Privacy
This is a list of what the database actually contains, who can read each row, and what happens to all of it when you leave. It is written from the schema rather than from a template.
Last updated 27 August 2026
The short version
- Nothing is sold, and nothing is advertised. There is no ad network here, no data broker, and no arrangement under which anything you write leaves for money.
- There is no analytics of any kind. No Google Analytics, no pixel, no session recorder, no A/B tooling. Nothing on the site is watching how you use it.
- Your location never reaches the server. If you allow location access the coordinates stay in your browser and are used to sort the list by distance. They are not sent anywhere and not stored.
- Almost everything you add is private by default. A new pin is Just you until you decide otherwise.
- Deleting your account deletes what you wrote, not just the login.
- You can take a copy of all of it whenever you like. Settings → Account → Download my data hands you every row below as one JSON file, with no reason asked and nothing to wait for.
What is stored, and why
Every row Forklist keeps about a person is in this table. "Who can read it" means who the server will show it to — it is enforced by one shared rule that every query goes through, not by the screen deciding what to draw.
| What | Why it exists | Who can read it |
|---|---|---|
| Google account id | Identifies you across sign-ins. Used instead of your email, because an email address can be reassigned to a different person and this identifier never is. | Only the server |
| Email address | So a friend can add you before you have signed up, and so a reply to a support message can reach you. | You, and anyone who already knows the address well enough to type it |
| Name and avatar | Shown next to what you add. Taken from Google unless you set your own name in Settings, which then survives Google changing theirs. | Your friends, and members of your groups |
| Sign-up and last-seen dates | Last-seen is refreshed on sign-in. It is what a friend profile means by "friends since". | You |
| Your pins and notes | The point of the app. A note is up to 500 characters, plus an optional 1–5 rating and up to five tags from a fixed list. | Whoever the note's audience says: just you, your friends, one group, or everyone |
| Places | Name, category, coordinates and address of somewhere pinned. A place is shared — several people leave notes on the same restaurant. | Anyone who can see at least one note on it |
| Upvotes | Ranking, and telling your friends you recommend somewhere too. | Your friends see that you recommend the place — not which note you agreed with |
| Friendships and requests | One row per pair, plus who asked. A request to an address with no account yet waits until that person first signs in. | The two people in it |
| Groups you are in | Membership and role. The group password is stored only as a bcrypt hash, never as the password. | Other members of that group |
| Messages | Chats are keys into a fixed list of phrases, plus an optional pinned place. No message contains text anybody typed. | The two people in the conversation |
| Notifications | What happened while you were away. Carries a snapshot of the other person's name so it still reads correctly if they later leave. | You |
| Reports you file | A reason and optional detail. Three different people reporting the same note hides it pending review. | Whoever runs the site |
| Support messages | The one place free text you write is read by a human. Kept apart from everything else for exactly that reason. | Whoever runs the site |
| Session records | So a session can be revoked, which a self-contained signed cookie cannot be. What is stored is a SHA-256 of the cookie's token, not the token — a copy of this table yields no usable session. | Only the server |
What is not stored
- Your password. Sign-in goes through Google and Forklist never sees one.
- Your location. As above: the browser works out distances and keeps the coordinates.
- A history of what you looked at. There is no record of which spots you opened, searched for, or scrolled past.
- Your IP address, as a rule. It is held in memory for a few minutes to rate-limit abusive traffic, and never written to the database — with one exception, below.
The exception: an upvote or a report has to be attributable to someone, or the same person can press it repeatedly and it stops measuring anything. That identity is your account if you are signed in, a random token your browser generated if you are not, and only if neither of those exists does it fall back to a value derived from your IP address. Since adding, voting and reporting all require an account, in practice this is your account id.
What leaves the site
Two separate things, both from Google, both unavoidable for an app that is a map you sign in to.
- Sign-in. Google tells Forklist your account id, name, email and avatar when you sign in, and nothing else. It knows you signed in here.
