Privacy Policy

Last updated: May 2026

1

Introduction

Welcome to Maz ("Maz," "we," "our," or "us"). Maz is a social event planning application that helps groups of friends discover activities, vote on where to go, and save the memories. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

This Policy applies to the Maz mobile application, our website, and any related services that link to it (together, the "Service"). By creating an account or using the Service, you agree to the practices described here.

2

Information We Collect

a. Information you provide. When you create an account or use the Service, you may provide:

  • Account details: email address, password (hashed and never stored in plain text), or a third-party identifier from Google or Apple if you choose social sign-in
  • Profile details: first and last name, profile photo or selected avatar, bio, timezone, date of birth, phone number, your unique Maz code, interests, and optional links to social profiles
  • Social graph: friends you add, friend requests you send or receive, users you block, and the groups you create or join
  • Event and activity content: events you organize or attend, activities you suggest or favorite, votes you cast, RSVPs, time proposals, and photos you upload as event memories
  • Communications: messages you send to our support team or feedback you submit

b. Information collected automatically. When you use the Service we automatically collect:

  • Device information: device model, operating system and version, unique device identifiers, language, and timezone
  • Push notification tokens issued by Apple Push Notification service or Firebase Cloud Messaging
  • Usage data: features you interact with, the actions you take in groups and events, and timestamps
  • Diagnostic data: crash logs, performance metrics, and error reports used to keep the Service stable

c. Location, camera, photos, and calendar. With your permission, the Service can access:

  • Location — to help you find activities and venues nearby. We do not track your location in the background.
  • Camera and photo library — to set a profile picture and capture or upload event memories
  • Calendar — to add confirmed events to your device calendar and check for conflicts
  • Motion sensors — to power small visual effects in the app

You can grant or revoke each of these permissions at any time through your device settings.

3

How We Use Your Information

We use the information we collect to:

  • Create and authenticate your account and keep it secure
  • Provide the core features of the Service: friend connections, groups, activity discovery, voting, event scheduling, and event memories
  • Show suggested activities relevant to your location and the groups you participate in
  • Send transactional emails and push notifications about events, votes, friend requests, and account activity
  • Diagnose crashes, debug issues, and improve performance
  • Detect and prevent abuse, spam, and violations of our Terms of Service
  • Comply with legal obligations
4

How We Share Your Information

We do not sell your personal information. We share information only in the following situations:

  • With other Maz users. Your profile, Maz code, and activity within a group or event are visible to friends, group members, and event participants. Anyone with a friend invite or group invite link you share can see the associated profile and group details.
  • With service providers. We use trusted third parties to host our infrastructure, deliver push notifications and email, store media, and monitor errors. They process information on our instructions and are bound by confidentiality and data-protection obligations. See Section 5 for the specific providers.
  • For legal reasons. We may disclose information if required by law, subpoena, or court order, or where necessary to protect the rights, property, or safety of Maz, our users, or others.
  • In a business transfer. If Maz is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership.
  • With your consent. We will share information for any other purpose only with your explicit consent.
5

Third-Party Services

The Service relies on the following third-party processors. Each provider has its own privacy policy that applies to data they process on our behalf:

  • Amazon Web Services (AWS) — application hosting, database, photo and media storage (S3), transactional email (SES), and content delivery (CloudFront)
  • Google (Sign-In, Maps, Places) — authentication via Google account, map rendering, and venue information for activity discovery
  • Apple — Sign in with Apple, and Apple Push Notification service for iOS notifications
  • Firebase (Google) — Firebase Cloud Messaging for Android and iOS push notifications and Crashlytics for crash reporting
  • Vercel — hosting for this website

We do not use advertising networks, do not run third-party advertising trackers, and do not use the Service to build advertising profiles about you.

6

Data Storage and International Transfers

Our primary application servers and databases are located in the European Union (AWS eu-north-1, Stockholm). Some of our service providers, including push notification services and OAuth providers, may process information in the United States or other countries. When information is transferred outside your country, we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission to protect your data.

7

Data Security

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest for our databases and media storage, hashed passwords using industry-standard algorithms, signed JSON Web Tokens for session authentication, and access controls that limit who within Maz can access user data. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8

Data Retention

We keep your personal information for as long as your account is active or as needed to provide the Service. Specific retention rules include:

  • Push notification tokens are automatically deleted after 90 days of inactivity
  • When you delete your account, your profile is anonymized and your personal identifiers are removed within a reasonable period
  • Content you posted to a group or event (such as votes or shared photos) may remain visible to that group, in anonymized form, after account deletion
  • We may retain limited information for as long as necessary to comply with legal obligations, resolve disputes, prevent abuse, and enforce our Terms of Service
9

Your Rights and Choices

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you
  • Correct information that is inaccurate or incomplete
  • Delete your personal information, subject to limited exceptions
  • Object to or restrict certain types of processing
  • Receive a portable copy of your information
  • Withdraw consent where processing is based on consent
  • Lodge a complaint with your local data-protection authority

You can exercise most of these rights directly in the app or by contacting us at the email below. You can also manage device-level permissions (location, camera, photos, calendar, notifications) in your operating system settings.

10

Account Deletion

You can delete your account at any time from within the app. When you do, we mark your account as deleted, anonymize your email address, and remove your profile from public view. Some content posted to groups and events may persist in anonymized form so that the rest of the group can still see the history of their plans. Backups containing residual data are purged on a rolling basis according to our backup schedule.

11

Children's Privacy

Maz is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. In jurisdictions where the minimum digital-consent age is higher (for example, 16 in parts of the European Economic Area), users below that age must have verifiable parental consent. If you believe a child has provided us with personal information, please contact us and we will delete it.

12

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app or by email. Your continued use of the Service after the changes take effect means you accept the updated Policy.

13

Contact Us

If you have questions about this Privacy Policy or want to exercise any of your rights, please contact us at:

Email: privacy@maz.app