In February 2014 a security firm called Include Security published a way to find any Tinder user to within about 30 metres. Tinder had already stopped sending coordinates to the app. It still sent a distance, and that was enough.
The trick is older than phones. Ask for the distance from three different spots and draw three circles. They cross at one point. An attacker doesn't have to walk anywhere, because a fake location costs nothing to send. Rounding the number slows this down and doesn't stop it: you step your fake position along until the label flips from 1 km to 2 km, and the flip tells you where the edge is.
A sort order leaks the same way. In 2016 researchers at Kyoto University located Grindr users who had switched the distance display off, using nothing but the order of the profile grid. A radius filter has the same hole. A fuzzy circle drawn on a map is no better, because a circle has a centre and anyone can find it.
What that means for an event map
Heerish is used at conferences and residencies of 50 to 500 people, and the map shows where attendees are staying. That's a hotel, for several nights, next to a name and a photo. We decided early that nothing in the product would ever answer the question "how far is this person from me". So there are no distance labels and no proximity sort. "People near you" will never ship, however politely the feature request is worded.
What the map shows is a named place. If you're at the Station Hotel, your card sits on the Station Hotel, in the same spot as the other 21 people there. If the organiser has capped precision at district level, your card says Old Town and nothing finer ever leaves the server. The organiser picks that cap per event. City is the default, and hotel level comes with a warning they have to read and accept.
Hiding is one tap, with no confirmation dialog. From everyone else's side it looks identical to never having shared a hotel at all.
The feature that sounds safe
We also skipped "only visible to people at the same hotel". Think about how you'd abuse it. Claim the Linden, look at the list, switch to the Noord, look again. Six hotels later you have everyone.
Most people who get stalked know the person doing it. In the US Bureau of Justice Statistics' 2016 survey it was 69%. At a 200-person event that person might hold a valid invitation, so the map has to be safe to show to someone with bad intentions and a login.
If you find a way to pull a location out of Heerish that's finer than what the map displays, write to info@thatukrainianguy.rocks.