Skip to content
Small World
Menu

Small World privacy policy

Effective from 13 August 2026. Small World is a friend location-sharing app — bubbles, not pins. This policy explains, in plain language, what personal data we collect, why, how long we keep it, and the rights you have over it.

Who we are

Small World is operated by FIKIR LIMITED, a company registered in England and Wales (Companies House no. 16810967). FIKIR LIMITED is the "controller" of your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018).

For anything about your data, contact us at devs@fikir.uk.

What we collect and why

Profile and account information

Your name, email address, optional phone number and profile photo. We use these to provide Small World's account and social features — including creating and running your account, letting you sign in, and showing you to your friends. Legal basis: performance of our contract with you.

Location

Small World collects your device's precise location, including in the background while the app is closed, to provide Small World's location and social features — including showing friends roughly where you are, telling you when you cross paths, and helping you arrange to meet. Sharing your location is necessary to use Small World: without it, friends cannot see you and crossed-paths detection will not work. Your location is shared with your friends via our server — but it is obfuscated before display: friends see a bubble covering a much wider area than you occupy, never your exact position, and never a bubble drawn around the position you reported. We build that bubble from the accuracy your device reports, so when that reading is poor the bubble can sit a little off until a better reading arrives — it is designed to be vague, not to be a guarantee. A bubble holds its position until you move far enough for us to redraw it, and that holding is why a bubble that has not moved shows a friend that you have not gone far, and why two people in the same place get almost the same bubble. Your exact location is only ever shown when you yourself start a precise share, which is time-limited and stops automatically. You can turn location sharing off at any time in the app. Legal basis: performance of our contract with you (location sharing is the core of the service); precise shares happen only when you initiate them.

Messages, photos and stories you share

What you send and post in Small World — including chat messages, reactions, photos you send in a chat, place suggestions, and stories (a photo and caption you share with your friends, which stops being visible automatically). When you post a story you choose who can see it: all your friends, or the groups you pick, and we record which of them have viewed it so we can show you who has seen it. We collect this content so we can deliver and display it to the people you send it to. Legal basis: performance of our contract with you.

Your friends and how you use Small World

Your friend list (who you are connected to on Small World), how you group your friends, and per-friend crossed-paths counters. Legal basis: performance of our contract with you.

Your contacts

If you turn on Find friends from my contacts in Settings, we collect scrambled identifiers — cryptographic hashes — of the phone numbers in your contacts, and only after you agree and grant access. We never collect contact names, or the numbers themselves. We use these hashes to show you which of your contacts are already using Small World, and to tell you when one of them joins. A hash obscures a phone number, but it is not irreversible for someone who already holds a large list of numbers to hash and compare against it, so we treat these hashes as personal data, not as anonymous ones. The same setting also makes you discoverable to people who have your number saved as a contact and have turned it on themselves — it is off by default, so you are not discoverable this way until you turn it on. You can turn Find friends from my contacts off at any time in Settings, which deletes the hashes we derived from your contacts and stops you being discoverable this way — deleting your account deletes everything described here. If you appear in someone else's contacts, we hold only a hash of your phone number, submitted by them, and we use it solely to show that person a match once you join Small World and are yourself discoverable by phone number. Legal basis: your consent (for uploading your own contacts and for making yourself discoverable); our legitimate interest in helping people find friends already using Small World (for matching against a hash someone else uploaded, where you are not yet a user or have not made yourself discoverable).

Device and technical information

A Firebase Cloud Messaging (FCM) token for each device you sign in on, together with an identifier for that device, so we can deliver message and proximity notifications to the right place and replace a device's token when it changes. We keep these until you sign out on that device, the token changes, or you delete your account (legal basis: performance of our contract with you). The same device identifier also accompanies your location uploads and appears in our operational logs, so we can diagnose delivery problems (legal basis: our legitimate interest in keeping the service reliable). Your IP address, used transiently for rate limiting and never written to storage or logs (legal basis: our legitimate interest in keeping the service secure). We also use Google's Play Integrity service to check that requests come from a genuine, unmodified copy of the app (legal basis: our legitimate interest in keeping the service secure).

Analytics and crash reporting (optional)

Google Analytics for Firebase and Firebase Crashlytics help us understand how the app is used and fix crashes. These only run if you agree when the app asks for your consent, and you can change your choice at any time in Settings. Legal basis: your consent.

Running, protecting and improving Small World

We also use the data described above to operate the service itself — including diagnosing faults, keeping Small World secure, preventing abuse and misuse, investigating reports and enforcing our terms, and understanding in aggregate how Small World is used so we can improve existing features and develop new ones. Where aggregated or anonymised data will answer the question, we use that instead of data that identifies you. We never analyse your location, or the content of your messages, photos or stories, for these purposes — investigating a report is limited to what was reported and the accounts involved. Legal basis: our legitimate interests in providing, securing and improving a service people can rely on. You can object to this processing at any time — see Your rights below.

We do not make automated decisions about you that have legal or similarly significant effects, and we do not profile you.

How long we keep your data

Where we give a period below, deletion is triggered automatically once that period is reached. It can take up to a further 48 hours for the data to be fully removed from our systems.

