The googlymaps manual

Everything the app does, in one place. If you only want the short version, read how it works instead. This is the full reference.

This manual is kept current. If something here doesn't match the app, that's a bug worth reporting to [email protected].

Anything described here that is decided but not yet built is marked (not built yet) where it appears, and listed again in What isn't built yet at the end. We'd rather say "designed, coming" than let you assume something is protecting you today when it isn't. That list used to be long, and on 25 August 2026 it was empty. On 26 August 2026 it gained two items again, both about buying the ad-free upgrade on a phone, because that went on sale on the web before Apple and Google could carry it. On 1 September 2026 one of the two came off it: paying on the web now switches the ads off by itself, with nobody doing it by hand.

What googlymaps is

A world map of googly eyes.

People stick googly eyes on things (postboxes, parking meters, bins, statues, the family dog) and other people find them. This is the map of where they are. You photograph one, the app records exactly where you're standing, and once it's checked, a pin appears for everyone.

That's the whole app. A photo and a place.

A pin has a short comment and nothing else. No title, no name, no link, no contact details. The comment is optional, at most 200 characters, and it is read: a filter refuses the obvious as you type it, and every one that gets through is judged afterwards. Three takedowns and the comment box closes for good, though the account and the pins are untouched. See Saying something about your pin.

Until 2 September 2026 there was nowhere to type anything at all, and this manual said so. That changed because people kept asking for it; what has not changed is the reason the box was refused for so long, which is that every word somebody writes is a word nobody has checked sitting on a public map. The answer is not to trust the filter. It is that a person and a model read all of them.

Getting started

Where to get it

In a browser, at googlymaps.net, with nothing to install. That is the whole app, not a preview of it: the map, the camera, your pins and your points all work there, on a phone as well as on a computer.

On Android, install it from Google Play, where it is listed as "Googly Eyes Map". That is the better route, because updates arrive through the store. There is also a direct download at googlymaps.net/download; that page says plainly which build it is and whether it is behind the store.

If you do install a downloaded copy, Android will warn you that it did not come from the Play Store. That warning is correct and you should take it seriously with any app: the download page publishes the file's SHA-256 fingerprint so you can check that what you got is what we published.

Links, once the app is installed

On Android, a link to googlymaps.net opens the map in the app rather than in a browser, with no "open with" question, because Android has checked with the site that the app is genuinely ours.

Only the map link does that. A link to this manual, to the privacy policy or to any of the guides opens as a normal web page, which is what you wanted if somebody sent you one. There would be no sense in a link to a page about the app opening the app instead of the page.

If you would rather links never open the app, Android lets you turn it off: Settings > Apps > googlymaps > Open by default.

Updating the app

The website always has the newest version the moment it is published. The Android app is a copy that goes through the Play Store, so it is usually a little behind, and Play's own background updates can take days or be switched off. So the app checks for itself: each time you open it, it asks whether the store has a newer build than the one you are running. If it does, it says so straight away: a panel with Update now. Tap it and Google Play updates the app right there, in under a minute, and brings you back. Later puts it away for a day and leaves a small Update button in the top bar for when you want it. Both go away on their own once you are current. To see exactly which build you have, open About: the last line shows the version, the build number and the code it was made from.

Signing in

Browsing the map needs no account at all. Posting does.

You can sign in with Google, Apple, or your email address. There is no password to choose: the email option sends you a link that signs you straight in, so there's nothing to forget and nothing to steal. Whichever you choose, we get almost nothing: an account identifier and, for email sign-ups, your email address. We don't ask for your name, and we don't store a profile picture even if your provider offers one.

Using more than one sign-in button

They usually land on the same account. If your Google and Apple accounts use the same email address, signing in with either one gets you the same pins, the same points, the same everything. You don't have to do anything for that to happen.

Sometimes they can't, and it's worth knowing when, because we can't fix it afterwards. We match you up by email address. If your Apple ID and your Google account use different addresses, there's nothing linking them, and the second one you use starts a new, separate account. The commonest way to hit this is Apple's "Hide My Email" option: take it, and Apple gives us a random @privaterelay.appleid.com address instead of yours, which matches nothing.

So if you want more than one way in, add it deliberately: sign in, open Account → Ways to sign in, and press Add. That attaches it to the account you're already using, whatever address it reports. It takes a few seconds and it's the difference between one account and two.

If you've already ended up with two, email [email protected]. We'd rather sort it out by hand than pretend it can't happen.

Your account carries a name, purely so our own records make sense. It is never published: not on a pin, not on the chart, not anywhere another user can see it.

Where that name comes from is worth being exact about, because the obvious answer is the wrong one. Google and Apple do hand us the name on your account, usually your real one. We throw it away and generate one instead: googly_ and a few characters. Nothing in this app ever asked for your real name, and picking it up as a side effect of which sign-in button you tapped would be collecting it by accident, which is the kind of thing that is easy to do and hard to undo. If you signed up on our own form and typed a name in, that's the name you have. Either way you can change it in your account, and nothing anyone else sees depends on it.

Your age

You need to be 16 or older to post. You can browse at any age.

