Privacy Policy

Mukaan is operated by the Mukaan team. For any privacy question or to exercise the rights below, write to [email protected].

• Your email address and display name, used to sign you in and identify you to your crew.
• Your phone number, if you choose to add one. It is optional, it plays no part in signing in, and it is used only so people who already have your number saved can find you here.
• Your timezone and locale, used to schedule and translate reminders correctly.
• A push notification token, used to send you the reminders you asked for.
• Contact email and phone hashes, only when you choose Find people from contacts. The app creates the hashes on your device; we use them to find existing Mukaan accounts and do not store them.
• Your one-time location, only when you tap Use my location while creating a plan. We save the resulting plan pin and label, not a location history.
• The plans you create or join, your RSVPs, and your check-in times.
• Photos you choose to attach to a check-in.
• Messages you send in a crew's thread, including photos, videos and voice messages you record there, and any caption you add to them.
• Feedback and safety reports you send, plus the app version, device platform, operating-system version, and locale attached to that report.
• If you bought a paid plan in the app before Mukaan became free: the store's transaction references for that purchase. Mukaan is now free and we take no payments.
• Your friends and the communities and chats you join, including direct and group messages and any photos or other media you send in them.

Event listings on the website are gathered from ticket sellers and city event calendars, plus events posted by users. The events website at mukaan.app/events uses the same account. Browsing it needs no account at all. If you sign in there, we also keep:

• How you signed in: an email code, or Sign in with Apple or Sign in with Google if you choose one, in which case we receive the email address and name that service shares with us.
• The events you mark I'm in or save. People in your crews can see that you are going to an event; nobody else sees your name, only a total once five or more people are going.
• Events you post: the details you enter (title, description, venue and time), the poster image you upload, and the host name you choose. Posts are reviewed before they appear, unless you are a verified host, in which case they can go live without review. A published event is public.
• Reports you file about an event, a message or a person, with the reason and any note you write, which our moderators read.
• If you ask to be listed as an organizer, the organization's name and website.
• For each signed-in session, the IP address and browser it was started from, kept with that session for security.

We do not track your location in the background, do not store your contacts or the raw email addresses and phone numbers in them, and do not use advertising identifiers. The mobile app has no analytics SDK. (The website does use Google Analytics, described under “Cookies on the website” below.) Crashes in the app are reported through Sentry so we can find and fix bugs — it receives a stack trace, your device model, operating-system version, and app version, but never your name, email, or anything you typed.

Your location on the website is never sent to us. If you tap Use my location to pick a city, or Near me on the map, your browser asks for permission and the position is used inside your browser to choose the nearest city or centre the map; only the city you end up with is kept (in a cookie, see below). We do not guess your city from your IP address.

On the events website, a view of an event page is counted as one number per event per day; nothing about who viewed it — no account, IP address or cookie — is stored with the count. Your IP address is used briefly, and only in memory, to limit how often sign-in codes can be requested. When you report an event listing, we keep the reason and any note you write, plus a key made by hashing the date, your browser’s name and its language setting together with a secret value. That key only stops the same visitor reporting one event twice; it contains no IP address and no account.

If you are going to or saved an event and it is cancelled, moved or postponed, we email you once about that change. Each of those emails has an unsubscribe link, and you can switch them off at any time under Email me on your profile. If you post an event, we also email you when it is approved or declined; that is part of posting and is always sent.

If you ask for early access to the app, we store your email address, your language, the phone you use (iPhone or Android) if you said, where on the site you signed up from, and when. We use it only to send you one confirmation email now and one email when the app launches. You can remove yourself at any time with the Remove me link in those emails, or by contacting us. We delete the list 30 days after the launch email, or sooner if you ask.

The events website sets the cookies it needs to work: the sign-in session, a marker that tells the site you are signed in, and the language, light or dark theme and home city you pick. The home city is remembered for a year.

Our public website pages, including the events pages, also load Google Analytics, which sets its own cookies and receives your IP address, browser details and the pages you view so we can see how the site is used. We use it for statistics only, not advertising.

The map is drawn with tiles from OpenFreeMap, so your browser contacts that service when you open the map and it can see your IP address.

• Photos are kept for as long as the check-in they belong to exists — the same as the rest of your account data below.
• Messages in chats are kept for as long as the chat and your account exist, since they are part of a shared conversation with other people.
• Account data — your profile, plans, RSVPs, and check-ins — is kept until you delete your account.
• Backups — we keep encrypted backups of the database and of uploaded photos, videos and voice messages for up to 35 days. When you delete your account, your data is removed from live storage straight away and leaves the backups as they expire.

Mukaan’s application database runs on a server in Helsinki, Finland. Uploaded photos, videos, voice messages and event posters are kept on that server and in Cloudflare R2 object storage within the European Union, and our encrypted backups are kept in R2 as well. Delivery providers listed below may process the minimum information needed to provide email, push delivery, or network security from their own service locations.

The app also keeps a copy of your crews’ memories on your own phone: the chat messages, photos, voice notes and check-in photos you have seen, with the names of the people who shared them. It sits in the app’s private storage (included in your phone’s own backups), is only readable while you are signed in to your account, and exists so that shared memories survive when someone deletes their account. You can remove it at any time in Settings → Saved memories; deleting your account removes it too.

A small number of processors act on our behalf, strictly to run the service:

• Our VPS hosting provider — stores the database and files on the Helsinki server described above.
• Cloudflare — proxies traffic to that server so the app stays reachable, and stores uploaded photos, videos and voice messages, and our encrypted backups, in its R2 object storage in the European Union.
• Expo Push Service — relays your push notifications to Apple (APNs) and Google (FCM) so they arrive on your phone.
• Resend — sends the one-time sign-in code and the event emails described above to your inbox.
• Apple — processed App Store purchases made before Mukaan became free, and confirms who you are if you choose Sign in with Apple.
• Google — processed Google Play purchases made before Mukaan became free, and confirms who you are if you choose Sign in with Google.
• Google Analytics — measures visits to our public website, as described under “Cookies on the website”.
• OpenFreeMap — serves the map tiles on the events map.

None of them are permitted to use your data for their own purposes.

• Access and export — Settings → Download everything downloads everything we hold about you as a file.
• Erasure — Settings → Delete my account in the app, or Delete account on your profile on the events website, removes your email, name, photos, and the contents of your messages from our servers immediately. If you founded a crew, it is handed to another member rather than deleted, so their history survives. Your check-ins are kept but stripped of anything that identifies you — that is what keeps “3 of 4 showed up” true for the people who stayed. When you delete, you can choose to let the people you shared crews with keep seeing your first name on your shared memories. If you don’t choose this, your name is removed like everything else. Your I’m in and saved events go with your account. Events you posted that were never published are deleted; ones that were published stay listed for the people planning to go, shown as hosted by “A Mukaan host” with nothing that identifies you. Deleting your account is permanent and cannot be undone.
• Copies on other members’ phones — like a messaging app, each crew member’s phone keeps its own copy of the messages, photos, and names it has already received (see “Where your data lives”). We cannot reach into other people’s phones, so when you delete your account, copies they already have stay on their phones, shown with your name and marked as a deleted account. Anything they had not yet received is gone for good.