Draft — not yet in force. Details in [square brackets] are still to be confirmed.
privacy policy
Privacy Policy
Last updated 4 October 2026
The short version. The rest of this page has the detail.
- Mistify is public by design. In Spaces, your membership, group chat messages and Space posts can be seen by everyone on Mistify, even if your account is private, and posting in a Space’s feed puts you on its Popularity Board. Your Individual Posts, including the exact place you pin them, can be seen by everyone on Mistify, or only by followers you approve if your account is private.
- We use your location only while the app is open, for example to check you are at a Space when you join it. We never share your live location with other users.
- We don’t sell your data and we don’t show ads.
- Your data is stored in the UK and the US, with Amazon Web Services and Google.
- You can see, correct, download or delete your data, and complain to us or to the ICO.
1. Who we are
Mistify is run by Mistify Labs Ltd, a company registered in England and Wales (company number 17229665), whose registered office is 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the controller of the personal data described in this policy, which means we decide how and why it is used and we are responsible for it under UK data protection law.
For anything about your personal data, email us at support@mistify.app.
This policy explains how we use personal data in the Mistify app on iOS and Android and on this website. Our Terms of Service are the contract between us.
2. What we collect
Mistify has two kinds of post. Space posts are the photos and videos you post in a Space’s feed. Individual Posts are the photos and videos you post on the map, not in a Space, pinned to a point you choose within 25 km of where you are.
What you give us
| Type | Details |
|---|---|
| Sign-in details | The name and email address your Google or Apple account shares with us when you sign in with it. |
| Profile | Name, username, date of birth, gender, profile photo and bio. |
| Spaces | The Spaces you join and leave, and when; your acknowledgement of the Space guidelines; and when you last viewed each Space’s feed and chat, so we can show you what’s new. When you join a Space, we check your location once to confirm you are within its join radius, and we don’t keep it (see Location). Your Space posts (photos and videos, captions and the post category; they are placed at the Space itself, not where you are) and the group chat messages you send. Your ranking on each Space’s Popularity Board, which we work out from the likes, comments and shares your Space posts receive. |
| Individual Posts | Photos and videos, captions, the post category, whether it is a disappearing post, and the place you pin it to (see Location). |
| Activity | Comments, likes and dislikes, posts you view, shares, follows and follow requests, blocks, and your settings (private account and who can message you). |
| Messages | Direct messages and space chat messages you send, with when they were sent, edited, delivered and read. |
| Reports and contact | Reports you make (including any details and screenshots you add), and anything you send us by email. |
What we collect automatically
| Type | Details |
|---|---|
| Device location | Only while the app is open and only if you allow it (see Location). |
| Notifications | A push-notification token for your device, and which platform it is (iOS or Android). |
| App analytics | Which screens you open, how you signed in, and device and app information (model, operating system, app version, a random app-instance ID, and your approximate country or region), collected through Google Analytics for Firebase. We use it only to understand and improve Mistify. Google processes it for us as our processor and doesn’t use it for its own purposes or for ads. You can switch it off in Settings → Usage analytics. |
| Security checks | A confirmation from Apple (App Attest) or Google (Play Integrity) that requests come from a genuine copy of the app. |
| Technical data | Our servers and service providers necessarily receive your IP address and basic request information when the app talks to them. |
What we get from others
- Google or Apple, when you sign in with them (name and email).
- Other users: reports about you, messages they send you, comments on your posts, and follow requests.
- Our own records: moderation decisions and violations on your account.
What you must provide
To create an account you must sign in with a Google or Apple account and give your name, your date of birth (so we can check you are 18 or over), your gender (you can choose “Prefer not to say”) and a username. Your profile photo and bio are optional. Without location permission you can still browse, but you can’t post or join a space.
3. Location
Mistify is a map, so location is at its heart. Here is exactly how we use it.
- Only while the app is open. Mistify never reads your location in the background. You can turn location off at any time in your phone’s settings.