We ask for your date of birth the first time you try to post, not when you sign up. We check it, record the moment you were confirmed old enough, and then discard the date. We never write your birthday to the database and we don't keep it. There is no column for it to go in: the check runs on the value you typed and the value is gone by the time the answer is stored.

Why the check happens at posting rather than at signup: Apple and Google don't tell us your date of birth when you sign in with them, so refusing to create the account would simply have broken those buttons. The account can exist; it can't post until the age check passes.

The 16 is enforced in the database itself, not in the app on your phone, so there's no version of the app that can be talked out of it. There is no parental-consent route.

We ask once, and the answer sticks to that account. If the date you give is under 16, we record that it happened and the account can't post from then on. You don't get a second go with a different date. That's the only thing that makes asking worth anything: a question you can answer again until you get the answer you want isn't a check, it's a formality.

What we record is simply that it happened, and when. Not the date you typed, and not anything the date could be worked back out from.

We know an honest person can mistype a year, and that somebody who was 15 will eventually be 16. Both cases are a real email to [email protected] and a human sorting it out, rather than an automatic second chance that would defeat the point.

And to be straight with you: none of this proves anything. Somebody determined to lie about their age can. The check is here so that we asked, so that the answer is recorded, and so that we aren't knowingly running a service for children. Actually verifying age would mean asking you for ID or a card, which would mean collecting exactly the personal information the rest of this manual explains we go out of our way not to hold.

Accepting the rules

Browsing needs nothing from you: no account, and nothing to agree to. You can look at the whole map, every pin on it, without ever seeing a terms screen.

Posting a pin, or reporting one, does. Before your first pin, and before your first report of somebody else's, we ask you to accept the current Terms of Use and the current privacy policy. It's one tap, and it sticks, unless something changes (below). This applies even if you're reporting without an account: reporting has never needed one, but it does need this.

Both documents now carry a version number and an effective date at the top, and that isn't decoration: it's exactly what you're agreeing to, and exactly what gets recorded against you.

When something in either document changes enough to matter, you're asked again. We call that a material change: a new version is published, and you can't post or report under it until you've accepted it. A typo fix, a clarified sentence, anything that doesn't actually change what you're agreeing to, doesn't trigger this, on purpose. Asking you to re-agree over a typo would teach you to stop reading the screen, which is worse than the typo.

What's recorded is small and exact: which document, which version, and when. Nothing else rides along with it. It's kept as evidence that you agreed, not deleted on a schedule the way most things in this app are (see your data).

If you delete your account, the record of your acceptance stays, but the link to you doesn't. What's left afterwards is a document, a version number and a timestamp: no name, no account, nothing that leads back to you. It's one of a short list of things a deletion request doesn't erase; see your data for the others.

If you accepted while reporting anonymously, there was never a link to remove. You're asked to accept the same two documents at the report form even with no account behind you, and because there's no account to tie the record to, it's anonymous from the moment it's made.

Posting a googly eye

1. Take the photo

The app opens the camera. In the Android app that's your phone's own camera, with everything it normally does: zoom, tap to focus, flash, night mode. Take the shot and confirm it, and you're back in the app. On the website the camera opens inside the page instead, because a browser can't hand you the phone's camera app. Either way, it only takes a new photo: there's no way to pick one from your gallery.

Get close enough that the eyes are clearly visible, with enough of the object in frame that people can tell what they're stuck to. Daylight helps. That's it.

You take the photo there and then. You can't upload one you already had, and that's deliberate rather than us being awkward.

Before anything is sent, your phone turns the photo the right way up, strips the hidden data your camera wrote into it, and resizes it. This happens on your device: the camera file your phone actually produced never leaves it. If your phone can't open a photo to do this, the photo is refused rather than sent as it is: you'll be asked to take the shot again, and nothing is uploaded.

The place on a pin comes from your phone at the moment you post, not from the photo. Phones and browsers strip location out of saved pictures anyway, so if you uploaded a photo from a trip last week while sitting at home, we'd have no honest way to know where it was taken, and the pin would land on your house. A pin in the wrong place is worse than no pin at all, because the whole point is that somebody else can go and look.

What counts: real, physical googly eyes, the plastic kind with a pupil that rattles, attached to something. On a bin, a tree, a car, a shop sign, a rock, your dog. Animals and pets are fine.

It never matters what they are stuck to. A poster, an advert, a billboard, a street sign, a magazine page, a cereal box: all fine. Googly eyes on the face of somebody in a poster is one of the oldest and best things you can do with them, and it counts. The only question is whether the eyes are real. If you could get a fingernail under one and peel it off, it counts.

What doesn't:

• Eyes drawn on, printed as part of the picture, added with a filter, or edited in afterwards. They have to be real and actually there. A poster that came out of the printer with googly eyes already on it is a picture of googly eyes; the same poster with two plastic ones stuck on top of it is the real thing.
• Anything explicit, sexual, gory, or vulgar. One exception, decided on 12 September 2026: if the nipples and genitals of a figure on a poster, print or statue are covered, by the googly eyes themselves, by hearts or stickers, or by anything else opaque, and nothing explicit is left showing, the figure counts as covered and the photo is allowed. A real person is never covered by this: see the next point.
• Photos where a person is the subject, or where a recognisable face is the point of the picture.
• Anything that pinpoints where somebody lives.

