Privacy Policy

Marco · Plans With Friends

Last updated: 22 October 2026

The short version

This policy applies to the Marco app for iPhone, the Marco app for Android, and the website at letsmarco.com. Where they differ, the difference is stated.

Marco is a map of plans. We store what’s needed to show the right plans to the right people — your profile, your friendships, the events you make and join — and honour the visibility choices you set inside the app. The apps never send your device’s position to our servers; the website uses an approximate position only when you ask it to show what is near you, and does not store it. Your address book is never uploaded. We show no ads, we use no third-party analytics or advertising tools, and we do not sell your data. The iPhone app reports its own errors to us so we can fix them.

How Marco shows you to other people

Marco separates who you are into three layers, and the difference matters for your privacy:

• An account identifier. A random technical id. Nobody sees it, including you. It exists so our servers can tell accounts apart.
• Your handle (for example @karl). Unique, changeable, and public by design. It is what Marco shows first about you everywhere — in RSVP lists, on plans you host, and in your profile link. It appears in any link or QR code you share, so we do not offer a setting to hide it. What you can control is whether people can find you by searching for it.
• Your real name. Optional, private by default, and never used as your public label. See below.

Your real name

You can add your real, full name. It is optional — Marco works without one.

Your name is never the primary way you appear; your handle is. Where your name is shown at all, it is a quieter second line, and only to people you have allowed. You choose from four levels, each including the one before it:

• Everyone — anyone who can see your profile
• Friends & hosts (default) — your friends, plus the host of a plan you have said you are going to or might
• Hosts only — only the host of a plan you have said you are going to or might
• Only me — nobody, except the host of an event that requires real names (see below)

“Host” is deliberately narrow: the host of an event where your RSVP is going or maybe, and only until that event ends. Not everyone who has ever invited you, and not indefinitely.

Hosts who check names at the door. A host can mark an event as requiring real names — a club matching a guest list against ID, for example. Such an event says so before you respond. If you respond to it, its host and co-hosts can see your name, whatever your name setting. A host can only turn this requirement on while nobody already on the guest list keeps their name to themselves, so your name is never shared with a host because of a change made after you responded.

Notifications never contain your real name. Push notifications use handles only, because a notification arrives outside the app where our visibility rules cannot be applied.

We do not verify names today. If we introduce verified identity in future (see “Planned features”), we will update this policy before it ships.

Data we collect

Account data

• Your sign-in identity from Sign in with Apple or Sign in with Google (a technical identifier, your name, and your email if you chose to share it — Apple’s “Hide My Email” works fully with Marco). In the Android app, both sign-in methods are completed on letsmarco.com in your device’s browser, which then returns you to the app; see This website
• For Sign in with Apple, a one-time authorisation code, exchanged with Apple for a token that lets us revoke your Apple sign-in when you delete your account
• Your phone number, only if you choose to verify one (used so friends who already have your number can find you — see “Phone numbers”, below)

Profile data

• Handle, status line, and whether you are Quiet, Open or Out
• Your real name, if you provide one, and its visibility setting
• Your avatar: the character you build, an emoji, or a photo you choose to set
• For organizer accounts: organisation name and type, city, public links, verification-call details, and the email address and optional phone number you give us so we can contact you about verification

Social data

• Your friendships and friend requests (including how you connected: search, QR, or contacts)
• Organizers you follow
• Groups you create; the groups and lists you belong to; your status in each; how and when you were added or joined; and a record that you left or were removed from a group, used so that you are not suggested to that organizer again and so that a person removed by an organizer can only ask to rejoin
• Your Invitations from organizers setting
• Accounts you have blocked, and reports you have submitted

Plans and events

• Events you create or are invited to: title, notes, category, start and end times (a plan may run across several days), visibility, capacity, whether real names are required, whether questions are open, and the event’s location (a place the host picks — not anyone’s live position)
• Your RSVPs, and your position on a waiting list if an event is full
• Photos you upload as event artwork
• Your check-ins (see below)
• Questions you ask, and answers you give (see below)
• For organizers: saved venues and their entry instructions

