Privacy Policy

Our Privacy Promise

At Mapages, your privacy is paramount. We've built our service with privacy-first principles. Your family memories are yours alone—we never sell, share, or use your data for purposes beyond providing you with our service.

What Information We Collect

• Account Information: Email address, full name, and password (encrypted) for authentication
• Content: Photos, voice notes, text captions, and album organization you create
• Usage Data: How you interact with the app (page views, features used) to improve our service
• Payment Information: Processed securely through Apple App Store or Google Play — we never see or store your card details
• Device Information: IP address, browser type, operating system for security and debugging

How We Use Your Information

• Provide and maintain the Mapages service
• Process one-time app purchase payments via Google Play
• Send essential service updates and notifications
• Improve app performance and fix bugs
• Prevent abuse and maintain security
• With your explicit consent: Send promotional emails (you can opt out anytime)

What We DON'T Do

• ❌ We NEVER sell your data to third parties
• ❌ We NEVER use your photos for AI training without permission
• ❌ We NEVER show ads in the app
• ❌ We NEVER access your photos unless required for technical support (with your permission)
• ❌ We NEVER share your content without your explicit consent
• ❌ Photo filters, stickers, and enhancements are processed locally or on-demand only

Data Storage & Security

• Photos and voice notes are encrypted in transit (HTTPS) and at rest
• Stored in secure AWS/GCP cloud infrastructure with industry-standard security
• Regular security audits and monitoring
• Staff access is logged and restricted to essential operations only
• Two-factor authentication available for your account

Upload Security & File Integrity

Every file uploaded to Mapages goes through a multi-layer security check before being accepted:

• MIME type validation: We verify the actual file content (magic bytes) — not just the file extension. A video renamed to .jpg is detected and rejected.
• Image-only policy: Only JPEG, PNG, GIF, WEBP, and HEIC/HEIF image formats are permitted. Videos, documents, PDFs, audio files, and archives are automatically blocked.
• Duplicate detection: Each uploaded photo is fingerprinted with a SHA-256 cryptographic hash. If you attempt to upload the same photo twice, it will be detected and skipped — protecting your storage and keeping your albums clean.
• File size enforcement: Per-file size limits are enforced per your plan tier. Oversized files are rejected before upload begins.
• All validation runs client-side first for speed, with server-side enforcement as a final safeguard.

Your Data Rights

You have complete control over your data:

• Access: View all your data anytime in the app
• Export: Download all your photos and data in standard formats
• Delete: Remove specific photos or delete your entire account
• Portability: Take your data with you if you leave Mapages
• Revoke Sharing: Instantly revoke share links you've created

Data Retention

• Active accounts: Data retained as long as your account is active
• Canceled subscriptions: Data retained for 90 days, then permanently deleted unless you reactivate
• Deleted accounts: Data permanently deleted within 30 days
• Share link analytics: Retained for 12 months

Trusted Access & Invite Links

• When you create a Trusted Access invite, we generate a unique token and store the invite record (album ID, role, optional email restriction, expiry)
• If you restrict an invite to a specific email, we store that email to verify the recipient's identity when they accept
• When someone accepts an invite, we record their user ID and acceptance timestamp against the album access record
• Invite links you share outside Mapages (WhatsApp, email, etc.) are your responsibility — we do not send these on your behalf
• Revoked invites are retained for audit purposes but grant no access

Beta Testing Program

• Beta testers receive a unique invite link to access the app. We store the email address, invite token, and acceptance timestamp
• Tester activity (features used, bugs encountered) may be logged for product improvement
• All testers are subject to a confidentiality obligation — beta features must not be disclosed publicly
• Tester data is treated with the same privacy standards as all other user data

Third-Party Services

We use the following trusted third-party services:

• Apple App Store / Google Play: Payment processing (see their respective privacy policies)
• AWS/GCP: Cloud storage and hosting
• Analytics: Anonymous usage tracking to improve the app

Children's Privacy

Mapages is family-friendly. While we don't knowingly collect data from children under 13 without parental consent, parents can create albums containing photos of children. Parents are responsible for managing what content is uploaded and shared.

International Data Transfers

Your data may be stored on servers in different countries. We ensure all transfers comply with applicable data protection laws (GDPR, CCPA, etc.).

Changes to Privacy Policy

We'll notify you via email and in-app notification if we make significant changes. Continued use after changes indicates acceptance.

Contact Us

Questions about privacy or data requests? Use our contact form.