- Showing you what’s nearby. We use your position to centre the map and to work out how far posts are from you. It is sent to our servers with those requests. It is not saved to your account or shown to anyone.
- Pinning an Individual Post. When you post an Individual Post, you choose where it appears: anywhere within 25 km of where you are, or your current location if you don’t choose. We store that exact point with the post, together with the area, city and country name, which we look up from the point.
- Joining a space. We check your precise location once, to confirm you are within the space’s join radius. We use it for that check only and don’t store it.
Other people can see where your Individual Posts are pinned. An Individual Post appears on the map at the exact point you chose, with the place name and how far it is from the viewer. Unless it is a disappearing post, it also stays on your profile’s footprint map, at the same point, until you delete it. If you don’t want a place linked to you, such as your home, don’t pin an Individual Post there.
Photos and videos can carry hidden details of where they were taken. We remove location details from photos before they are uploaded (the app sends photos as JPEGs; a small photo in another format, such as HEIC, may be uploaded as it is). Most videos are re-encoded when you upload them, which drops those details too, but some short or small clips are uploaded as they were recorded. If you don’t want to share where something was taken, turn off location for your camera in your phone’s settings.
4. What other people can see
Mistify is a public social app. Most of what you post is meant to be seen. This table shows who sees what.
| What | Who can see it |
|---|---|
| Space posts, and messages in a Space’s group chat | Everyone signed in to Mistify, whatever your account’s privacy setting: a private account doesn’t hide them. Space posts stay in that Space’s feed until you delete them, and don’t appear on your profile. |
| The Spaces you have joined | Everyone on Mistify, whatever your account’s privacy setting, through the Space’s member list. The Space also appears on your profile map. |
| Your place on a Space’s Popularity Board | Once you’ve posted in a Space’s feed, everyone on Mistify who views that Space, whatever your account’s privacy setting. They see your name, username, profile photo, score, and the likes, comments and shares behind it. |
| Your name, username, profile photo, bio, badges, follower and following counts | Everyone signed in to Mistify, even if your account is private, except people you’ve blocked or who have blocked you. |
| Your Individual Posts, including where they are pinned, and your footprint map | Everyone on Mistify if your account is public; only the followers you approve if it is private. An Individual Post is on the map for 24 hours, then leaves the map. Unless it is a disappearing post, it stays in The World and Following feeds, and on your profile and footprint map, until you delete it. A disappearing post is removed from everywhere (the map, The World, Following and your profile) 24 hours after you post it. |
| Comments, likes and dislikes | Anyone who can see the post. |
| Views | Anyone who can see a post sees how many people viewed it. Only the post’s author can see who. |
| Your date of birth and gender | Only you. Once a space has at least 10 active members, it shows their overall gender mix and age range as totals, never anyone’s own details. |
| Direct messages | You and the person you’re talking to. They can see when a message was delivered and read, and whether you currently have your conversation with them open. If either of you deletes your account, the whole conversation is deleted. |
| Share links | Anyone you send a link to, even without a Mistify account. They see the post, your name, username and photo, and its city, country and rough area. Posts from private accounts can’t be shared, and a link stops working if the account becomes private. Otherwise, a link to a post keeps working as long as the post exists. |
Anything other people can see, they can also screenshot, save or share outside Mistify. We can’t control copies made that way.
Our authorised staff can see account details, content and reports where they need to run, support and moderate Mistify. We don’t read direct messages as a matter of routine, but we may access them to investigate a report, enforce our terms, or comply with the law.
