Privacy Policy

Last updated 26 August 2026

Mappack is a tool for people who manage Google Business Profiles on behalf of other businesses. It is built and run by one person, and this policy is written to be read rather than skimmed past.

It covers the getmappack.com website and the Mappack app you sign in to with Google. Questions about any of it: jordan@getmappack.com.

What Mappack asks Google for

When you sign in with Google, Mappack requests three permissions and no others:

• openid — so Google can confirm which account signed in.
• email — so Mappack knows that account's email address. The Business Profile permission below carries no identity at all, so without this one there is no way to tell one signed-in person from another.
• https://www.googleapis.com/auth/business.manage — to read and manage the Google Business Profiles that account already manages.

You will see all three on Google's consent screen, and you can withdraw them at any time.

What data that gives access to

• Your email address, from Google's sign-in. It is the only personal detail about you that Mappack receives — not your name, not your profile picture, not your contacts.
• The Business Profiles that account manages: the list of accounts, and for each business its name, address, categories, and whether Google is currently showing it normally.
• The performance figures Google publishes for those profiles: how many people found the business on Google Search and on Google Maps, phone calls, direction requests, website clicks, messages and bookings.
• Posts that Mappack publishes to those profiles on your instruction, and a record of which post went to which profile.
• Who administers each profile — the people and roles Google lists as having access — so Mappack can point out an owner or an unaccepted invitation you may not have known about.

Mappack does not ask for, receive or store your Google password, your contacts, your calendar, your Drive, your Gmail, or any Google data outside the Business Profiles the signed-in account already manages.

What it is used for

Only the job you signed in to do: showing your profiles on one screen, publishing the posts you write, building the monthly report you send your client, and telling you when a profile has been suspended or has someone unexpected attached to it.

That is the whole list. Google user data is not used for advertising, not used to build a profile of you, and not used to train any machine-learning or AI model. No human reads it, except where you ask for help with something and seeing it is the only way to answer you.

Where it is stored, and for how long

• Your sign-in session lives in an encrypted cookie in your own browser (AES-256-GCM). The Google access token sits inside it. It is not held on a server, and it expires after one hour, after which you sign in again. Mappack does not currently ask Google for a refresh token, so nothing can hold access open once that session ends.
• A record of published posts — which profile, when, and a short fingerprint of the post text rather than the text itself — is kept so the same message cannot be published twice by accident. It is stored with Netlify, the hosting provider.
• Everything else is not stored at all. Your profile list, the performance figures, the standing check and the access list are fetched from Google while the page is open and are gone when you close the tab.

Netlify, Inc. hosts the site and stores that record, acting as a processor on Mappack's behalf. Google is the source of the data itself.

It is not sold, and not shared

Mappack does not sell your data. It is not shared with advertisers, data brokers, or any other third party, and it is not transferred anywhere except to the hosting provider needed to run the service and to Google itself.

There is no third-party analytics, no advertising pixel and no tracking script on getmappack.com or inside the app.

Cookies

Two, both strictly necessary. One holds your sign-in session. One is short-lived and exists only during sign-in itself, to protect against request forgery. There are no advertising or analytics cookies.

The waiting list

The sign-up form on getmappack.com submits through Netlify Forms, and your address is stored with Netlify, Inc. — the same company that hosts this site, and the only company involved. It is not sent to Mailchimp, ConvertKit, or any other email marketing service, because no such account exists. If one is ever introduced, this page will name it before a single message is sent through it.

Netlify screens form submissions for spam on Mappack's behalf, and its spam filtering is provided by Akismet (Automattic, Inc.), so a submission passes through that check on the way in.

The address is used for one thing and one thing only: a single message when Mappack opens. It is not sold, not used for advertising, and not shown to anyone but Jordan. It is kept until that message has gone out, or until you ask for it to be removed — whichever comes first.

To be removed sooner, reply to that message or write to jordan@getmappack.com, and it is deleted.

Your choices

• Withdraw access at any time from your Google account's permissions page at myaccount.google.com/permissions. That ends Mappack's access to your Business Profiles immediately.
• Sign out to clear the session cookie from your browser.
• Ask for deletion. Email jordan@getmappack.com and the record of published posts held for your account will be deleted, along with your address if it is on the waiting list.

Children

Mappack is a tool for businesses and is not directed at anyone under 16.

Changes to this policy

If this policy changes, the date at the top changes with it. If a change materially affects how Google user data is handled, anyone with an account will be told by email before it takes effect.

Contact

Jordan Dinovitzer — jordan@getmappack.com