Settings and technical data

• Your privacy settings themselves (we need them to enforce them)
• A push notification token, only when you enable notifications in the iPhone app (the Android app does not use one; see Notifications)
• The days on which you use Marco, and which app and version you use, so that we can understand how Marco is used and which versions still need support
• Standard short-lived server logs (IP address, timestamps) used for security and keeping the service running
• Error reports from the iPhone app — see “When something breaks”, below

When something breaks

When the Marco app for iPhone hits a problem — a change that failed to save, a plan the server refused, a start-up that had to fall back to older data — the app sends us a short error report so we can find the bug. It records only failures: nothing you do successfully is included in an error report.

An error report contains:

• What went wrong: a short technical description, the name of the piece of code that failed, and the error it produced
• When it happened
• Which build of Marco you are running, and your iOS version
• Which account it came from, because a bug we cannot tie to an account is usually a bug we cannot fix

It does not contain the contents of your plans, your messages, your location, or anything you have written. Reports are batched and sent when the app goes to the background or the buffer fills, they are stored on our own servers rather than a third-party crash-reporting service, and they are deleted after 30 days.

The Marco app for Android does not send error reports. Should it do so in future, this section will be updated before it does.

What we do NOT collect

• Your GPS location. Your phone’s position is used on your phone: to centre the map, to sort plans by how near they are, and to confirm you are at a plan before you can check in. The apps never transmit your coordinates to our servers. The only coordinates we store are the ones a host picks for an event.
• Your position on the website, with one exception that you control. If you ask What’s on on the website to show plans near you, your browser asks for your permission, and your position, rounded to about one kilometre, is included in the address of the page so that our web server can show the plans within the distance you choose. It is used only to build that page. It is not stored by us and is not passed to Marco’s other servers; like any page address, it may appear briefly in our hosting provider’s request logs.
• Your address book. Contact-based friend finding works by matching salted cryptographic hashes of phone numbers — your contacts are never uploaded or stored on our servers, and you can turn off being findable by phone at any time. On both iPhone and Android, Marco reads your contacts only after you have granted it permission to do so, reads them on your device, and sends only the hashes of the phone numbers they contain. Names, and the phone numbers themselves, are not sent.
• Advertising identifiers, tracking pixels, or analytics profiles. There is no ad SDK and no third-party analytics SDK in Marco.
• Calendar contents. On iPhone, if you turn on calendar sync, plans are written to your calendar on your device. On Android, a plan is added to your calendar only when you choose Add to Calendar on that plan: your device’s calendar app opens with the plan’s details filled in, and Marco is given no access to your calendar. We never read your calendar.
• Anything, if you are only browsing. You can open Marco and look at public plans without an account. In that state we hold no profile for you.

Who sees what — your tiers

Visibility is the product. Inside Marco you control, per audience tier, who sees your presence, your status, your profile picture, and your plans. Events carry their own visibility (public, friends, invite-only) chosen by the host. On an event that is not public, everyone on it can see one another there, whatever their own settings. These choices are enforced on our servers, not just hidden in the interface: data outside your chosen audience is not delivered to other people’s devices.

Check-ins

You can tap to say you have arrived at an event. It is always a deliberate tap — Marco never checks you in by itself, and never infers that you have arrived somewhere.

We ask before the first one. Before you ever check in, Marco explains what it discloses and who sees it, and you can decline. Declining discloses nothing, and you will simply be asked again the next time you try. Agreeing is permission for the feature to exist for you — not a standing grant, and not a substitute for the individual tap each check-in still takes.

A check-in is quiet by design. It sends no notification to anyone. It adds warmth to that event’s marker on the map for as long as the plan is running, and people who can already see the event can see that you are there. When the plan ends, so does the warmth. Check-in counts may feed aggregate features such as busy-right-now indicators and the organizer statistics described below.

Who can see you are there, by name. Your friends, and you. If you are hosting, also the people on your own guest list — the ones you invited or who answered — so you can tell who actually turned up. To everybody else you are part of a count and nothing more. This is enforced on our servers: a name outside that audience is not sent to other people’s devices at all, rather than being sent and hidden. On a plan that is not public — one whose host chose the people on it — everyone on that plan can also see one another there.