- Maps and Places. The map, the search box and a spot's photos, rating and description come from Google and are requested by your browser as you use them, so Google sees those requests. The photos and ratings are read at display time and never stored here.
Google's handling of that is governed by Google's own privacy policy, not this one.
Hosting
The site runs on Amazon Web Services in the United States. AWS holds the database and serves the traffic; standard web server logs exist as a consequence of that.
Nobody else
That is the entire list. There is no third party receiving your data for analytics, advertising, personalisation, crash reporting or anything else, because there is no such third party wired in.
Your rights, and the two buttons that exercise them
Under the UK and EU General Data Protection Regulation you have rights over the rows above. Two of them do not need asking for — they are controls in the app, and pressing one is the whole process.
| Right | What it means here | Where it is |
|---|---|---|
| Access — Article 15 | A copy of everything held about you, as one JSON file: your notes, the spots you added, what you have marked been and want to try, your friendships, your groups, your conversations, your notifications, your reports and your settings. Not a summary of them — the rows. Sign-in tokens and group passwords are left out, because they say nothing about you and a file you email yourself is the wrong place for either. | Settings → Account → Download my data |
| Erasure — Article 17 | Your account and what you wrote, gone, and not just the login. What exactly goes and what stays is set out under Leaving below, and the app counts it for your account before you commit to it. | Settings → Leaving → Delete my account and pins |
| Rectification — Article 16 | Your name, your line, your city and your picture are yours to change whenever you like, and a change travels to everything you have ever added rather than only to what comes next. | Settings → Account, and your profile |
| Portability — Article 20 | The same file as Article 15. JSON, structured and commonly used, so it can be read by something other than this app. | Settings → Account → Download my data |
| Objection and restriction — Articles 18 and 21 | There is no profiling here, no advertising and no automated decision-making, so there is nothing of that kind to object to. Anything else, ask. | Support |
| Complaint | If the answer you get here is not good enough, you can complain to your national data protection authority. In the UK that is the Information Commissioner's Office. | Your own regulator |
Nothing on this list costs anything or needs a reason. The two in the app are immediate; for anything else, ask and it will be done — this is a small enough database that the answer is a query rather than a process.
Cookies, and what sits in your browser
Two cookies, both strictly necessary: one keeps you signed in, one protects the few seconds you are away at Google signing in. Your settings — theme, units, sort, filters, the pin colours — are not cookies at all; they live in your browser's own local storage, never leave your device, and are what the notice at the bottom of the app is telling you about the first time you arrive. There is no analytics cookie, no advertising cookie and no third party setting anything through this site, which is why that notice has one thing to say and nothing to ask.
The cookies page names both cookies, how long each lasts, and everything kept in local storage beside them.
Leaving
Settings → Leaving. You type DELETE rather than clicking a confirm button, because it cannot be undone and a confirm dialog is one stray tap away.
- Deleted: your account, every note you wrote, your upvotes, your friendships and pending requests, your group memberships, your conversations, your notifications, your support messages, and every session.
- Also deleted: any place left with no notes on it at all, and any group where you were the only member.
- Kept: places other people have also written about. Removing a restaurant from everyone else's map because one of three people left would be the wrong outcome.
- Asked first: if you lead a group that other people are in, you choose who takes it over before the deletion runs.
Before you commit to it the app shows you the count of exactly what will go. You can also just ask, and someone will do it for you and confirm. Either way this is Article 17, and nothing about it needs a reason from you.
Children
Forklist is not intended for children under 13, and accounts are not knowingly created for them. If you believe one exists, say so and it will be removed.
Changes, and asking
If this page changes in a way that affects what is collected or who can see it, the date at the top changes and the change is described here rather than quietly applied.
A copy of everything held about you and a deletion are both buttons in the app now — see the rights table above. Anything else, a correction, a question about a row, or a copy you would rather somebody sent you: ask, and it will be done. This is a small enough database that the answer is a query, not a process.
How to get hold of me