turn them off; account emails such as password resets cannot be turned off, since they are actions you asked for directly.

We also send occasional news and updates emails about new features and changes to Map'd, but only if you choose to receive them: they are off unless you tick the box when you create your account or switch them on from your account page. Every news email has a one-click link to stop them, and you can switch them off from your account page at any time. Turning news emails off does not affect notification or account emails. We send news emails ourselves through Resend; we do not give your address to a mailing-list provider, and we do not track whether you open them or click their links.

The map itself, its tiles, and the place-search box used to submit a guess are provided by Mapbox, a US-based mapping service. Unlike the other services listed here, your browser talks to Mapbox directly rather than through our server — this means Mapbox can see your IP address and whatever place names or search terms you type while playing. We do not receive or store anything beyond the guess you actually submit. Underlying map data is © OpenStreetMap contributors; see Acknowledgements for full credit.

We use third-party advertising companies, including Google AdSense, to serve advertisements when you visit playmapd.com. These companies may use cookies, web beacons, or unique identifiers to collect information such as your IP address, browser type, the pages you visit and the time of day during your visits to this and other websites, in order to provide advertisements about goods and services that may be of interest to you.

How Google uses cookies:

• Google, as a third-party vendor, uses cookies to serve ads on playmapd.com.
• Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google's Ads Settings.

Alternatively, you can opt out of a third-party vendor's use of cookies for personalised advertising by visiting the Network Advertising Initiative opt-out page.

Consent: if you are visiting from the European Economic Area (EEA), the United Kingdom or Switzerland, we ask for your explicit consent before personalised advertisements are served or advertising cookies are set. That request is shown by Google's consent tool, which is certified for this purpose. You can change or withdraw your choice at any time using the "Cookie settings" link at the bottom of every page(open cookie settings now). Withdrawing consent does not affect your ability to play.

The game itself needs no other cookies to run. The only things it stores in your browser are the device identifier (in storage and in the daily challenge cookie) and sign-in session described above, which are strictly necessary and so do not need your consent. Our page-view counts use no cookies or storage at all.

To see how Map'd is used, we count page views ourselves rather than using an analytics service. When a page loads, your browser tells our server which page it was and, for the first page of a visit, which website linked you there. We keep only the day, the page, and the linking site's name (for example reddit.com, never the full address). We do not store your IP address or any identifier with it, set no cookie, and store nothing on your device for it, so it cannot be tied back to you.

If you have an account, we also note each day you use it, so we can count daily and weekly active players. That record is linked to your account and is deleted along with it.

Aside from the services named above, we do not sell or share your data. In summary:

• WorkOS (USA) — authentication and session management.
• Resend (USA) — sending account, notification and news email.
• Mapbox (USA) — map tiles and place search, called directly from your browser.
• Google (USA) — advertising through Google AdSense, as described above.
• Hetzner (Helsinki, Finland) — hosts the server and database.

WorkOS, Resend, Mapbox and Google are based in the United States. Where personal data is transferred to them from the UK or EEA, that transfer relies on the appropriate legal safeguards those providers offer (such as Standard Contractual Clauses). Hetzner's hosting is inside the EEA, so no such transfer applies to it.

Under UK GDPR we need a lawful basis for each use of your data. Ours are:

• Performance of a contract — running the game for you: your account, your sign-in session, your results, your friendships, and the account emails that go with them. This is why creating an account does not ask you to tick a consent box: consent is not the basis we rely on, and withdrawing it would simply mean closing your account.
• Legitimate interests — keeping the game working and fair, such as rate-limiting abuse and keeping leaderboards honest, and understanding how the game is used through the counts described above.
• Consent — optional notification emails, news and updates emails, and advertising cookies and personalised ads. You can turn any of these off at any time without affecting anything else.

Account data is kept for as long as your account exists. Ask us to close it and it is removed.

Anonymous play is worth being precise about, because the device identifier is not purely local. It is generated and stored in your own browser, but it is also recorded on our server alongside the results it produced — your daily-challenge submissions and survival-mode runs are saved against it, which is how an anonymous streak survives a page reload. Clearing your browser storage stops your device being recognised in future, but it does not delete those stored results. If you want them removed, contact us — see below.

If you are in the UK or the EEA, data protection law (UK GDPR / GDPR) gives you the right to:

• find out what personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• object to how your data is used (objection); and
• ask us to restrict or export your data.

There is currently no self-service "delete my account" button in the app. To exercise any of these rights, including deleting your account, please contact us — see below — and we will action the request directly.

If you are unhappy with how we have handled your data or your request, you have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK's data protection regulator, or to the equivalent authority in your own country.

Questions about this policy, or a request under any of the rights above, can be sent to privacy@playmapd.com.

We may update this policy as the game changes. The "Last updated" date at the top of this page will always reflect the most recent change.