Checking in somewhere new moves you: the plan you left keeps you for a short grace period, offers to keep you there if you are genuinely at both, and otherwise lets you go silently. Nobody is told that you left, and no departure time is shown to anyone.

Checking in requires you to be there. Marco will only let you check in to a plan if your phone is within about 500 metres of the venue. This is what makes a check-in mean something — to a host counting who turned up, and to the aggregate statistics described below.

That comparison happens on your device. Your phone works out how far it is from the venue and either allows the tap or does not; your coordinates are still never sent to us. What reaches our servers is the same thing it always was: which plan you checked into, and when.

If your phone reports a location that has been faked by other software, Marco will not accept the check-in.

You can refuse Marco access to your location and still use the app, including checking in. In that case Marco simply cannot confirm that you are there, and the check-in carries no confirmation with it. Nothing about your location is guessed or inferred in the meantime.

Questions on a plan

You can ask a host a question about their plan — “is there parking”, “what time do doors actually open”. This is deliberately not messaging:

• The question belongs to the event, not to the person. When the plan is over, so is the thread.
• It is one exchange: you ask, the host answers. There is no back-and-forth channel.
• Nobody’s contact details are ever exposed. The host answers inside Marco, and you are shown by handle — never your real name, whatever your name settings say.
• An unanswered question is visible only to you and the host. Answering publishes it to everyone who can see the event, so the next person wondering the same thing reads the answer instead of asking again.
• A host can turn questions off for a plan, and can only be asked one open question by the same person at a time.

We store the question, the answer, who asked, and when — for as long as the event exists.

Links to plans you’re not in

When someone forwards you a link to a plan you are not part of, we deliberately send your device less than the plan contains: its title, the day it happens, and who is hosting. Not the time, not the address, not the notes, not who else is going.

That reduction happens before the plan reaches your phone, not after — a link you hold cannot leak details that were never sent to you. If a host lets you in, you then receive the plan in full like anyone else on the guest list.

If you ask to join, the host sees that you asked, and your handle. If a guest put you forward, the host also sees who vouched for you. Nobody else sees either.

Groups and lists

Marco allows users and organizers to save sets of people, called groups, in order to share plans with them. There are three kinds.

Friend groups. A user may save some of their friends as a friend group in order to invite them to plans together. Only friends can be added. The name of a friend group is visible only to the user who created it. Members are not notified that they have been added to a friend group and cannot see it; they receive only the plans shared with it.

Member groups. An organizer may maintain a member group, such as the members of a club. A user becomes a member only by their own action: by joining through the group’s link, or by accepting the organizer’s invitation. Joining a member group also makes the user a follower of that organizer. A member may leave a member group at any time from their profile; the organizer is not notified. A person whom an organizer has removed from a member group cannot rejoin through its link; they may only ask to rejoin, and the organizer decides.

Private lists. An organizer may maintain a private list of people who follow it, or who were on the guest list of one of its own events (by responding to it, being invited to it, or joining its waiting list), in order to invite them to future events. People are not notified that they are on a private list. A user may prevent this at any time by switching off Invitations from organizers in Settings. This removes them from every organizer’s private lists, declines any group invitations they have not answered, and prevents them from being added to new lists. Member groups the user joined themselves are not affected. Unfollowing or hiding an organizer also takes you off its private lists, and keeps you off them until you follow it again or unhide it.

Information available to organizers. For each person in one of its own groups or lists, and for each person it considers adding to a list, an organizer can see:

• the person’s handle;
• the person’s name, only where that person’s name settings already allow this organizer to see it (see Your real name);
• the person’s status in the group (member, invited, or asked to join), how they were added, and the dates on which they were added and joined;
• how many of that organizer’s own events the person checked in to, the date of the most recent such check-in, and how many of that organizer’s events they responded “going” to.

Only events on whose guest list the person appeared are counted. An organizer cannot see a person’s activity at other organizers’ events, their location, their friends, or any information beyond that listed above. Figures about a group as a whole, such as the number of members active in the last 30 days or average attendance, are aggregate.