2. Location

A pin needs a precise location, and there's no way around it. The app reads your device's GPS at the moment you photograph. GPS is the only way a pin gets a location. You can't tap the map, drag a pin, or type in coordinates. A googly eye is at one specific spot, and half the point is that someone else can go and find it. The manual-placement route isn't hidden, it's gone: the database accepts exactly one kind of location, a device fix, and refuses everything else.

How precise is precise enough? We accept a fix accurate to 50 metres or better. That's the floor, not the target: while you're framing the shot the app keeps asking for a better fix and keeps the best one it gets, and it only settles for 50m if the phone genuinely can't do better. Anything worse than 50m is refused.

Every pin shows how accurate it is. We store the accuracy your phone reported and we show it: a circle around the pin on the map, and a line on the pin's detail page reading something like "accurate to about 40m". A 6-metre pin and a 48-metre pin look different, because they are different, and someone walking out to find the eyes deserves to know which one they're chasing.

The published number is rounded up to the nearest 5 metres, so it's one of ten values between 5 and 50 rather than whatever your phone said to two decimal places. Partly because nobody needs "accurate to 37.42 metres". Mostly because an exact per-device accuracy figure, sitting next to an exact coordinate and a timestamp, is a faint fingerprint of your handset, and ten shared values are not. You still see the precise figure on your own pins.

If the fix isn't good enough yet, you'll see "getting a precise location…" while it settles. GPS usually sharpens within a few seconds. If it can't get there, stepping outside or away from tall buildings almost always fixes it.

While the fix sharpens you can type an optional comment for the pin. If the fix never gets good enough and you choose Try again, the comment you typed comes with you rather than being thrown away.

If location is switched off entirely, the app will tell you exactly where to turn it on for your device. One thing that catches people out on iPhone: you can grant location access while Precise Location stays off, which gives a deliberately fuzzy position that will never be good enough. The app will say so if that's what's happening.

3. What happens next

If the upload itself fails (a dropped connection is the usual cause), nothing is kept: the pin is withdrawn and you simply try again. A pin never sits in your list waiting for a photo that did not arrive.

If posting takes unusually long, which usually means a poor connection, the screen says so and offers to let you put the phone away. The upload carries on in the background and you are told when it has finished, so there is never a "Posting" screen you cannot leave.

Your photo is checked automatically for two things: that it really shows googly eyes, and that it contains nothing explicit.

Most photos clear in seconds and the pin goes live immediately. Occasionally one is borderline and is held for a person to look at. That's normal and usually quick. When a person does say yes, the pin appears a minute or so later rather than instantly: your photo has to be copied into the public half of the app first, where it's stripped and resized again, independently, on our own servers, rather than us simply trusting that your phone did it correctly. Nothing is wrong if you refresh and don't see it for a moment.

When it goes live, we email you. One message, to the address on your account, with the photo you took in it and nothing else: no other pins, no chart, nothing about anybody else. It is the only email googlymaps sends you that you did not ask for by writing to us first, and it only ever arrives about your own pin. If you would rather not have it, reply and say so and we will switch it off for your account.

Borderline is never auto-rejected. Googly eyes on the backside of a classical statue is the obvious case: public art, centuries old, nobody's idea of explicit, and exactly the sort of thing an automatic checker gets wrong. Anything in that grey zone goes to a human instead of being turned down by a machine.

If it's rejected, you'll be told why, and you can appeal. A human reads appeals. You get three goes at it on the same pin, not one, and then the decision stands.

How many you can post

Up to 10 pins in any rolling 24 hours, per account. Not a calendar day: it's always whatever happened in the 24 hours right before your next attempt, so there's no trick where you post 10 right before midnight and 10 more right after. Every submission counts, whatever became of it afterwards: one that got rejected still counts, and so does one you later deleted yourself. Deleting a pin frees up nothing.

You'll always be able to see how many you've got left, and exactly when your next slot opens up.

Why the limit exists, plainly: every photo you submit, accepted or not, is checked twice: once by an AI classifier that costs real money every time it runs, and again by a human moderator whenever the automatic check can't be sure. Both of those cost something, per photo, whatever the outcome turns out to be. Ten a day, per account, is plenty for anyone genuinely out finding googly eyes, and it stops one account from being able to run either check into the ground.

Saying something about your pin

You can add a short comment, up to 200 characters, while the app is finding your location. It is optional. It appears under your photo for anyone who taps the pin, and you can change or delete it afterwards from your own pin.

Do not write where you live or work. This is the one place in googlymaps where you can undo your own anonymity. A pin is anonymous and a photograph of a postbox tells nobody anything, but "outside my shop" or "my street" tells everybody something. Nothing stops you, and nothing can un-tell it later.

What happens to it

A filter refuses the obvious as you type it. If it does, nothing is held against you: the filter is blunt, being caught by it costs you a rewrite and nothing more.

Then every comment is read, by us and by the same kind of AI that checks the photographs, usually within a minute of posting. It errs towards leaving things alone: rude is not against the rules, unfunny is not against the rules, and a comment nobody is sure about stays up.

