Privacy notice

1. Who we are

NappyMap Limited (Companies House no. 17029501) is the data controller for the personal data described in this notice.

For any privacy question, contact us at hi@nappymap.co.uk.

2. What we collect

Anonymous identifier. When you first visit, we create an anonymous ID (a Firebase Auth anonymous UID) with no sign-up required. It's stored in your browser (IndexedDB) and attached to any comment, venue or facility update you make, so we can attribute and moderate contributions. It is not linked to your name, email or any account.

Contributions. If you add a comment, we store the comment text and the display name you type with it. If you upload a photo, we store four resized versions of it (thumbnail through to full size) linked to the venue and comment. If you answer facility questions (e.g. "does this venue have baby-changing?") or add a venue, we store that too.

Approximate location. Only if you grant browser permission. Used to centre the map and sort venues by distance. We never write this to our database - it stays in your browser session.

IP address. Our hosting provider (Google Cloud Run) sees your IP address in the course of serving each request, as any web server does. We don't store it ourselves. It is also used momentarily by our visit counter (see section 4) to create a one-way hash - the address itself is never saved.

3. Cookies and similar technologies

• _hp2_id.3206675156

  Heap analytics - identifies a returning visitor.

  Set only after you accept

• _hp2_ses_props.3206675156

  Heap analytics - session properties.

  Set only after you accept

• nappymap.consent (localStorage)

  Records your cookie choice, so we can honour it.

  Strictly necessary

• firebaseLocalStorageDb (IndexedDB)

  Your anonymous session, so contributions can be attributed and moderated.

  Strictly necessary

• nappymap_locations_cache (IndexedDB, 24h)

  Caches public venue data so the map loads quickly, even on a poor connection. Contains no personal data.

  Strictly necessary

Our visit counter (section 4) does not use any cookie or store anything on your device at all.

You can change your cookie choice at any time: reopen the cookie banner, or use Cookie settings in the menu.

4. How we measure site usage

Basic visit counting (no consent needed). We record aggregate visit counts using a one-way hash of your IP address and browser type, combined with a salt that changes every day. This means we cannot link visits from the same person across different days, and once a day's salt is gone, the hash cannot be reversed to reveal an IP address. Nothing is stored on your device. We aim to keep these records for no more than 90 days (see section 8).

Detailed analytics (only with your consent). If you accept analytics cookies, we use Heap to understand how the site is used. Heap does not record anything you type. It receives a fixed, limited set of events (page views and interactions like venue searches), tagged only with public information such as venue names - never personal details.

5. Error monitoring

If something goes wrong on the site, we use Sentry to capture the error message, a technical trace, the page URL, and basic browser/device information, so we can fix bugs. We deliberately strip out your anonymous ID and any query string parameters before sending this data, and we do not store IP addresses in our error monitoring at all - so error reports cannot be traced back to you.

6. Who else processes your information

• Google (Firebase, Cloud Run, Maps/Places) - hosts our site and data, and powers the map.
• Heap Inc (part of Contentsquare, US) - analytics, only if you consent to cookies.
• Sentry (Functional Software, Inc.) - error monitoring. Event data is kept in Sentry's EU region.

7. Our legal basis for processing

• Contributions and your anonymous ID - necessary to provide the service you're using.
• Basic visit counting - our legitimate interest in understanding site traffic, balanced against your privacy (nothing identifiable is kept).
• Heap analytics - your consent, which you can withdraw at any time.
• Error monitoring - our legitimate interest in keeping the site working reliably.

8. How long we keep your data

• Visit-counter records: we intend to delete these after 90 days. Each record already carries a 90-day expiry stamp, but the automatic deletion that acts on it is not switched on yet, so this is our intention rather than something already automated.
• Comments, photos and venue contributions: kept until you or we remove them. Removal is permanent and deletes every stored size of a photo, not just the one shown.
• A comment someone has reported is hidden immediately. If we haven't reviewed it within 30 days we delete it. Like the visit-counter records above, that clear-out is something we run rather than something that happens on its own yet, so 30 days is our aim rather than a guarantee. We are automating it.
• Error monitoring data: retained per Sentry's standard plan terms.

9. Your rights

You have the right to access, correct, delete, or ask us to restrict use of your personal data, and to object to processing based on legitimate interests. To exercise these rights over your contributions, contact us with your anonymous ID if you still have it (found in your browser).

For the basic visit counter, we are unable to identify you from the data we hold - the hash cannot be reversed, and nothing is stored on your device - so we cannot link a request to a specific person. UK GDPR (Article 11) recognises this: where a controller cannot identify a data subject, the usual access/erasure rights don't apply in the same way, and this notice states that plainly rather than leaving it unclear.

You also have the right to complain to the Information Commissioner's Office (ICO) - see below.

10. Complaints

Please contact us first at hi@nappymap.co.uk so we can try to resolve any concern directly. You can also complain to the ICO at ico.org.uk or 0303 123 1113.

11. Changes to this notice

We'll update the "last updated" date above whenever we make changes. For a material change to how we use your data, we'll also reset your cookie consent so you're asked again.