Exporting a member group. An organizer may download the members of a member group as a file. The file contains only each member’s handle and, where that member’s name settings allow this organizer to see it, their name. It contains no attendance information, no dates, no contact details, and no information about people who have been invited or have asked to join. Private lists cannot be exported. Marco records each download: which organizer profile downloaded the list, from which account, how many members it contained, and when. Once downloaded, the file is held by the organizer as an independent controller under data protection law, and may be used only to administer the organizer’s own membership.

Blocking and reporting

There are two different tools here, because hiding a venue you’ve grown bored of and blocking a person are not the same decision.

Blocking a person. The block is stored on our servers and enforced in both directions: they cannot see you, find you, or reach you, and you will not see them. Blocking works at the account level, so it covers every profile that account has. You can see and undo your blocks in Settings.

Hiding an organizer. Venues and promoters can be hidden from your map instead of blocked. It’s one-directional and about taste rather than safety: their events leave your map and search, but anything you already said yes to stays, and the person who runs the venue keeps their separate personal profile. You can see and undo both lists in Settings.

If you report a person or an event, we store the report — what was reported, why, and when — so we can review it and act. Reports are reviewed within 24 hours. We keep records of reports and enforcement actions for as long as needed to keep Marco safe, including after the reported account is deleted.

Phone numbers

Verifying a phone number is optional. If you do, we store the number and a salted hash of it. The hash lets friends who already have your number in their contacts find you on Marco — and only if your “findable by phone” setting allows it. Verification codes are delivered by text message. You can turn off findability at any time in the app’s privacy settings. To remove your number from your account, contact us at info@letsmarco.com; deleting your account also removes it.

Notifications

You choose what Marco is allowed to interrupt you for, and those choices are sent to our servers, because that is the only place they can actually be enforced — a notification that has already arrived cannot be recalled by your phone. The categories are: reminders before your plans, changes to plans you answered, invitations, answers to plans you host, friends, the morning summary, and things happening nearby. “Nearby” is off unless you turn it on.

The rule behind the defaults: notifications follow commitment. The more you have actually said yes to something, the more Marco tells you about it. A plan you never answered gets you one invitation and then silence.

Marco also keeps an inbox in the app of what happened while you weren’t looking — new friend requests, answers, people joining your plans. It is stored only on your device, separately for each of your profiles, and each entry is deleted after 30 days.

If you enable notifications, we send you reminders for plans you are going to, an optional morning summary of your day, and alerts when something about a plan changes — for example if a host moves the venue. Venue-change alerts are deliberately delayed and combined, so a host who adjusts a location several times produces one message rather than several. You can turn any of these off in Settings, and turning notifications off removes your push token.

The Android app does not receive push notifications from our servers. While you allow it to show notifications, it asks our servers for news about every 15 minutes, using your existing sign-in, compares the answer with its inbox on your device, and shows anything new as a notification. No third party is involved, and the same choices in Settings apply.

Third-party services

• Apple Inc. — Sign in with Apple, if you choose it; push notifications in the iPhone app; and Apple Maps, in the iPhone app and in the maps the website shows to signed-in users (map code and imagery are loaded from Apple, which involves your IP address, like any map app)
• Google LLC — Sign in with Google, if you choose it; in the Android app, the map, provided by the Google Maps SDK for Android: map code and imagery are loaded from Google, which involves your IP address, and the SDK sends Google technical information — such as the device model and operating system version, crash reports from the map’s own code, how the map is moved and zoomed, and a pseudonymous identifier — which Google uses to maintain and improve its services under its own privacy policy; and, in the Android app, the QR code scanner provided by Google Play services. The scanner processes the camera image on your device, and Google does not store the image or the scanned result. When the scanner is used, Google Play services collects technical information about your device and about the scanner’s use — such as the device model, the operating system version, the version of the Marco app, and performance data — which Google uses for diagnostics and usage analytics under its own privacy policy. Marco receives only the scanned code
• Unsplash — stock event artwork, and some pictures on the website, are loaded from Unsplash’s servers, which involves standard web request data
• Service providers that run parts of Marco for us — such as hosting, website delivery and security, sending text messages, and the tools our team uses to receive applications, reports and messages. They process data only on our behalf and for those purposes.
• Nobody else. No data brokers, no ad networks, no analytics companies — and no third-party crash-reporting service: error reports are stored on our own servers.