What does come down: abuse aimed at a person or a group, sexual content, threats, an address or a phone number or somebody's full name, advertising, and anything pretending to be us.

Three strikes

When a comment comes down, that is one strike, and we email you every single time. The email quotes the comment back, says exactly why, and tells you which strike it is, so nobody ever loses the comment box by surprise or has to guess what they did.

After the third, the comment box closes for good. Nothing else changes: your account is untouched, every pin you have posted stays exactly where it is, and you can go on adding new pins with photographs forever. It is only the writing that stops. If you think a strike was wrong, reply to the email and a person reads it.

Appeals, warnings, and bans

This is the part most apps are vague about, so here it is straight.

Appealing is safe

An honest appeal is never punished. Not if you win, not if you lose. If you genuinely thought your photo was fine and we disagree, that is the end of it, with no warning, no strike, no mark on your account.

We are explicit about this because the alternative is worse for everyone. If appealing carried any risk at all, honest people would stop appealing, and every mistake the automatic checker made would quietly become a lost user. We'd rather read a hundred appeals that go nowhere than lose one person who was right.

The appeal screen actively invites you to explain yourself, including the awkward part: tell us why this might look borderline. Saying "it's a statue, and yes, it's a bare backside, but it's a 400-year-old one in a public square" is exactly the right thing to write. That's not a confession. That's the appeal working.

What actually gets you in trouble

The penalty is for lying, not for being wrong.

The gap between rows three and four is the whole system. Row three is a person who was wrong. Row four is a person who knew and argued anyway.

A ban is permanent, and it survives deleting your account

If you are banned, you are banned. Not for 30 days, but permanently.

And it has to outlast your account, or it means nothing: delete, re-register, and you'd be back in five minutes. So:

We keep a one-way hash of the sign-in identifier you were banned under, for ever. When anybody signs up, we hash the new identifier the same way and check it against that list. A match doesn't create an account you then can't use: the sign-up is refused outright.

Two details, because they're the ones that decide whether this works at all. Changing your email address while banned doesn't shake it off, it adds the new address to the list. And deleting your account doesn't clear it either, which is the entire point.

Being plain about the trade-off, because it is a real one:

• A one-way hash can't be turned back into your email address. We can't read the list, we can't sell it, and it doesn't tell us who you were.
• To make the lookup work at all, the hashing uses one fixed value across the whole app. That means the same email always produces the same hash, which is precisely what lets us recognise a returning banned user, and also means the list isn't as unreadable as a per-user salt would make it. We chose the version that works. It's a deliberate trade, and pretending otherwise would be worse.
• Nothing else survives. The ban record and the hash are all that's left; your pins, your photos and your account data go.
• This is the one thing a deletion request does not erase, and the privacy policy says so in the same words.

Points and the chart

Every new googly eye you post is worth 10 points.

Emphasis on new. Photographing the same pair of eyes from five angles is one googly eye, not five. The app compares each accepted photo against the ones you have already had accepted, using a perceptual hash, a fingerprint of what the image looks like rather than of the file, so a rotated, re-cropped, or recompressed copy of the same eyes is recognised as the same eyes and scores once. The comparison is against your own accepted photos and nobody else's.

A discarded photo costs you a point. If a photo is rejected, or a pin that had already gone up is later taken down for breaking the rules, that's minus 1. Your score can go negative, and that's deliberate: it costs something to keep pushing photos that don't belong on the map, in a way a score stuck at zero never would. None of this touches a photo while its fate is still open: a pin waiting on its first check, or a rejected photo you're appealing, costs nothing until the decision is final. You're never charged for a decision that hasn't been made yet, and never charged twice over for the same photo.

A pin retiring costs you nothing at all. If nobody confirms your pin for six months, or two people report that the eyes have gone, it becomes historic (see When the eyes are gone). Your 10 points stay, and so does the country flag it earned. Once a pin has reached the map, it's earned. Eyes coming off a bin isn't something you did, and a score that docked you for it would quietly teach people not to post anywhere busy, which is exactly where the good pins are.

Deleting your own pin is a different thing again, with a different cost. See Deleting your own pin below.

What's public and what isn't

Public: your rank, your points, your country flags (see below), and an account number: a plain number, not a made-up code. The app also calls it your member number, and it's the same number either way. Numbers start at 0 for the very first account ever created and count up in the order accounts joined, so yours is normally just your place in the queue.

A number is a claim about when you arrived, and we treat it as one. Two things follow from that, and they're worth knowing before you try to read somebody else's number.

• You can ask for a particular number. Write to [email protected] and, as long as it isn't already taken or retired, a human moves you to it. So the order isn't a guarantee any more: most people's number is the queue position they were given, but somebody with a high number may well have been here since the first week.
• A number you leave behind is retired, permanently. Move to a different one and the old one is never handed to anybody else, ever, and neither is the number of a deleted account. Reissuing a number would tell some later arrival they were the third person here when they weren't, which is the one thing the number is for.

Because numbers get retired and can be chosen, the highest number on the chart isn't a headcount of anything: not of who's using the app today, and not even of how many accounts have ever existed. That's the honest trade of a plain number instead of an opaque code, and we'd rather say so than pretend the chart tells a stranger nothing about the rest of us. See your data and the privacy policy for the full picture.

