Fosstodon.org (Mastodon Instance)
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- Staff may review your content; the policy does not describe an opt-out.
A Mastodon server that posts publicly, keeps IPs up to a year, and lets operators read DMs; no AI training terms.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, posts, follows, profile pictures, IP address, and browser name.
Read the exact line
Privacy policy
“If you register on this server, you may be asked to enter a username, an e-mail address and a password.”
Training
They use it to run Mastodon, send emails, and help moderate, including checking IPs.
Read the exact line
Privacy policy
“To aid moderation of the community, for example comparing your IP address with other known ones to determine ban evasion or other violations.”
Sharing
Public posts go to the whole network; they say they do not sell data but use helpers and other servers.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
Kept
Login IPs up to 12 months; request logs up to 90 days; you can delete your account.
Read the exact line
Privacy policy
“Retain the IP addresses associated with registered users no more than 12 months.”
Controls
You can download an archive, delete your account, review sessions, and approve followers.
Read the exact line
Privacy policy
“You can request and download an archive of your content, including your posts, media attachments, profile picture, and header image.”
Fine print
Policy dated Oct 6, 2022; 13+ in the US and 16+ in the EU; no lawsuit or payment terms here.
Read the exact line
Privacy policy
“If this server is in the USA: Our site, products and services are all directed to people who are at least 13 years old.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Download an archive of your posts and media
Privacy policy: request and download an archive of your content
Irreversibly delete your account
In the service; policy says you may delete at any time
Review and revoke logged-in sessions
Settings; all logged in sessions are available for review and revocation
Turn on manual follower approval
Settings; toggle to approve and reject new followers
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
People who run this server or other servers can read your private and followers-only posts.
Read the exact line
Privacy policy
“Please keep in mind that the operators of the server and any receiving server may view such messages, and that recipients may screenshot, copy or otherwise re-share them.”
For example, a direct message you send could be read by a server admin, not only the person you sent it to.
They warn you not to put secrets in posts because they cannot fully protect them.
Read the exact line
Privacy policy
“Do not share any sensitive information over Mastodon.”
For example, do not send a password, medical detail, or home address in a Mastodon message.
Once you post, copies can live on other people's servers even if you later delete them here.
Read the exact line
Privacy policy
“Your posts are delivered to your followers, in some cases it means they are delivered to different servers and copies are stored there.”
For example, a public post may still exist on a follower's server after you delete it on Fosstodon.
Your profile is public to anyone, not just people you follow.
Read the exact line
Privacy policy
“The username, display name, biography, profile picture and header image are always listed publicly.”
For example, a search engine or stranger can see your display name and photo.
They keep a record of the internet address you last logged in from for as long as a year.
Read the exact line
Privacy policy
“The latest IP address used is stored for up to 12 months.”
For example, they could still have last year's login IP even if you have not posted in months.
They say they do not sell your personal info, except to trusted helpers and when the law requires it.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
For example, they would not list your email for sale, but a hosting company they use might see it.
You can wipe your account yourself, and they say that cannot be undone.
Read the exact line
Privacy policy
“You may irreversibly delete your account at any time.”
For example, if you leave Fosstodon you can delete the account from the service.
They hash passwords and let you add a second login step.
Read the exact line
Privacy policy
“your password is hashed using a strong one-way algorithm. You may enable two-factor authentication to further secure access to your account.”
For example, you can turn on an authenticator app so a stolen password is not enough.
In the US they say you must be at least 13, but they do not describe checking your age.
Read the exact line
Privacy policy
“If you are under the age of 13, per the requirements of () do not use this site.”
For example, a 12-year-old could still type that they are 13 and sign up.
Words to know
Legal words from the lines above, in plain English.
- human review
- Company staff or contractors may read your messages or content, usually to check for rule breaking. For example, a flagged private chat with an AI can be read by a person at the company.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- sensitive personal information
- Data that could hurt you if exposed, like health, religion, sexuality, race, exact location or bank details. For example, telling a chatbot about a medical condition creates sensitive data that some laws protect more strictly.
- COPPA
- A US law that limits what apps can collect from children under 13 without a parent's permission. For example, an app must get a parent's OK before it collects a 10-year-old's email address.
How we got here · grade C · score 45/100 · 13 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect account info, posts, media, follows, plus IP addresses, browser name, and server logs.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say server operators and receiving servers may view direct and followers-only messages, with no opt-out described.
Are you profiled or tracked for advertising?
They describe cookies for preferences and login, not ads or third-party ad trackers.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information, but share with trusted helpers and federated servers for posts.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete your account anytime and download an archive. Request logs are kept no more than 90 days; login IPs up to 12 months.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe SSL, hashed passwords, and optional two-factor authentication. No audit or leak history is given.
Is there a real age gate, and are teens protected?
They say 16+ in the EU/EEA and 13+ in the USA. They do not describe checking age.
Will they tell you when the rules change, and is the policy specific?
The policy is dated Oct 06, 2022, but it does not say they will notify you of changes.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
The documents do not describe paid plans, renewals, or refunds.
The privacy policy is 1,202 words at a fairly hard level (Flesch reading ease 54.2).