Links you open

Marco claims links on letsmarco.com, so a plan or profile link opens in the app if you have it. Opening a link doesn’t tell us anything beyond the standard web request the page itself would see.

This website

letsmarco.com uses no third-party analytics, no advertising and no tracking cookies. Visiting it sets no cookies. When you arrive through one of our own links or posters, we record the visit — which link and page, when, and the technical details your browser sends with any request, such as your IP address and browser type — so that we can see which of our links and posters work. It sets a cookie only when you do something that needs one:

• While you sign in with Apple or Google — on the website, or from the Android app, which signs in through the website — a cookie that holds the sign-in attempt for at most ten minutes, so that the answer from Apple or Google can be matched to the attempt that requested it. It is deleted as soon as that answer arrives.
• If you sign in on the website — a cookie that keeps you signed in, for up to 90 days or until you sign out. It cannot be read by scripts on the page.
• If you choose a light or dark appearance — a cookie that remembers your choice, for up to one year or until you return to following your device’s setting.
• If you turn on “near you” in What’s on — a cookie that remembers that you turned it on, for up to one year or until your browser no longer allows the website to use your location. It holds no location.

These cookies are strictly necessary for the things you ask the website to do, which is why it does not ask for consent to them. None of them is used for advertising, analytics or tracking, and none is shared with anyone. If we ever add a cookie that is not strictly necessary, we will ask for your consent before setting it, and update this policy first.

The website also keeps these records in your browser’s own storage. They stay on your device and are never sent to us or to anyone else:

• If you answer “Not now”, “Ignore” or “Skip” to something in your inbox on the website — a record of which request you set aside, so that it stays out of your inbox in that browser. Neither we nor the person who sent the request are told. A “Not now” on a Marco is kept until the end of that day; the others are kept until you clear the website’s data in your browser.
• If you decline to keep the people on a plan as a group — a record that you declined, so that the website does not ask again about the same people. It is kept until you clear the website’s data in your browser.
• If you send a plan to friends on the website — a count of which friends you send plans to together, so that the same people are suggested first next time. It is kept until you clear the website’s data in your browser.

Like the cookies above, these records exist only because you did something that needs them, and they are used for nothing else.

Standard short-lived request logs are kept for security.

Pages we list

Some organiser pages on Marco were created by us rather than by the organiser.

A page like this carries the label Listed by Marco in the app and on the website, and is never given the verification mark. There is no account behind it: nobody has registered, nobody has agreed to any terms, and we neither represent the organisation nor claim any connection to it.

It shows the organisation’s name, its city, links it publishes, a picture where one is published, and the dates and times of events it has publicly announced. We add no contact details — no email address, no telephone number.

An organisation can claim its page and run it itself, or ask for it to be removed. Either request goes to info@letsmarco.com and needs no Marco account. We act on removal requests without undue delay; a removed page goes from the app and the website at once, and from backups within 30 days.

Aggregate insights for organizers

Verified organizers can see how their events perform — always as aggregate, de-identified statistics (for example: total RSVPs over time, or how many attendees of one event went on to another). Organizers and venues receive counts and trends, never individuals, with one exception: the information about the people in an organizer’s own groups and lists described in Groups and lists, which is limited to that organizer’s own events. Your identity is never part of what an organizer buys or sees beyond what an event’s own visibility already shows (such as an RSVP list you chose to join, or your name if you gave it to a host who checks names at the door). If we ever introduce optional profile fields (such as age) to make these aggregates more useful, they will be optional, used only in de-identified aggregate form, and this policy will be updated first.

Planned features

We list these in advance so nothing arrives as a surprise. Each will be described here in specifics before it goes live.