The chart is rebuilt on a schedule rather than live, about once a day. Your points land on your account the instant a photo is accepted; the public chart catches up on its next refresh. Nothing is lost in the gap. The delay is also doing a job: a rank that ticked upward the second a new pin appeared on the map would quietly tie that pin to that account number, and a chart that updates once a day can't.

Private: where you've been. Nobody but you can list your pins. Not by account number, not by rank, not by clicking your score, not through any part of the app or the website.

That split is the entire design. Points are a game and games want a scoreboard. Pin lists are a movement history with timestamps, and handing one to a stranger would be handing them the answer to "where does this person spend their evenings". So the score is public, and the trail is not.

Country flags

Every accepted photo also earns you the flag of the country it was taken in, shown next to your account number, including on the public chart. Flags never appear on a pin: like everything else on the chart, they sit next to your account number and nowhere else, so seeing a flag tells nobody which pin it came from.

Flags don't repeat. Your first accepted photo in Australia earns you an Australian flag. Your hundredth accepted photo in Australia earns you nothing new: you already have that one. Post from a different country and you earn a new flag for it, so your set of flags is the story of where your googly eyes have actually been, not a count of how many you've posted.

A flag doesn't retire when the pin does. If the eyes come off and the pin goes historic (see When the eyes are gone), the flag stays with you, exactly like the points. You were there and you photographed them, and that stays true afterwards.

A rejected photo earns no flag. Neither does a duplicate: a second photo of eyes you've already photographed is published normally but scores no points (see above), and it earns no flag either, for the same reason. Posting from somewhere the app can't place, such as well out at sea, simply earns no flag. None of this ever stops the photo publishing: a flag is a bonus on top of a successful pin, never a condition of one.

How we work out the country, and why this doesn't change what we collect: we look at the same coordinate your pin already publishes, and work out the country on our own servers. No outside mapping or geocoding service is called, and no new information about you is gathered to do it: the flag is entirely derived from a location that was already going to be public on the map. The boundary data is Natural Earth, a public domain map of the world at a resolution good enough to tell which country you're in, not which side of the street.

Worth knowing: there's a 12 km allowance along coastlines. At the resolution we use, a coastline is a simplified line, and real places, a spot in Manhattan, a canal in Venice, a street in Hong Kong, can technically fall just outside their own country's shape on the map. Rather than hand out no flag to someone standing exactly where they say they are, we count a photo as being in a country if it's within 12 km of that country's coastline. One side effect worth being upfront about: someone taking a photo from a ferry within 12 km of a coast can earn that country's flag too.

A flag is a rough badge, not a political statement, and we know it isn't perfect. A couple of things are worth knowing about before you email us confused:

• Gibraltar shows as a Spanish flag, and Vatican City shows as an Italian one. Both are real, separate places, but they're too small for the map data we use to tell apart from the country around them.
• For places whose borders are genuinely disputed, we simply follow what our map data says, which is one particular view of the world and not a claim by us about who owns what. In practice that means Crimea shows as Russia, Western Sahara mostly shows as Morocco, Taiwan shows as Taiwan, and Kosovo shows as its own flag.

If a flag looks wrong to you, or you'd like to tell us it should be different, email [email protected]. We'd rather hear about it than have you wonder.

Deleting your own pin

You can delete a pin you posted, and only one you posted: there's no way to delete anyone else's.

It costs you the 10 points that pin earned. Deleting a pin isn't a punishment, so it isn't the same minus-1 that a discarded photo costs (see Points and the chart); it simply gives back what the pin gained, because the pin isn't on the map earning its keep any more.

This is not the same as a pin retiring, and the difference is who decided. If the eyes come off and the pin becomes historic, you keep the points and the flag, because that wasn't your doing (see When the eyes are gone). Deleting is you taking your own pin off the map on purpose, so the points go back.

Three things you can't delete, and why:

• A pin still being reviewed. There's nothing to delete yet: it isn't published, and the review needs to finish first.
• A pin that's already been turned down. It was never published, and the minus-1 penalty for that stands either way, so deleting it wouldn't achieve anything except making it harder to look into if you appeal.
• A pin with an open report against it. Once someone's reported it, the report has to be resolved first. Deleting it out from under an active report would make it impossible to look into properly.

The pin comes off the map immediately. Nobody sees it again, not even you. But the photo itself is kept for 14 days before it's deleted from storage, the same 14 days a rejected photo gets, for legal and safety reasons: it needs to still exist in case something comes up in that window. It isn't visible to anyone during that time, not even to you. The app asks you to confirm before you delete a pin, and tells you about the 14 days before you agree, because this is one of those things you should know before you tap, not after.

Once that has happened, the pin stays in Your pins with its reason and its dates, and the little square where the photo used to be says Photo deleted. Nothing has gone wrong: that is the deletion working.

You are anonymous

Nothing on a public pin says who posted it. No name, no picture, no account ID, no badge, no colour, no per-user code of any kind. Someone browsing the map sees a photo and a place. Your account number from the chart doesn't appear here either. It lives on the chart and nowhere else, and there's no route from it to a pin. There is no profile page anywhere in the app.

