Privacy Policy

1. Who we are

Mela is run by Mela Social, Inc., a Delaware corporation in the United States. In this policy, "Mela", "we" and "us" mean that company. We're responsible for the personal information we handle on Mela, and you can reach us using the details in section 21.

2. What this policy covers

Mela is offered to people in the United States and Canada. This policy covers the Mela apps for iOS and Android, our website at mela.social, the Mela web app, the invite preview pages that open when someone follows a Mela invite link, and the emails and notifications we send.

It doesn't cover websites you reach through links on Mela, or services that have their own relationship with you, such as the Apple App Store, Google Play and the hCaptcha bot check. Their own policies apply. Our Terms of Service set the rules for using Mela, and terms defined there mean the same here.

Community owners and admins are Mela users with extra tools, not separately responsible for your data. They may use what they see about members only to run their Community. Please send any privacy request to Mela.

3. Information you give us

Account information

Mela is invite-only. To create an account you give us:

• your email address, which we verify with a one-time code. Mela doesn't use passwords: each time you sign in, we email you a new code (or you use Apple or Google);
• a username, which is the same in every Community you join, appears on everything you post there, and can't be changed;
• your name, if you choose to add it, which we use to suggest your display name in each Community (other members see it if you keep it), to greet you, and in account and security emails and notifications, where a copy is kept with the notification;
• your date of birth, which will get used to check your age and apply age-based rules. We never show it to other members or admins;
• the invite code you used, which also tells us who invited you.

We need your email, username, date of birth and invite code to create your account and confirm your age. Your name and your account-wide avatar and bio are optional. We don't ask for financial, biometric, health or government ID information, or about your employment or education, but you may choose to share it in your Content or with the Assistant.

Signing in with Apple or Google

If you sign in with Apple or Google, that company sends us an account identifier, your email address (with Apple, possibly a private relay address) and, if you allow it, your name, which we use to create your account and sign you in. We keep any token Apple provides so we can revoke Mela's access to your Apple ID, as described in section 14.

Your profile in each Community

You have a separate profile in each Community you join: a display name and, if you add them, a bio, location line, avatar and banner. We also record your role and when you joined.

Content

We store the Content you create so we can show it to the people you share it with: posts, comments and reactions; articles and pages, with their version history; direct messages, group chats and channel messages, with attachments; photos, videos and other files; your conversations with the Assistant; and instructions you give an Agent.

Photo and video metadata

Photos and videos can carry details added by your camera or phone, such as the date, the device and the precise location where they were taken. Mela currently keeps this metadata in most files you upload, and anyone who can open a file can read it. To avoid sharing where a photo was taken, remove its location before uploading.

Reports, flags, appeals and support

If you flag a post, report something to us, appeal a decision or contact us, we keep what you submit and our reply. Members see how often a post was flagged, not by whom.

4. Information we collect automatically

• Device and app information: a random install ID the app creates, platform, app version, operating system, device model, language, time zone, when you were last active, and a push-notification token for each device where you allow notifications.
• Sign-in and security records: the time, the type of browser or device, and the IP address of each sign-in. We use these to keep you signed in, protect your account, and email you when a new device signs in.
• Server logs: each request's IP address, browser or app details, the page or feature requested, the time, and (once you're signed in) your user ID and Community, used to run and secure Mela.
• Activity status: whether you're online, when you're typing, and which messages you've read. People in the same Community or conversation can see this.
• App update checks: our mobile apps check with our app-update provider for new versions, sending your IP address, platform, app version and a random installation identifier, but no account information.

Crash reports

We use an outside diagnostics service to find and fix bugs. When the app hits an error, it sends a technical report: what went wrong, the screen and recent app actions, your device and app version, the Community you were viewing, and your IP address. Reports can be linked to your account.

What we don't collect

We don't use advertising identifiers or track you across other companies' apps or websites, and our apps don't include other companies' advertising, attribution or analytics tools. The app asks for camera and photo library access only when you choose to take or upload media. We don't request your device location or contacts.