5. How we use your data, and our lawful bases
UK data protection law requires a lawful basis for each use of your data. These are ours:
| What we do | Lawful basis |
|---|---|
| Create and run your account; show your profile, Spaces, posts and messages; place Individual Posts on the map and work out distances; check you are within a Space’s radius; deliver notifications you ask for | Contract: we need it to provide the service you signed up for. |
| Show your place on a Space’s Popularity Board, ranked by the likes, comments and shares your Space posts receive | Legitimate interests: showing activity in a Space. |
| Check you are 18 or over | Contract, and our legitimate interest in keeping under-18s off an adults-only service. |
| Use your gender and age, combined with other members’, to show a space’s overall gender mix and age range as anonymised totals, only for spaces with at least 10 active members | Legitimate interests: helping people see who a space is for, without showing anyone’s own details. You can choose “Prefer not to say” for your gender. |
| Handle reports, moderate content, apply our rules, detect illegal content, and keep a record of violations | Legal obligation (our duties under the Online Safety Act 2023) and our legitimate interest in keeping Mistify safe. |
| Prevent fraud, spam, abuse and ban evasion; keep our systems secure | Legitimate interests (security and preventing crime). |
| Understand how the app is used, fix problems and improve it | Legitimate interests. You can switch app analytics off at any time in Settings → Usage analytics (see Your choices). |
| Report child sexual abuse material to the National Crime Agency; respond to lawful requests from the police, courts and regulators | Legal obligation, or the “recognised legitimate interests” in UK law for preventing crime, safeguarding and emergencies. |
| Deal with legal claims and disputes | Legitimate interests. |
| Send you news or marketing (we don’t do this at present) | Only with your consent, which you can withdraw at any time. |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details of that assessment.
Sensitive information
We don’t ask for information about your health, religion, ethnicity, politics or sexual life. But posts, messages and reports can reveal it, and reports can involve allegations of crime. We handle that information only to run the features you use and to moderate and keep people safe. We rely on the conditions UK law provides for preventing or detecting unlawful acts, safeguarding, regulatory requirements relating to unlawful acts, and legal claims. Our appropriate policy document explains how; you can ask us for it.
Automated steps
Some moderation steps happen automatically when several people report the same content. At 5 reports a space chat message or Space post is hidden and its author paused in that space. At 8 reports a post is blurred as sensitive. These are temporary holds until a person on our team reviews them. We don’t make decisions with legal or similarly significant effects about you by automated means alone, and every final moderation decision is made by a person. Our moderation decisions, including bans, are final within Mistify. There is no appeals process. If you believe we made a mistake, you can email support@mistify.app and we’ll look at it when we can.
7. International transfers
Some of the providers above store or access data outside the UK, mainly in the United States, and our media delivery network serves files from locations worldwide.
For transfers to the US we rely on the UK’s adequacy regulations for organisations certified under the UK Extension to the EU–US Data Privacy Framework. Google LLC, which provides Firebase, is certified under it, and Google’s standard contractual clauses apply as a backup. Where a recipient isn’t certified, or for other countries without UK adequacy regulations, we use the ICO’s International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses. You can ask us for a copy of the safeguards that apply by emailing support@mistify.app.
8. How long we keep data
| Data | How long |
|---|---|
| Account and profile | Until you delete your account. |
| Individual Posts (media, caption, location) | Until you delete them or your account. An Individual Post that isn’t a disappearing post is on the map for 24 hours, then leaves the map. It stays in The World and Following feeds, and on your profile and footprint map, until you delete it. |
| Space posts | Until you delete them or your account. They stay in the Space’s feed until then. |
| Disappearing posts | Removed from everywhere (the map, The World, Following and your profile) 24 hours after you post them. We keep a copy for safety and moderation until your account is deleted. |
| Posts and comments you delete | Removed from view immediately. We keep a copy for safety and moderation until your account is deleted. |
| Messages | Until you delete them or your account. Deleting a message removes its text for everyone straight away, but a notification already delivered to the other person’s phone stays there. |
| Reports, moderation decisions and violations | While your account exists. If your account is deleted, we may keep records of reports, violations and safety concerns involving it for up to 12 months, to protect people and to deal with legal claims. |
| Banned accounts | A banned account can’t be deleted from the app. We keep it, and the email address used, for as long as the ban stands, so the same person can’t sign straight back up. To ask about deleting it, email us. |
| Complaints you send us, and our replies | 2 years after the complaint is closed, so we can show how we handled it. |
| Content we report to the National Crime Agency | At least 1 year, and the report reference for 5 years, as the law requires. |
| App analytics | Up to 14 months. |
| Server logs | As long as we need them for security, fixing problems and preventing abuse. |
| Backups | Database backups are overwritten within 7 days. |
When you delete your account (Settings → Delete Account), we delete it straight away: your profile, posts, photos and videos, comments, likes, follows, space memberships, reports, your direct message conversations (for both people) and your space chat messages, and your sign-in account. Copies in database backups are overwritten within 7 days. The exceptions are material we are legally required to keep, such as content we have reported to the National Crime Agency, for as long as the law requires, and our record of any complaint you made, for 2 years after it closed. You can also ask us to delete your account by email: see Delete your account.