You'll see your own pins marked as yours when you're signed in. That marking is computed for you and shown to nobody else.

Why this matters more than it sounds: pins carry precise coordinates. If strangers could list every pin by one person, they could map that person's movements, and the place someone posts from most often in the evening is usually their home. Keeping pins unlinkable is what makes the map safe to use.

Blocking used to be a hole in this, and isn't any more. Blocking hides exactly the photo you blocked and nothing else. The same person's other photos stay on your map, and the reason is the whole of this section: if blocking made someone's entire footprint vanish, the act of blocking would tell you which pins share an owner. Block one pin, see what else disappears, unblock, repeat, and you could sort a neighbourhood by author in an afternoon. Nothing fixes that except not doing it: rate limits only price it, making blocks permanent only stops you reusing an account, and hiding a few random extra pins as cover is defeated by trying twice. So the block acts on the photo you named. You'd already been shown that photo and already picked it out, so watching it go tells you nothing you didn't know.

Earlier versions of this manual described the leak as current and said we hadn't decided what to do. It's decided and it's built. The cost landed on you and we'll say so plainly: hiding a second photo by the same person is a second tap.

The one thing that's still true and can't be fixed here: when somebody deletes their account, everything they posted goes at the same moment, so a few of your hidden photos can leave that list together. Anyone who writes down pin identifiers off the public map and watches sees exactly the same thing, with no block involved, so this is a fact about deleting things rather than about blocking. We run deletions in batches to smudge it, which works better the more people are using the app, and is therefore weakest right now.

The other honest exception: we can see who posted what. We have to, to deal with abuse, respond to reports, and meet legal obligations. Anonymous means anonymous to other users, not to the people running the service. We'd rather say that plainly than imply something we can't deliver.

Sponsored pins are the last exception, and those are labelled with the business that paid for them, which is the point of paying.

Finding and getting there

Tap a pin once and a small card pops up over it: the photo, when the eyes were last seen, and how good the location fix is. The map stays where it was, so you can tap along a street and compare. Tap the card for everything: the full photo, the comment, the coordinates, the dates, and the buttons for directions, confirming, and reporting. Tap anywhere else on the map to put the card away.

Zoomed out, pins that would sit on top of each other fold into one orange disc with a number on it, the number being how many pins are in there. Tap the disc and the map zooms in until they come apart. At street level nothing is folded: two pairs of eyes on the same lamppost are two pins.

From the full view, open it in your usual map app for walking directions. Google Maps, Apple Maps, whatever your phone defaults to.

You can also export pins as KML (for Google My Maps or Google Earth) or GPX (for GPS units and hiking apps): either your own pins, or whatever's in view. Handy for planning a walking route. See maps and export for the details, including how to import a KML into Google My Maps if you want your own layer.

When the eyes are gone

Googly eyes don't last forever. They come off in the rain, they get cleaned away, somebody pockets them. A map that pretended otherwise would slowly fill up with pins nobody can find, so a pin can retire, and going back to look at one is something anybody signed in can do.

"I went, they are still there." Every pin has that button, and it sits up next to Directions rather than down in the quiet row with report and hide. That placement is on purpose: those two are things you press when something is wrong, and this is somebody back from a walk saying a pin is good. One tap, no photo needed, no explanation. It resets that pin's six month clock and clears any doubt hanging over it.

Six months with nobody confirming it and a pin retires itself. Time is the main rule rather than votes, because it's automatic, there's nothing to argue with, and no group of people can push it one way or the other. It's also simply true: googly eyes don't survive a year outdoors.

Reporting that the eyes are gone speeds that up, it doesn't decide it. One report fades the pin on the map rather than hiding it, so you can see that somebody went and didn't find them before you walk out there yourself. Two reports, from two different accounts, retire it. One is deliberately not enough. If it were, a single account could quietly empty the map, one pin at a time, and nobody would be able to tell that from the eyes genuinely having gone. The count is of separate accounts, so the same person filing ten times still counts once. An anonymous report is read by us like any other, but it doesn't count towards retiring a pin, for the same reason: there's no honest way to tell two anonymous reports apart.

Retiring is not deleting, and it goes both ways. A retired pin is still there, in the history, with its photo and its place. If somebody goes and finds the eyes back on the postbox, confirming it puts it straight back on the live map, and the button says so: "They are back, put it on the map". Eyes get re-stuck, and a map that couldn't recover would only ever shrink.

The "Gone" toggle in the top bar switches the map between the eyes that should still be there and the ones that have gone. Active is the default and stays the default. A map of eyes that have gone is a lovely thing to browse and a useless thing to navigate by, so seeing them is a choice you make rather than the state you're dropped into.

Retiring a pin never costs the person who posted it anything. They keep the 10 points and they keep the country flag. See Points and the chart for why that matters more than it sounds.

Who confirmed what is never readable by anyone: not by the person who posted the pin, not by another user, not through any part of the app. A pin is anonymous, but a confirmation would put a particular account at a particular place at a particular time, which gives away more than the pin ever did. So confirmations go in and nothing comes back out. See you are anonymous, because this is the same principle that keeps the chart on a once-a-day refresh.

Ads, and getting rid of them

The app is free, and ads pay for it.