5. Information from other people and services

• Other members may mention you, reply to you, add you to a group chat or channel, flag or report your Content, or post about you.
• Admins create records when they decide on your join request, change your role, decide an appeal, hide your posts, or suspend, remove or ban you from their Community.
• hCaptcha, our bot-prevention provider, checks your browser or device when you sign up and tells us whether you passed.
• Apple and Google send us sign-in details (section 3) and, where available, an age range or age signal for your device account through Apple's Declared Age Range and Google Play's Age Signals (section 17).

6. Information about people who don't use Mela

To help a Community follow topics, members and Agents can bring in publicly available material, such as social media posts, news articles and web pages. We store it with the original author's name or handle, the text, and links to the source and its media, and only that Community's members can see it. Members may also mention or write about people who don't use Mela.

If you don't use Mela and want something about you removed, email safety@mela.social with a link to or description of the material, or privacy@mela.social for a request under privacy law. For copyright claims, please use the process in our Terms. We'll remove material where the law requires, and we may remove other material too. When original material is deleted at its source, we'll remove or refresh our copy within 30 days after we learn about it.

7. How we use information

We use personal information to:

• create and run your account, Communities, feeds, Spaces, articles and messaging, and deliver notifications;
• provide the Assistant, Agents and other AI features when you or your Community use them, and train and improve the models behind them unless you opt out (section 8);
• review Content against Mela's and each Community's rules, handle flags, reports and appeals, enforce our Terms, and order feeds;
• keep Mela secure (prevent bots, spam and fraud, alert you to new sign-ins, investigate misuse) and fix crashes and performance problems;
• understand how Mela is used, in aggregate, from activity records that don't include the text of posts or messages;
• show a Community's admins each member's AI usage there and its estimated cost;
• check that you meet the minimum age;
• comply with the law, respond to valid legal requests, and protect people from harm.

Consent, if you're in Canada

By using Mela, you agree to the uses in this policy that are needed to provide the service. Subject to legal and contractual limits, you can withdraw consent to AI training and to push and email notifications at any time, using the controls in section 15. We'll tell you what withdrawing means for the features you use; it doesn't affect what we did before.

8. AI features and AI training

Mela uses AI for the Assistant, Agents, small helpers (such as naming your chats and summarizing links), post review and feed ordering. The Mela Assistant and Agents make mistakes. Please check responses.

What the Assistant and Agents use

The Assistant works in one Community at a time. It uses your chat with it, your profile in that Community, the Space memory of Spaces you own, and anything it looks up for you, limited to Content you can already see there. When other members use the Assistant or an Agent, it may look up your posts and Community profile the same way. The Assistant and Agents never read direct messages, group chats or channel messages.

Space memory

The Assistant doesn't keep a personal memory about you. Each Space has Space memory: notes the Assistant and Agents keep for that Space, which can include what members asked for or wrote there, and which the Space's owner and editors can see. It can't be turned off, so it's best to leave out sensitive details you wouldn't want kept there.

Where AI processing happens

All of Mela's AI features run on models Mela hosts on its own servers on Amazon Web Services in the United States. We don't send your information to outside AI providers.

AI training

We may use your posts, Assistant chats, messages in public channels, and Space memory to train and improve the models behind Mela's features. You'll be able to opt out in settings. Opting out stops future use, but neither opting out nor deleting your Content removes it from models already trained. We'll never train AI models on direct messages or group chats.

Records we keep about AI use

We keep technical logs of each AI request, including its text, to investigate problems and misuse, and usage records (who made each request, in which Community, how much it processed, and any search queries) to manage capacity and costs. Our internal performance monitoring also records the timing of AI requests and may record their text.

9. Post review and feed ordering

AI review of posts

Every post and comment is reviewed by AI against Mela's rules and the Community's charter and conduct policy before anyone but its author can see it. If a post doesn't pass, only you can see it, with the reason, and you can ask for a person to review it. Members who can see a post can also see the AI's assessment of it. AI can hold a post, but only people (a Community's admins or Mela staff) can suspend, remove or ban a member.