• Payments and tickets. Marco does not process payments today. When ticketing launches, payments will be handled by a certified payment provider — we will never see or store card numbers — and transaction records will be retained as Estonian accounting law requires.
• Verified identity. We may offer optional identity verification through a specialist provider, so that hosts can run events for verified guests only. It would be optional, the provider would handle any identity document, and we would store the result of a check rather than the document itself.
• Limits on public plans. To keep the map worth looking at, we may limit how far a public plan reaches based on how established an account is, and how many public plans one account can post. This would never restrict plans shared with friends or by invitation, and it will be described here before it takes effect.
• Live location sharing. Your live GPS position is not collected today. If we ever offer optional live-location sharing between friends, it will be strictly opt-in per feature, and announced here before it exists.

Legal basis for processing

• Performance of a contract — running your account and delivering the service you asked for, including friend groups and member groups you create or join
• Consent — optional things you switch on: notifications, contact matching, phone verification, calendar sync, your real name
• Legitimate interests — keeping Marco secure, preventing abuse, reviewing reports, fixing bugs from the error reports described above, and listing organisers and their publicly announced events as described in Pages we list
• Legitimate interests — understanding how Marco and our website are used, including which of our links and posters bring people to Marco, so that we can improve them; and receiving and responding promptly to organizer applications, reports and messages
• Legitimate interests — enabling organizers to keep private lists of their own followers and guests in order to invite them again. You may object at any time by switching off Invitations from organizers
• Legal obligation — where law requires us to retain or disclose something

Your rights under GDPR

If you are in the EU, you have the rights below — whether or not you have a Marco account.

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate information
• Erasure — delete your account and associated data (“right to be forgotten”)
• Portability — export your data in a machine-readable format
• Object and restrict — limit specific processing
• Withdraw consent — for any processing based on consent
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

To exercise any of these rights, email info@letsmarco.com. We respond within 30 days.

Data retention

• Account, profile, and social data — kept while your account is active. Deleting your account removes it from active systems immediately; residual copies are permanently purged within 90 days
• Events — an event you hosted is removed when you delete it or your account; your RSVPs and invitations are removed with your account
• Check-ins — stop showing on the map when the plan ends, and are deleted with the event
• Groups — a group is deleted when its creator deletes it or deletes their account. Your membership ends when you leave, are removed, unfollow the organizer, unfriend the creator of a friend group, block or are blocked by its creator, or delete your account. A record that you left or were removed from a group is kept until that group or your account is deleted. The record of each download of a member group’s members is kept until that group is deleted
• Notices that you were removed from a plan — kept for 30 days, or until the plan has ended if that is later, and then deleted
• Reports and enforcement records — kept as long as needed for safety, including after an account is deleted
• Records of the days you use Marco — kept while your account is active, and deleted with it
• Records of visits through our links and posters — kept for as long as they help us compare our links and posters
• Server logs — kept briefly for security and operations, then deleted
• Error reports from the iPhone app — deleted after 30 days
• Push tokens — removed when you disable notifications or delete the app

Where your data lives

Your data is stored and processed inside the European Union. Where a service provider described above processes data outside the EU, the transfer relies on the safeguards that provider offers, such as Standard Contractual Clauses or the EU–US Data Privacy Framework, where available.

Security

• All traffic between the app and our servers is encrypted (HTTPS/TLS)
• Sessions use short-lived signed tokens. On iPhone they are stored in your device’s Keychain; on Android, in storage private to the Marco app, which is excluded from device backups; on the website, in a cookie that scripts on the page cannot read
• Phone numbers used for friend matching are additionally stored as salted hashes
• Access to production data is limited to the two people who build Marco

Children

Marco is not directed at children. You must be at least 16 to create an account. Where local law sets a higher age for consenting to data processing, that higher age applies. If you believe someone under 16 is using Marco, contact us and we will delete the account and its data.

Changes to this policy

If this policy materially changes, we will notify users in the app and update the date at the top.

Data controller

LongShot Digital OÜ Registry code: 17437669 Tallinn, Estonia

Email: info@letsmarco.com

← Back to Marco