Nothing sits on the map while you browse. No banner, ever, on the thing you came to look at. There is exactly one ad, in the Android app: a full-screen one shown while a photo you have just taken is being checked, so it fills a wait that happens anyway, and not every time. The website shows no ads on the map at all.

Or buy us a coffee, once, and they're gone for good. Not a subscription: one payment, no ads on that account ever again, on every device you sign in on. It follows your account rather than your phone, so buy it on the web and sign in on a phone later and the ads are still gone.

Buying it on the web

It's a payment of A$4.50, taken by Revolut. Your card details go to Revolut and never reach us.

You have to be signed in before you press the button. We need to know which account to take the ads off. When you press it, the checkout opens in a new tab already carrying your account's reference, so there is nothing for you to type and nothing to copy across. Press the button twice and you get the same reference back, not a second charge.

The ads switch off as soon as Revolut confirms the payment, usually within a minute. Nobody does it by hand any more: Revolut tells us the payment landed, the reference on it says which account, and the upgrade applies itself. Your reference is still shown, because it is what you would quote if you ever needed to ask us about a payment. If the ads are still there after an hour, email [email protected] with your reference and we will sort it out.

A donation through PayPal is a different thing, and does not remove the ads. On the website there is a PayPal button on the same screen for anybody who would rather send something that way, and it is a tip: PayPal cannot tell us which account paid, so nothing switches off. The Revolut button above is the one that buys the upgrade.

On iPhone and Android you can't buy it yet (not built yet)

The apps don't offer it at all, on purpose: no button, no PayPal, no link. Apple and Google both require a purchase like this to go through their own billing, and pointing you at a web checkout, or a tip jar, from inside the app is grounds for them rejecting it. That isn't us being precious about it, and we wouldn't risk the app to save the commission. Until those are built, buying on the web is the way, and it covers your phones too, because the upgrade follows the account.

Why it says coffee and shows a beer

The words say "buy us a coffee", because that's the phrase everyone already knows for a small one-off thank-you. The picture next to them is a one-litre Oktoberfest beer glass. The gap between the two is the joke, and it's deliberate.

The cat in the crown

Once you've bought us a coffee, a small cat wearing a crown appears next to your member number, just before your country flags. It's the same size as a flag and sits in the same row.

It's a cat and not just a crown on purpose. A crown on its own would look like rank, and this isn't rank. Buying the coffee removes the advertisement and buys nothing else at all. Not a faster check on your photos, not the benefit of the doubt on a report, not a nudge up the chart, not a single point, and no more say in anything than anybody else has. The rules apply to you exactly as they did before. A cat in a crown is obviously a joke about status rather than a claim to one, which felt like the honest way to mark somebody who bought a round.

Everybody who had an account before the coffee could be bought has one already. They were here when the map was nearly empty, they're the reason several things work, and there was no way to pay us even if they'd wanted to.

Reporting and blocking

Every pin has a report button, and you don't need an account to use it. If something shouldn't be on the map, use it. You'll get an acknowledgement straight away, and if you're signed in, or you leave us an email address, we'll tell you what we decided.

The button doesn't fire anything off on its own: it asks what you found. The screen is headed "Something about this pin" rather than "Report this pin", and the question is "what did you find?", because most of the time the answer isn't a complaint about anybody.

The first option is "The eyes are not there any more", and it is not an accusation. You went, and they had gone. Nobody is in trouble for that: eyes come off in the rain, get cleaned away, or somebody pockets them. It's first in the list because it's the commonest thing that happens to a googly-eyes pin, and every other reason on that screen is a complaint about somebody. Before it existed, an honest passer-by had to either blame the poster's GPS or bury an ordinary fact under "something else". Choosing it tells you "good to know they have gone" rather than promising that a person will look into it, because a person looking into it isn't the point: it counts towards the pin retiring instead. See When the eyes are gone for exactly what it does.

You do need to accept the current terms and privacy policy first, the same one-tap agreement posting asks for. See Accepting the rules above for exactly what that means and what gets recorded. Not needing an account and needing to accept those two documents are different things, and both are true at once.

Reporting while signed out has some small print, so here it is. That button is reachable by anyone on the internet, so it's behind a captcha and capped at five anonymous reports an hour from one source. We don't keep the address it came from: we keep a one-way hash of it with a counter, and that's deleted after 24 hours. It's the shortest-lived thing in the whole service, deliberately.

Two consequences you should know before you rely on it:

• The confirmation says the same thing whatever we find. It won't tell you whether that pin exists, whether it's still up, or what's happening to it. Pin identifiers are public, so a reply that varied would let anybody use the report button to work out what we'd taken down. That's a privacy control for whoever posted the pin, not us being unhelpful to you.
• An anonymous report gives us nothing to reply to. We review it on the same timescale either way. If you want the outcome, leave an email address in the form or write to [email protected].

You can block from a pin. There's no profile page to block from: pins don't carry one, and there is no profile to visit. It hides that photo, and only that photo. See the note above for why, because the reason is the interesting part. Blocking is private, the other person is never told, and it never tells you who anybody is. Your hidden photos are listed in your settings and you can unhide any of them whenever you like.