9. Your rights
Under UK data protection law you have the right to:
- access a copy of your personal data;
- correct data that is wrong or incomplete;
- erase your data;
- restrict how we use it;
- object to uses based on legitimate interests, including analytics;
- data portability: receive data you gave us in a machine-readable format, or have it sent to another provider;
- withdraw consent at any time, where we rely on it;
- ask for a person to review, and to contest, any decision made about you by automated means.
Some rights have limits. For example, we may keep information we need for safety or legal reasons. To use any right, email support@mistify.app from the email address linked to your account, or tell us your username. We may ask you to confirm your identity. We reply within one month, which can be extended by up to two further months for complex requests (we’ll tell you if so). Using your rights is free.
Complaints
You have the right to complain to us. Email support@mistify.app with “Data protection complaint” in the subject. We acknowledge complaints within 30 days and respond without undue delay.
You also have the right to complain to the Information Commission, known as the ICO, the UK’s data protection regulator: ico.org.uk/make-a-complaint, or 0303 123 1113. We’d appreciate the chance to deal with your concern first.
10. Your choices
- Private account: only followers you approve see your Individual Posts. It doesn’t hide anything you post or say in a Space.
- Popularity Board: to leave a Space’s Popularity Board, delete your posts in that Space; to stay off it, don’t post in that Space’s feed.
- Who can message you: Everyone; Followers only (only people who follow you can start a conversation); or No one (nobody can message you, including in conversations you already have, and you can’t message anyone either).
- Block anyone. They can’t message you or see your profile or posts. Space chats are public, so both of you can still read messages there.
- Location and notifications: turn them on or off in your phone’s settings at any time.
- Analytics: switch off Settings → Usage analytics at any time. It is off on that device from then on.
- Delete any post or message you sent, or delete your whole account from Settings in the app (see Delete your account).
11. Notifications and device permissions
If you allow notifications, we send you alerts about activity on your account: messages, likes, dislikes, comments, follows, activity in your spaces, and moderation notices. A message notification shows the sender’s name and the message text, so anyone who can see your phone’s lock screen may see it.
We ask for your camera, microphone and photo library only when you use them to take or choose photos and videos, and we upload only what you choose to post.
13. Security
We protect your data with access controls, encryption in transit, encrypted storage of sign-in details on your device, and by limiting which staff can see personal data. No system is completely secure. If a breach puts you at high risk, we will tell you without undue delay.
14. Adults only
Mistify is only for people aged 18 and over. We check your date of birth when you sign up. If we learn that someone under 18 has an account, we close it and delete their data, except what we must keep for safety or legal reasons. If you believe a child is using Mistify, please report their profile or email support@mistify.app.
15. Changes to this policy
We update this policy when what we do with data changes. If a change matters to you, we will tell you in the app before it takes effect. The date at the top shows when it was last updated.
16. Contact us
Mistify Labs Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Company number 17229665. Email: support@mistify.app.