LurkMap privacy policy
Controller and scope
BUILD YOUR WEB, a French EURL, SIREN 918 338 401, 12 rue René Lège, 92700 Colombes, France, is the controller for LurkMap processing. This policy covers the website, app and API. Cyprien Brindejonc de Tréglodé handles privacy and safety requests at privacy@lurkmap.com. Requests are acknowledged within 48 hours; this does not guarantee resolution within that time.
Account and security
Registration requires an email address, username, password and date of birth to restrict access to adults aged 18 or over. We also retain the account identifier, acceptance of the terms, email verification, preferences and account status. Passwords are hashed with bcrypt, not stored in plain text or in a form that can be decrypted.
Sessions and login or confirmation tokens protect access. Refusing required data prevents account creation; optional profile information is not needed to register.
Location and venues
With device permission, the app can obtain your precise location while in use and send it to the API for nearby searches. For newly recorded positions, the API stores an approximate public point within 1 km of the received position and a city derived from that point. Blurring is not anonymisation: a location area and username may still identify someone. Older precise locations and logs may remain until they are processed or erased.
You can refuse or withdraw location permission, which limits nearby features. Public LurkSpots may be shown precisely. Addresses entered in your private venue book are exact: details are only disclosed to the owner and confirmed participants in a linked private game, not merely to friends or invitees.
Profile and social activity
Your photo, biography, favourite games, availability and public links are optional and visible according to the app’s features and settings. Friends, requests, invitations, games, challenges, participation, reviews and counters are recorded to organise games, enforce limits and calculate tiers and LurkTrust. These features do not import your phone’s address book.
Newly uploaded avatars are re-encoded without EXIF/GPS metadata. This does not guarantee erasure of older images or of information visible in a photo itself. Avoid publishing a home address or sensitive information in text or photos.
Messages and reports
Conversations, invitation messages, email invitation recipients, blocks and reports are processed to communicate and protect the community. Messages are not end-to-end encrypted. Messages are available to their intended recipients; reports and relevant information are available to the people responsible for handling them.
A report may be sent by email to the responsible operator with the identifiers and information needed to review it. Do not include passwords, identity documents or abusive material in a report or support request.
Subscriptions and payments
Apple or Google handles payment through your store account. LurkMap does not receive your payment card number. RevenueCat receives your LurkMap account identifier and purchase, product, transaction, renewal and expiry data needed to validate access and provide subscription statistics. Subscription states are retained in our database to enable or remove benefits; they are not displayed in public profiles.
Notifications, emails and technical data
If you allow notifications, push tokens and installation information route alerts through Expo, Apple APNs and Google FCM. You can change this choice in the app or device settings. Some conversation notifications may contain a message preview.
API account emails, invitations and reports use Brevo. The website sends data requests through its mail service. Servers and security systems process IP addresses, browser or operating system details, requests, dates and errors; searches or location information may appear in logs.
Purposes and legal bases
Providing the account, communication, games and subscriptions you request is based on performing the service contract. Abuse prevention, security and reports are based on the legitimate interest in protecting people and the service, and on legal obligations where applicable. Handling data rights, accounting or judicial obligations is based on legal obligations.
Optional device permissions remain under your control. Withdrawing them does not by itself erase information already sent to the service. You can exercise the rights below for existing data.
Recipients and providers
The LurkMap website, API and database are hosted by OVHcloud in Frankfurt, Germany. Authorised BUILD YOUR WEB staff and technical providers handle data for their respective functions: RevenueCat for subscriptions; Apple and Google for their stores and notifications; Expo for notifications; Brevo for API email delivery.
Address searches may be sent to IGN Géoplateforme and Nominatim/OpenStreetMap. Maps use CARTO/OpenStreetMap and Leaflet resources from unpkg: these services may receive an IP address, the viewed map area and technical request data. Other players receive the information made available to them through profile, publishing, conversation or participation features.
International processing
Hosting the website and API in Germany does not mean that every provider processes data only within the European Union. Stores, notification services, RevenueCat and other technical services may operate from other countries. Contact us for information about recipients, countries and safeguards applicable to your processing; we do not describe the entire service as hosted exclusively in the European Union.
Retention
Closing or uninstalling the app, logging out or letting Premium expire does not erase your account or history. Account and activity data are retained for the service; deletion requests are handled separately. A token’s expiry date does not prove erasure of its record, logs or backups.
Some information may need to be retained to meet a legal obligation, handle a dispute or prevent abuse; this does not justify unlimited retention of all data. The request’s scope, applicable obligations and backup cycles must be assessed when processing it. A request may also cover associated data held by our providers, without deleting your Apple or Google account.
Your choices and rights
You can change your profile and permissions, choose visibility, block someone, and request access, correction, erasure, restriction, portability where applicable, or object to processing based on legitimate interests. Use the personal data form below or privacy@lurkmap.com. Proportionate verification of account ownership may be necessary; do not send identity documents unless requested.
You may complain to the CNIL or your competent data protection authority. Acknowledgement within 48 hours is separate from the applicable deadline for responding to your rights request. Cancel any subscription separately through the store to stop renewal.
LurkSpot proposals
A LurkSpot proposal includes a name, an address, coordinates and the identifier of the account submitting it. A phone number can be provided optionally; it is not required to create a LurkMap account.
Subscription technical identifiers
The RevenueCat SDK also transmits technical information about the app and device, including the iOS identifier for vendor (IDFV). This identifier is distinct from the IDFA advertising identifier. No advertising or attribution integration is enabled in RevenueCat for LurkMap.
Account deletion
Deletion requests are acknowledged within 48 hours and processed within one month, with confirmation of the outcome. Proportionate verification of account ownership may be necessary. We explain the scope of processing and any data retained under an applicable obligation; confirmation does not mean that all backups are erased instantly. Submitting the form does not automatically execute deletion.
Children and policy updates
LurkMap is for adults only. Any account confirmed to belong to a minor will be deleted under the child safety rules and applicable obligations. The update date at the top identifies this version of the policy.