Feed ordering

Feeds are ordered using how well a post fits the Community's charter, a quality score, your connections and engagement in that Community, and how recent the post is. Feed ordering may also incorporate what content you engage with.

10. Who can see what

Your profiles and posts are visible only inside the Communities you join (an invite link shows just the Community's basic details and the inviter's display name and avatar), and posts, profiles and messages aren't published on the open web or indexed by search engines. Anyone with a file's link, including a message attachment's, can open it without signing in. A small number of authorized staff can access account information, Community and moderation records, Assistant chats, Space memory and diagnostic logs, only as needed to provide support, fix problems, keep Mela safe and comply with the law, and access to message content is limited further (section 11).

11. Messages

Only the people in a conversation can see its messages. Community admins can't read conversations they aren't part of, though they can add themselves to private channels in their Community, and people added to a group chat or channel later can see earlier messages. The Assistant, Agents and post review can't read messages. Anyone with an attachment's link can open it (section 10).

Messages are not end-to-end encrypted. They're encrypted in transit, but our systems can read them, so please don't use Mela for anything that needs to stay strictly secret. Mela staff access message content only when authorized personnel need to because:

1. a participant reports a message or conversation to us;
2. the law or valid legal process requires it;
3. it's needed to investigate a security incident or protect someone's safety, including child safety;
4. it's needed to fix a problem delivering messages; or
5. you ask us to as part of a support request.

We never use message content for advertising, and never use direct messages or group chats for AI training (section 8).

12. Who we share information with

We don't sell your personal information, share it for targeted or cross-context behavioral advertising, or use your Content for advertising.

Service providers

Our service providers may use your information only to provide their services to us, under contracts that require them to protect it at least as well as this policy does. They are:

• Cloud hosting (Amazon Web Services, in the US), including for our own AI models: all the information in this policy.
• Push notification services (Apple and Google): device tokens and notification content.
• Email delivery: your email address and the content of emails we send you.
• Crash reporting and diagnostics: the data described in section 4.
• App updates: the update-check data in section 4.
• Sign-in (Apple and Google): the sign-in request.

Other recipients

• hCaptcha receives browser and device signals and your IP address when you sign up (section 5).
• Sites where Mela conducts searches receive AI-written search queries from our servers. We don't attach your name, username, email or IP address, but a query can include names, places or other details from your request.
• Websites whose content appears in Mela: images in link previews and media in posts brought in from outside sources load directly from their sites, which receive your IP address and basic device information.
• Websites our servers visit: when we fetch a link to build its preview, or the Assistant or an Agent browses a site or fills in a form there for you, that site receives our server's request and anything the AI enters, but not your IP address.
• Other people on Mela see what you share with them in your Communities and conversations.

Legal requirements and safety

We disclose information to authorities when we receive valid legal process, such as a subpoena, court order or warrant; when the law requires us to report; or when we believe in good faith it's needed to prevent death or serious physical harm. Authorities can send requests to legal@mela.social. We may challenge requests that are overly broad or invalid. We'll try to tell you before disclosing your information, unless the law forbids it, your account has been deleted, notice would be futile or put someone at risk, or the disclosure is an emergency or a required child-safety report.

We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) in the US, and to the Canadian Centre for Child Protection or police in Canada where the law requires. When we receive a valid request, we remove non-consensual intimate images, and identical copies we find, within 48 hours, as our Terms describe. We may also share information with the people involved, such as a reporting member or a Community's admins, when needed to enforce our Terms or protect someone's safety.

Business transfers, and sharing you ask for

If Mela is involved in a merger, acquisition, financing, reorganization or sale of assets, your information may transfer to the new owner, who must keep honoring this policy for information collected under it. We'll tell you before your information becomes subject to a different policy. We also share information when you ask us to or agree to it.

