Privacy Policy

Last updated 23 July 2026

This policy explains what personal data HapMap collects, why, and the choices and rights you have. We keep it plain.

Who we are

HapMap is operated by Heskja Consulting (“we”, “us”), the data controller for the personal data described here. See the contact details at the foot of this page.

What we collect

• Account — your display name and email, or, if you use Sign in with Apple or Facebook, the identifier and email those services return.
• Date of birth — collected once at signup to confirm you meet the minimum age (13, or higher where your country requires it). It is stored on your account and never shown to other users.
• Content you create — happenings you host, photos and clips you post (which are geofenced and expire), and board messages.
• Location — read only while the app is open, to show happenings near you and to check whether you are inside a happening's photo zone. We do not track your location in the background.
• Technical — a device push token (if you enable notifications), IP address, and basic diagnostics needed to run and secure the service.

Why we use it, and our legal bases

• To provide the service you asked for — hosting happenings, showing the map, delivering posts (performance of a contract, GDPR Art. 6(1)(b)).
• To keep the community safe — reviewing reports, moderating and removing content or accounts (legitimate interests, and where applicable legal obligation; Art. 6(1)(f)/(c)).
• To send notifications you opt into (consent, Art. 6(1)(a) — you can turn these off any time).
• To prevent abuse, fraud and to secure the service (legitimate interests, Art. 6(1)(f)).

Ephemeral photos

Photos and clips are meant to be fleeting. Each expires per viewer after the timer you choose, and stored copies are removed by an automated retention sweep. Deleting your account removes your content as described under “Your rights”.

Who we share it with

We do not sell your personal data. We use a small set of processors to run the service, each bound to protect your data and act on our instructions:

• Amazon Web Services — hosting, database and image storage (EU region).
• Mapbox — map tiles.
• Expo / Apple / Google — delivery of push notifications.
• Sentry — crash and error diagnostics.
• PostHog (EU region) — anonymous product analytics, only if you leave usage analytics enabled in the app.
• Apple / Facebook — only if you choose to sign in with them, to verify who you are.

Where your data is stored

Your data is hosted in the European Union. Where a processor operates outside the EEA, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

We keep your account data until you delete your account. Ephemeral media expires automatically and is swept from storage. Residual copies in encrypted backups are rotated out on a short cycle, and we keep only what the law requires us to keep.

Your rights

Under the GDPR you can request access to your data, correction, erasure, restriction, portability, and you can object to processing or withdraw consent. To exercise them:

• Delete everything yourself — Profile → Delete account, in the app. See Data deletion.
• Or email us at post@heskja.com and we will respond within 30 days.

You also have the right to lodge a complaint with your supervisory authority. In Norway that is the Norwegian Data Protection Authority (Datatilsynet).

Children

HapMap is not directed to children under 13, and where local law sets a higher age of digital consent, that age applies. We do not knowingly collect data from children below that age.

Security

Access is authenticated, traffic is encrypted in transit, and we apply rate limiting and other safeguards against abuse. No service can promise perfect security, but we work to protect your data.

Changes

We may update this policy as the product grows. Material changes will be reflected here with a new “last updated” date.

Contact

Questions about privacy or your data: post@heskja.com. Content or safety concerns inside the app: contact@hapmap.no.

Heskja Consulting operates HapMap and is the data controller.
Org. no. NO 934856643 MVA · D-U-N-S 348132944
post@heskja.com

Privacy · Terms · Data deletion