Privacy policy

Creators hold an account, make links and read results. For their account data we are the controller: we decide what is held and why, and this policy governs it.

Audiences open a creator's link and answer. They have no account and never sign in. What is collected from them is decided by the creator who wrote the questions — we hold it on that creator's behalf, and our Data Processing Agreement governs it.

• An account identifier from our authentication provider, your display name and your email address, so you can sign in and we can reach you.
• The links you make: the title, the questions and answers you wrote, and your settings for each.
• Which plan you are on.

Passwords are handled by our authentication provider and never reach us. We do not currently process payments; if that changes, this page changes with it.

The whole of it, for someone who opens a link and answers:

• A random identifier in a cookie, so opening a link twice is not counted as two people. It means nothing outside this site and is tied to no name.
• A country, worked out from the network the request arrived on. Two letters — never a city, an address, or a precise location.
• When the link was first opened and last seen open.
• The answers chosen, from the list the creator wrote.

Your IP address is not stored. It reaches the edge of our hosting, which uses it to derive the two-letter country above, and we keep the country rather than the address it came from.

Country is a guess about a network connection, not a fact about a person. A VPN, a corporate network or a mobile carrier can all put you somewhere you are not. Treat any map built from it as a good guess about a crowd.

A creator can add a question that asks for written text, or for an email address. If they do, whatever you type is stored against your answer and shown only to that creator — never on the public page, and never on the map.

What they ask for is their decision, not ours. If you would rather not give it, leaving that question unanswered still records the rest.

• Clerk — accounts and sign-in for creators.
• Supabase — the database everything is stored in.
• Vercel — hosting, and the edge that derives the country.
• datafa.st — page-view analytics for this site.
• X (Twitter) — measures whether somebody who saw an advert of ours went on to sign up. It runs on this site’s public pages, not inside anybody’s poll.

That is the complete list. We do not sell anything to anyone, we run no advertising, and no data broker receives anything from us.

Answers and audience records last as long as the link that gathered them. Delete a link and it stops answering and stops collecting; the responses it already holds are kept so a deletion by mistake is recoverable, and are removed on request.

Close an account and its links stop working immediately.

You may ask what is held about you, ask for it corrected, and ask for it deleted. Under the New Zealand Privacy Act 2020 — and under the GDPR where it applies to you — you may also object to processing and ask for a copy of your data.

If you answered someone's poll, the creator decides what happens to that answer, so ask them first; write to us and we will help you reach them and act on their instruction.

If this policy changes materially we will change the date at the top. Write to contact@mappbook.com with any question, or to make any request above.