1. Who we are
Mapmate is an iPhone app developed and operated by Marko Cranz, an independent developer based in Germany (“we”, “us”). We are the controller responsible for the processing of personal data described in this policy under the EU General Data Protection Regulation (GDPR).
Contact: markocranz30@icloud.com. We are not required to appoint a data protection officer and have not done so.
Mapmate is an independent app. It is not affiliated with, endorsed or sponsored by Instagram or Meta Platforms, Inc.
2. The short version
- You only give Mapmate a public username. We never ask for your password and never sign in to your account.
- Our server reads public data for that username to build your audience map: followers, following, recent posts and who liked them.
- Mapmate never posts, likes, follows or messages anyone on your behalf.
- Usernames — yours and other people’s — are never sent to analytics.
- Ad attribution with your advertising identifier happens only if you allow tracking in the iOS prompt.
- Settings → Delete my data removes your usernames and their history from our server and your iPhone.
- We do not sell personal data.
3. Information you give us
Usernames
To build a map, you enter the username of a public account. Mapmate stores the username on your iPhone and sends it to our server, which uses it to look up the account’s public data. If you change the username in Settings, the new one is processed the same way.
Because Mapmate never asks you to sign in, it cannot verify that an account belongs to you. Mapmate is meant for your own account or an account you are authorized to manage, and you can add up to three new usernames a day.
Messages to support
If you email us, we receive your email address, your message and anything you attach. When you write from the app, the email is pre-filled with your app version, iOS version and iPhone model so we can help faster. You can remove these details before sending.
Purchases
Subscriptions are bought through Apple’s App Store. Apple processes your payment; we never receive your name, payment card or billing address. We receive information about the purchase itself, described in section 5.
4. Public data we process to build your map
For the username you add, our server collects data that the account makes publicly available on Instagram:
- Public profile information: username, display name, profile picture link, follower, following and post counts, and whether the account is verified, a business or a creator account.
- The public lists of the account’s followers and the accounts it follows.
- The account’s recent public posts and which accounts liked them.
From this, Mapmate sorts people into groups (such as inner circle, quiet friends, fans and ghosts), records when someone follows or unfollows the account, and keeps the follower count over time for the growth chart. The server refreshes this data at most once every 8 hours, when you open the app.
These lists contain information about other people — their public usernames, names, profile pictures, follow relationships with the account and likes on its posts. Section 14 explains how we handle it.
Profile pictures are loaded by your iPhone directly from Instagram’s image servers, operated by Meta. When this happens, Meta receives your IP address and standard technical information about the request, as with any image loaded from the web.
5. Information collected automatically
Subscription status
We use Apphud to manage subscriptions. When you start the app, the Apphud SDK creates a random user identifier for this installation. Apphud receives App Store purchase and renewal information linked to that identifier, along with device information such as model, iOS version, language and region. Our server uses the identifier to check whether you have an active subscription.
App analytics
We use Google Firebase Analytics and Mixpanel to understand how Mapmate is used — for example, which screens are opened, where people get stuck in onboarding, whether a purchase succeeded and why a map failed to load. These tools receive app events together with a random app identifier, device and app information (model, iOS version, app version, language) and an approximate location derived from your IP address. Usernames are never included.
Ad attribution
We use AppsFlyer to learn which advertising campaigns lead to installs and subscriptions. AppsFlyer receives install and in-app events, device information, your IP address and Apple’s identifier for vendors (IDFV). If — and only if — you allow tracking in the iOS “Allow Mapmate to track your activity” prompt, AppsFlyer also receives your device’s advertising identifier (IDFA). Attribution results are shared with Apphud so we can see which campaigns lead to subscriptions. You can change your choice at any time in iOS Settings → Privacy & Security → Tracking.
Crash and performance data
We use Firebase Crashlytics and Sentry to find and fix crashes and errors. When something goes wrong, they receive diagnostic information such as stack traces, device model, iOS version, app version, memory and network state, and technical details of the screen where the error happened. We use this information only to fix problems.
Remote configuration
Firebase Remote Config lets us adjust settings — such as which subscription options are shown — without an app update. It uses a random installation identifier.
Connection data
Like any online service, our server and its hosting providers process technical connection data — IP address, time of request and the requested resource — to deliver responses, prevent abuse and keep the service secure.
6. Permissions on your iPhone
- Tracking (App Tracking Transparency). Used only for ad attribution as described above. Mapmate works the same whether you allow or decline.
- Photos — add only. Used to save your story card to Photos when you tap Save to Photos. Mapmate never reads your photo library.
- Notifications. Mapmate schedules a few local reminders on your iPhone about what the app can do. They never mention facts about your account. No push token is sent to us, and you can turn notifications off in iOS Settings.
Mapmate does not access your contacts, location, camera, microphone or passwords.
7. Data stored on your iPhone
To open quickly and work without a connection, Mapmate keeps a copy of your latest map on your iPhone: the people in each group, the changes it has noticed and the time of the last update. This copy is excluded from iCloud backups. It is erased when you change the username, when you tap Delete my data and when you delete the app. App settings, such as whether onboarding is complete, are stored on your iPhone as well.
8. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Building and updating your audience map | Username, public account data | Performance of our contract with you, Art. 6(1)(b) |
| Showing you the people in your audience | Public data about people in the lists | Legitimate interests, Art. 6(1)(f) — see section 14 |
| Selling and verifying subscriptions | Apphud identifier, purchase information | Performance of contract, Art. 6(1)(b); legal obligations, Art. 6(1)(c) |
| Improving the app and fixing crashes | Analytics, crash and performance data | Legitimate interests in a stable, usable app, Art. 6(1)(f) |
| Measuring advertising | IDFV, install data; IDFA only with permission | Legitimate interests, Art. 6(1)(f); consent for IDFA, Art. 6(1)(a) |
| Preventing abuse and keeping the service secure | Connection data, daily username limit | Legitimate interests, Art. 6(1)(f) |
| Answering support requests | Email address, message, device details | Performance of contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
Where we rely on consent, you can withdraw it at any time without affecting processing that happened before. Where we rely on legitimate interests, you can object as described in section 13.
9. Service providers
We share data only with providers that help us run Mapmate, under agreements that limit their use of it to providing their services to us, and with Apple for purchases.
| Provider | Used for | Location |
|---|---|---|
| Apphud Inc. | Subscription management | USA |
| Google Ireland Ltd. / Google LLC (Firebase) | Analytics, crash reporting, remote configuration | EU, USA |
| Mixpanel, Inc. | Product analytics | USA |
| AppsFlyer Ltd. | Ad attribution | Israel, EU, USA |
| Functional Software, Inc. (Sentry) | Error monitoring | USA |
| Server and hosting providers | Running our server and this website | EU, USA |
| Apple | App Store, payments, iCloud Mail for support emails | EU, USA |
Apple and Meta act as independent controllers for the data they process when you buy a subscription or when your iPhone loads profile pictures. We may also disclose information if required by law or to protect our rights, users or the public.
10. International transfers
Some providers process data outside the European Economic Area, mainly in the United States. Where a provider is certified under the EU–U.S. Data Privacy Framework, transfers rely on the European Commission’s adequacy decision. Otherwise, we rely on the European Commission’s Standard Contractual Clauses. Israel is covered by an adequacy decision. You can ask us for more information about these safeguards.
11. How long we keep data
- Usernames and audience data are kept while they are used in Mapmate, so your history of changes stays complete. They are deleted when you tap Delete my data, when you ask us to delete them, or once they are no longer needed to provide the service.
- The copy on your iPhone stays until you change the username, delete your data or delete the app.
- Subscription records are kept for as long as you have a subscription and afterwards for as long as tax and accounting laws require.
- Analytics, attribution and crash data are kept for the periods set in each provider’s settings and then deleted or anonymized.
- Support emails are kept for up to 24 months after your request is resolved.
12. Deleting your data
In Mapmate, open Settings → Delete my data and confirm. This removes your usernames and their history from this iPhone immediately and from our server shortly after — or the next time you open Mapmate if you were offline. Server-side deletion applies to all stored data for that username. Your subscription is managed by Apple and stays active; cancel it separately in your Apple Account settings if you no longer want it.
You can also email us at markocranz30@icloud.com with the username you want removed.
13. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- receive data you provided in a portable format;
- object at any time to processing based on our legitimate interests, for reasons arising from your particular situation;
- withdraw consent at any time, for example by turning off tracking in iOS Settings.
To use these rights, email markocranz30@icloud.com. Because Mapmate has no user accounts, we may ask for details — such as the username concerned — to find your data. We answer within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where an infringement occurred.
Wherever you live, you can ask us about or request deletion of your data, and we will not treat you differently for doing so. We do not sell personal data or share it for cross-context behavioral advertising outside the ad attribution described above.
14. If you appear in someone’s map
If you follow, are followed by, or liked a post of an account analyzed with Mapmate, our server processes public information about you: your username, display name and profile picture link, whether your account is verified, your follow relationship with that account, whether you liked its recent posts, and the dates Mapmate noticed changes. This information comes from publicly accessible Instagram data.
We use it only to show the user who added that account an overview of its audience. We do not contact you, do not monitor your own activity or accounts, do not include you in analytics and do not sell this information. Story cards made with Mapmate never show other people’s faces or usernames.
We rely on legitimate interests (Art. 6(1)(f) GDPR): Mapmate users have an interest in understanding the public audience of their own account, the data is already public, and we limit what we process. You can object at any time by emailing markocranz30@icloud.com with your username, and you have all the other rights listed in section 13.
15. Children
Mapmate is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child has used Mapmate, contact us and we will delete the data concerned.
16. Security
The app talks to our server only over encrypted connections, with mutual certificate authentication and certificate pinning. Access to our systems is limited to what is needed to run Mapmate. No method of transmission or storage is completely secure, but we work to protect your data and to fix problems quickly.
17. This website
This website is a static site. It does not use cookies, analytics or tracking, does not embed third-party content and loads its fonts from our own server. Our hosting provider processes technical data such as your IP address, browser type, the page requested and the time of the request in order to deliver the website and protect it from attacks (Art. 6(1)(f) GDPR). These logs are deleted after a short period.
18. Changes to this policy
We may update this policy when Mapmate or the law changes. We will change the “Last updated” date above and, for significant changes, let you know in the app or on this website.
19. Contact
Marko Cranz
Germany
markocranz30@icloud.com