13. Where we process your information

Mela stores and processes your information in the United States, on Amazon Web Services, and our service providers process it mainly in the United States. If you're in Canada, this means your information is subject to US law and may be accessed by US courts, law enforcement and national-security authorities. We protect it with the contracts and safeguards described in this policy. You can ask about our practices for service providers outside Canada at privacy@mela.social.

14. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete it or strip it of anything that identifies you. How long that is depends on what the information is for:

• Your account and profile: while your account exists. Sign-ups that are never completed are deleted after a short time.
• What you create: posts, comments, pages, messages and files stay until you delete them. Assistant and Agent chats, and the Agents you created for yourself, stay until you delete them or your account.
• Logs, security and diagnostic records: only as long as we need them to keep Mela secure, prevent abuse and fix problems, then deleted on a rolling schedule. Sign-in and security records may be kept longer than routine logs so we can detect repeated attacks.
• Usage and moderation records: as long as we need them to run Mela, handle appeals and enforce our rules. Usage records are then kept only in aggregate.
• Backups: expire automatically on a rolling schedule, so deleted information disappears from them over time.

We may keep specific information longer when the law requires it (for example, reports to the National Center for Missing & Exploited Children are kept at least as long as US law requires), to resolve a dispute or enforce our Terms, or under a legal hold or active safety investigation.

Deleting Content

When you delete a post, comment or message, we remove it from Mela right away, but files attached to a deleted message stay reachable to anyone with their link; copies may remain for limited periods in records and backups. We can't delete copies others already have, such as screenshots. Deleting your account doesn't delete your posts or messages, so if you want them gone, delete them first.

Deleting your account

You can delete your account in the app under Settings → Data & Privacy → Delete account, or without the app at app.mela.social/support/delete-account. We email you a code to confirm it's you. Deletion is immediate and can't be undone; there's no grace period. We erase the account and profile data listed here from our active systems, normally within minutes, and email you when it's done: your account and profile details (email, username, name, date of birth, bios, avatars and banners), follows, reactions and flags, message settings and read status, notifications, devices and sessions, Assistant and Agent chats (including with Agents in Spaces), personal notes and pages, and the Agents you created for yourself. If you signed in with Apple, we revoke Mela's access to your Apple ID.

Posts, comments, articles and pages you wrote in a Community, messages you sent, and their attachments stay where they are after you delete your account, shown as written by Former member and no longer linked to your name, username or email address, and anything you added to a Space's memory stays too. Reports you filed stay without your name, and records of your AI use keep only the counts.

Communities, Spaces and group chats you own, and Agents you created in a Space, pass to other members or are archived or closed; the app shows you what happens to each before you confirm. Backups, logs and other records containing your information expire on the schedules described above.

If you don't use Mela for 2 years, we may close and delete your account as described above and free up your username. We'll email you before we do.

15. Your choices and rights

Controls in the app

• Profiles, Content and account: edit your profiles and name, edit or delete your posts, messages and Assistant chats, and delete your account (section 14). To change your email, contact support@mela.social.
• AI training: opt out in Mela's settings (section 8).
• Notifications: choose which you get in Mela's settings or your device settings.
• Conversations: mute, hide or leave a conversation, or block someone. To leave a Community, ask its admins or support@mela.social; your Content there stays unless you delete it.

Requests you can make, wherever you live

You can ask us for a copy of the personal information we hold (including a copy of what you provided in a structured, commonly used, machine-readable format), to correct it, to delete it, or to stop using it for a particular purpose. Email privacy@mela.social from your account's address (to delete your account, use the app or web page in section 14). We'll verify your identity, usually by confirming you control that address, and respond within 30 days, or sooner if your local law requires. For complex requests, we may extend that as the law allows and tell you why. If we decline where the law allows, for example because a request would reveal someone else's information, we'll explain why, and you can appeal by emailing privacy@mela.social. We won't treat you differently for exercising your rights.

If you've deleted your account and want content you wrote removed, email privacy@mela.social; we'll remove it where the law requires. If you're under 18, you can ask us to remove content you posted, even after leaving a Community or deleting your account, by emailing privacy@mela.social; this can't remove copies others have made, such as screenshots.

