The People You Know — September 2026. Plain sentences, because you'd want a friend to be able to read this.
ROUGHLY · HERE📍 The map is city-level only. No addresses. Ever.
🤝 Only friends you've accepted can see your pin.
📸 A photo you upload lives for at most one hour, then it's deleted.
🍪 One cookie, to keep you signed in. No trackers, no analytics, no ads.
🗑️ Delete your account and everything goes — art included.
the rough where, by construction
Your pin is a city you pick from our list — a public gazetteer of the world's cities. The dot friends see is that city's center point, and even that is rounded before it ever reaches our database. We never ask for your location, there is no GPS anywhere in the product, and our pin-setting API literally has no field for an address.
If your rough place isn't a city ("the campsite", "somewhere in the desert"), you can name a custom pin. Wherever you tap, we snap it to a coarse grid — about 25 km between grid points — before saving. The blur is baked into the data itself, so a precise spot can't leak later: we never had it.
Pins can carry a short label ("until the 14th", "new home!"). Labels are free text, hard-capped at 40 characters, and shown only to the friends who can see the pin — so if you type your own street address into one, that's your call, but nothing public will ever show it.
an allow-list, not an audience
where you've roughly been
When your pin moves, we keep the hop it left behind — the old rough place and when you were there — so friends can see a faded trail of your wandering. The same rules apply: trail places are the same city-level or 25-km-grid places as pins, nothing finer, and only friends who can see your pin can see your trail.
You control the window with one setting (trail days): show the last 30, 90, or 180 days of hops — or 0, which shows no trail to anyone. The choice is yours, enforced on our side, and a trail never shows more than the ten most recent hops regardless.
the one genuinely sensitive thing here, treated like it
The avatar machine turns a photo of you into hand-drawn-style art. A face photo is the most personal thing this site ever touches, so here is exactly what happens to it:
1. You attest it's you. The upload requires ticking "this is a photo of me." We only want your face from you.
2. An AI reads it once. The photo is stored in a private bucket and shown to an AI vision service — currently xAI's Grok — which writes a few kind, cartoonable words about you (your character bible, below).
3. It lives at most one hour. The photo is kept for a one-hour working window so renders can be drawn from your actual face, and then it's deleted. If anything goes wrong along the way — a rejection, a garbled reply, a hiccup — it's deleted immediately, in the same request. No source photo outlives its hour.
The one exception: if you explicitly choose "use photo as-is", that copy becomes your avatar and is kept — visible to your friends like any avatar — until you delete it or your account. The button says so before you press it.
The character bible. What survives the photo is a short written description of how to draw you — "round glasses, big grin, salt-and-pepper beard." It's derived from your face, which makes it biometric-adjacent, so we treat it as sensitive: you can read it, rewrite it (the flattering dial is yours), have a copy exported to you on request, and it is erased completely when your account is.
The artists are third parties, named here. Renders drawn from your actual photo — or from a cartoon likeness you've approved — are generated by OpenAI (their gpt-image-1 model): the image goes to them for that render. Renders drawn from words alone are generated by xAI: only the bible's words go to them, never a photo. And the initial vision pass, as above, is xAI's Grok reading your photo once. These requests carry the image and/or the words — never your name, email, pin, or anything else about your account.
The approved likeness. You can bless one render as "that's me." Future styles are then redrawn from that cartoon, so new art keeps looking like you without us keeping any photo at all. You can clear or delete it any time.
The art itself lives at random, unguessable URLs — it can't be browsed or enumerated by account. Delete a render and the file is deleted with it, for good.
Your profile is deliberately thin: a handle, a display name, a short bio, and links out to the places you actually talk (Signal, Instagram, a website). Links and bio default to friends-only. We don't want your messages or your feed — the product answers "where is Dana, roughly, and how do I reach her" and gets out of the way.
the shortest section, on purpose
We set exactly one cookie: a signed sign-in cookie so you stay signed in (for up to 45 days). It identifies your account to us and nothing else, and JavaScript can't read it. There are no third-party analytics, no tracking pixels, no ad-tech — none. Your browser also remembers which visual theme you picked, but that stays on your device and is never sent to us.
Your email address is used for two things: signing in and resetting your password. Those messages are delivered by Resend, our email provider. No newsletter, no marketing, no "we miss you" — and your address is never shared with or sold to anyone.
erasure means erasure
Delete your account and it all goes in one sweep: your profile, pin, trail history, friendships, blocks, character bible, and every piece of art in storage — including a kept "photo as-is" avatar — with cached copies invalidated. Nothing is "deactivated" or kept around in case you come back. If you'd like your character bible exported first, ask and you'll have it.
This is alpha software and this page will grow with it. When it changes, the date at the top changes and the sentences stay this plain. Questions, worries, export requests: write to hello@the-people-you-know.com.