For the people who run it

Three staff screens live behind the Account button, and each appears only for an account whose role allows it. None of them is a secret; a person with the wrong role who types the address sees an empty screen, because the database refuses the request, not the app.

• Moderation (moderators and admins): the queue of photos waiting for a human decision. It deliberately hides who sent each photo.
• All uploads (moderators and admins): every upload from every account, newest first, under its pseudonym. It only looks.
• Admin (admins only): every account with its email address, number, role and counts, and every photo with its owner, verdict and status, in one place with a search box. From here an admin can ban or unban, change a role, delete an account, publish or reject or remove a photo, or delete a photo outright. Their photos closes the console and shows that one person's pins on the map in purple, whatever their state, with a banner to come back or clear the view. Each action asks once and is written to the moderation log. The address bar route is ?screen=admin. Today there is one admin.

Your data

We keep as little as possible, and not forever.

Two rows we can't shorten, and it would be dishonest not to point at them.

Ban records are forever. A ban that expires when you delete your account is not a ban. See above.

Supporter payments last five years. If you buy the ad-free upgrade, the record of that transaction has to survive even a deletion request, because Australian tax law requires the operator to keep business records for five years. That is not our policy and we can't waive it. What we keep is the bare transaction (date, amount, currency, a transaction identifier) and it is never public and never used to restore anything. Everything else goes.

A third thing survives too, but in a different way. Accepting a Terms of Use or privacy policy version (see Accepting the rules) is recorded, and that record isn't deleted with your account either. Unlike the two above, though, nothing is being kept about you: deleting your account removes the link between the record and you, so what's left is a document, a version number and a timestamp, and nobody's name attached to any of them.

Photos are checked by an AI service (Anthropic's Claude) to confirm they show googly eyes and nothing explicit. That means your photo is sent there to be looked at. Anthropic does not use it to train their models, and we never sell your photos or hand them to another company to train theirs.

We do keep a record of what the checker decided. Not the photo: the verdict, the confidence, the flags, and the short description the checker wrote of what it saw. We keep that even after the photo itself has been deleted, and we keep it for one specific reason, which is to measure how often the checker is right and make it better. Every time it is wrong about a poster or a colander, that record is how we find out. It describes a decision rather than a person, and you can object to it: the privacy policy says how, in Section 6.

Deleting your account removes your profile, your pins and your access. Your ad-free purchase does not survive it, because restoring that would mean keeping the payment identifiers that link you to it, which is exactly what deleting your data is supposed to prevent. We chose deletion.

You can do it yourself, from inside the app. Open Account, scroll to Delete your account, and type the word delete to confirm. It happens immediately: your pins leave the map at once and the photographs are destroyed from storage within 7 days. You do not have to ask anyone, and nobody asks you why. Emailing [email protected] still works if you would rather, and the full detail of what goes and what survives is on the account deletion page.

The one time it will refuse is while an open safety case involves your account. That is not us keeping you: it is that erasure gives way where the information is needed to deal with a live complaint, and otherwise deleting the account would be a way to destroy the evidence in a case about it. Write to us and a person will tell you where it stands.

The full detail is in the privacy policy, and the rules you're agreeing to are in the terms.

What isn't built yet

One thing, about paying us from inside a phone app, and it does not stop you using anything.

• Buying the ad-free upgrade inside the iPhone or Android app. The apps offer no purchase at all. Apple and Google require their own billing for this, and we're not allowed to send you to a web checkout instead. Buying on the web works today and covers every device you sign in on, so this is an inconvenience rather than a gap.

This section stays in the manual whether or not it has anything in it, rather than disappearing when it's empty, so you always know where to look.

What used to be on this list, and shipped on 25 August 2026

Recorded because a manual that quietly deletes its own caveats isn't worth trusting. Every one of these is now enforced by the database itself, not by the app on your phone, which means there's no version of the app that can be talked out of any of them, with one exception noted where it applies:

• Discarding the date of birth. There is no column for a birthday any more.
• GPS-only placement. Manual placement isn't disabled, it's impossible: only a device fix is accepted.
• The pin title and description fields, removed rather than hidden.
• The 50-metre accuracy floor, and showing the accuracy on every pin.
• Duplicate detection by perceptual hash, so the same eyes score once.
• The public chart: rank, points, and (as of 25 August 2026) a plain account number in place of the earlier opaque handle.
• The permanent blocklist, the one-way hash that makes a ban survive account deletion, including when the banned account changes its address first.
• Reporting without an account, captcha-gated and rate limited.
• Per-photo blocking, which replaced the version that hid everything an account had ever posted and told you, by doing so, which pins were theirs.
• Stripping the photo on your phone. Your camera file no longer travels to us intact: your phone straightens, strips and resizes the photo before anything is sent, and the untouched file never leaves it. (This one is enforced by the app on your phone rather than by the database, since it's work the phone does before anything reaches our servers. We still strip the copy we publish again, independently, on our own servers, so nothing depends on the phone alone.)

Getting help

[email protected], for anything: a bug, a rejected photo you think was wrong, a privacy request, or a pin that shouldn't be there.

Nothing is sent from or received at an @googlymaps.net address. If you get mail claiming to be from us at one, it isn't.

Last update: 2026-10-16 AWST