If you live in Canada

You have the right to access the personal information we hold about you and learn how it has been used and to whom it has been disclosed; to have it corrected; and to withdraw consent to uses that rely on it (section 7). You also have the right to:

• ask us to stop disseminating your information, or to de-index a link to it, where the law allows;
• be told when a decision about you is made exclusively by automated processing, such as an AI post hold (section 9), learn the information and main reasons behind it, have that information corrected, and submit your observations to a Mela staff member who can review it, by emailing safety@mela.social;
• be told about functions that identify, locate or profile you. Feed ordering uses who you follow and what you and others engage with in each Community (section 9).

If you're not satisfied with our response, contact our Privacy Officer (section 21). You can also complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy regulator where a provincial law applies.

16. Security

We protect your information with measures such as encrypting traffic between your device and our servers, expiring one-time sign-in codes and sign-in sessions, new sign-in alerts, and limiting access to production systems to authorized staff. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the authorities as the law requires.

To report a vulnerability, email privacy@mela.social with "Security" in the subject line, and please give us a reasonable chance to fix it before disclosing it publicly.

17. Children and teens

You need to be at least 13 to use Mela, including its AI features, or older if the law where you live requires it. We ask for your date of birth at signup and don't let you create an account if the date you enter is under the minimum age.

We don't knowingly collect personal information from children under 13. If we learn an account belongs to someone under the minimum age, we'll suspend it and, once confirmed, delete it with its information and content. If you believe a child is using Mela, contact safety@mela.social.

We also ask Apple (Declared Age Range) or Google Play (Age Signals) for the age range linked to your device's account and, where the law requires, whether a parent has approved. We use this only to confirm that you meet the minimum age and to meet legal requirements, and we don't keep it longer than we need to.

18. Cookies and local storage

We use only the cookies and similar storage that Mela needs to work, and no advertising or analytics cookies. On the web, they keep you signed in and your session secure, remember your preferences, and deliver browser notifications if you allow them. Our mobile apps keep your sign-in and cached data on your device until you sign out or delete the app. The random install ID stays until you delete the app or, on the web, clear site data. hCaptcha sets its own cookies on the signup screen, and Apple and Google set theirs on the web sign-in and signup pages.

Because we don't track you across other sites or apps, we treat everyone the same whether or not their browser sends a Do Not Track signal. Apart from hCaptcha at signup, Apple and Google sign-in on the web sign-in and signup pages, and sites whose media loads in Mela (section 12), we don't allow third parties to collect information about your activity on Mela over time and across other sites.

19. Emails and notifications from us

• Service and security emails, such as sign-in and verification codes, account-deletion codes and confirmations, new sign-in alerts and important notices about your account or our policies, are always sent.
• Notification emails are off unless you turn them on, and you can turn them off again in notification settings.
• Push notifications are on once you allow them on your device, and you can change them in Mela or your device settings.
• Marketing: we don't send marketing messages today. If we start, we'll ask for your consent first where the law requires it, as in Canada, and every message will let you opt out.

20. Changes to this policy

We'll update this policy when our practices or the law change. This policy explains our practices; it isn't part of our Terms of Service. The current version is always available on our website, and past versions will also be available. For a material change, such as collecting a new kind of information or using it in a significantly different way, we'll tell you by email and in the app at least 30 days before it takes effect. If a change is required by law or urgently needed for safety or security, we'll tell you as soon as we can. Where the law requires your consent, we'll ask for it. Adding or replacing a service provider that acts only for us isn't a new use.

21. Contact us

Mela Social, Inc., 6513 132nd Ave NE, PMB 124, Kirkland, WA 98033, USA.

• Privacy questions, complaints and data requests: privacy@mela.social
• Help with your account: support@mela.social
• Safety, abuse, child safety and intimate-image removal: safety@mela.social
• Legal notices, copyright and law-enforcement requests: legal@mela.social

Contact our Privacy Officer at privacy@mela.social.