  • Location: kept for up to 30 days, and deleted when you turn location sharing off.
  • Messages and chat photos: deleted around 6 months after sending. The most recent message in each conversation stays visible in your conversation list until it is replaced by a newer one or the conversation or account is deleted.
  • Stories: stop being visible when they expire — every story is given a fixed lifetime when you post it — and the photo is removed from our storage within 2 days of being uploaded.
  • Crossed-paths (proximity) sessions: the session itself is kept up to 24 hours after it ends. Each time you cross paths, one snapshot is saved into your chat with that friend — the two approximate areas you were each in at the moment you first overlapped. It appears only in that chat, and is deleted along with those messages.
  • Precise-share grants: expire automatically at the end of the sharing period you started, and are deleted immediately if you end it sooner.
  • Contact hashes: kept until the contact is removed from the uploader's address book (which we pick up at the next sync), until Find friends from my contacts is turned off, or until account deletion — whichever happens first.
  • Operational and delivery telemetry: up to 90 days.
  • Server logs: kept for up to 30 days.
  • Reports you make or that are made about you: kept up to 13 months. This is not erased by account deletion, in either direction — a report survives even if the account that filed it, or the account it names, is later deleted — so we can act on a pattern of reports and, where needed, establish, exercise or defend a legal claim. A surviving report keeps the category and details you gave us, a snapshot of the reported content, the reported person's name as it was when reported, and both accounts' identifiers; it never keeps an email address or phone number.
  • Accounts you have blocked: kept until you unblock them or delete your account.
  • Everything else (your profile, avatar, friendships, settings): kept until you delete your account. Deleting your account immediately erases your account data from our live systems, including your sign-in identity and avatar photo — with one exception: reports (see above), which are kept even though the account they involve has been deleted. Two things outlive it briefly and then expire on their own: operational log entries, within 30 days, and any analytics or crash reports you consented to, within 90 days. Copies may also persist for a limited period in encrypted backups and in our service providers' systems before they are overwritten; we do not use those copies for any purpose other than restoring the service after a failure.

Who we share your data with

We use a small number of service providers ("processors") to run Small World. They process your data only on our instructions:

  • Cloud hosting and infrastructure providers — our databases and servers. Your data is stored in the United Kingdom.
  • Google / Firebase — sign-in (Firebase Authentication), push notification delivery (FCM), notification delivery telemetry, and the Play Integrity check. Firebase Authentication and Cloud Messaging are global Google services, so your sign-in identity and push tokens may be processed outside the UK. Analytics and Crashlytics run only if you agree when the app asks; when enabled, that data is transferred to the US. All of these transfers rely on Google's standard contractual clauses with the UK Addendum.
  • Google Maps — the map you see in the app is rendered by the Google Maps SDK.
  • Google Places — when suggesting places to meet, we send Google an approximate location between you and your friend, never either of your exact locations.
  • Observability providers — server logs and metrics for keeping the service healthy.
  • Email delivery providers — deliver email when you contact devs@fikir.uk (processed in the US under the UK International Data Transfer Addendum).

Where a provider processes your data outside the UK, we rely on the safeguards named above. You can ask us for a copy of them by emailing devs@fikir.uk.

Apart from these providers, your data goes only to the people you direct it to: your friends, and — if you are discoverable by phone number — someone who already has your number saved as a contact and syncs it, as described in Your contacts above. The one exception is that we may disclose personal data to public authorities where we are required by law to do so — for example under a court order, or a valid request from the police. We will not hand over your data voluntarily, and where we are permitted to tell you about such a request, we will.

Your rights

Under UK data protection law you have the right to:

  • Access your personal data.
  • Rectify anything inaccurate.
  • Erase your data — delete your account in the app, or from our website at fikir.uk/small-world/delete-account. The website route is there whenever the in-app one is not open to you — for example if you have uninstalled Small World, or if we have asked you to accept updated terms and you would rather not.
  • Restrict how we process your data.
  • Port your data — email us and we will provide a copy in a common format.
  • Object to processing based on our legitimate interests.
  • Withdraw your consent to analytics and crash reporting at any time, in Settings. Withdrawing does not affect anything we did lawfully before you withdrew.

To exercise any of these rights, email devs@fikir.uk.

Complaints

If you are unhappy with how we handle your personal data, email us at devs@fikir.uk with "Data protection complaint" in the subject line. We will acknowledge your complaint within 30 days and respond substantively as soon as we can, keeping you informed of progress. You also have the right to complain to the UK Information Commissioner's Office (ICO) at any time — you do not need to complain to us first: ico.org.uk/make-a-complaint, or telephone 0303 123 1113.

Age

Small World is for adults. You must be 18 or over to use it — that is a condition of our terms of service, which is where the rule lives and what you agree to when you create an account.

Where Small World is available

Small World is available in the United Kingdom only at launch.

Changes to this policy

If we make material changes to this policy, we will take reasonable steps to tell you before they take effect — in the app, or by email. The effective date is shown at the top of this page.

FIKIR LIMITED · Companies House no. 16810967 · devs@fikir.uk · Delete your account