Mastodon.online
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- Staff may review your content; the policy does not describe an opt-out.
A public social server: your profile and posts are public, operators can see DMs, and IPs are kept up to a year.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, public profile, posts, follows, IP address, browser, and cookies.
Read the exact line
Privacy policy
“If you register on this server, you may be asked to enter a username, an e-mail address and a password.”
Training
They use it to run Mastodon, send email notices, and help with moderation like spotting ban evasion.
Read the exact line
Privacy policy
“To aid moderation of the community, for example comparing your IP address with other known ones to determine ban evasion or other violations.”
Sharing
Public posts go to other servers; they say they do not sell data but share with trusted helpers and the law.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
Kept
Login IPs up to 12 months; request logs up to 90 days. You can delete your account.
Read the exact line
Privacy policy
“Retain the IP addresses associated with registered users no more than 12 months.”
Controls
You can review logins, download an archive, delete your account, and manually approve followers.
Read the exact line
Privacy policy
“You can request and download an archive of your content, including your posts, media attachments, profile picture, and header image.”
Fine print
Minimum age is 13 in the US or 16 in the EU; no terms on suing, refunds, or account bans.
Read the exact line
Privacy policy
“If this server is in the USA: Our site, products and services are all directed to people who are at least 13 years old.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Download an archive of your posts and media
Privacy policy: request and download an archive of your content
Irreversibly delete your account
Privacy policy: you may irreversibly delete your account at any time
Review and revoke logged-in sessions
Settings: all logged in sessions are available for review and revocation
Manually approve new followers
Settings: toggle an option to approve and reject new followers manually
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Even “private” or followers-only posts can be read by server staff and people on other servers.
Read the exact line
Privacy policy
“Please keep in mind that the operators of the server and any receiving server may view such messages, and that recipients may screenshot, copy or otherwise re-share them.”
For example, a direct message about a job interview could be seen by a Mastodon admin or someone on another instance.
They warn you not to put secrets in posts or DMs because they cannot fully lock them down.
Read the exact line
Privacy policy
“Do not share any sensitive information over Mastodon.”
For example, they tell you not to send medical details or passwords through Mastodon.
Your profile is public to anyone, not just people you follow.
Read the exact line
Privacy policy
“The username, display name, biography, profile picture and header image are always listed publicly.”
For example, a photo you set as your avatar can be seen by people who never follow you.
Public posts leave this site and can be stored on many other servers you do not control.
Read the exact line
Privacy policy
“Your posts are delivered to your followers, in some cases it means they are delivered to different servers and copies are stored there.”
For example, deleting a post here may not erase copies already saved on another Mastodon server.
They keep a record of the internet address you logged in from for as long as a year.
Read the exact line
Privacy policy
“The latest IP address used is stored for up to 12 months.”
For example, they could still have last year’s login IP even if you stopped using the account months ago.
They say they do not sell your personal info, except to trusted helpers and when the law requires it.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
For example, they would not list your email for sale, but a hosting vendor might still process it.
You can wipe your account for good whenever you want.
Read the exact line
Privacy policy
“You may irreversibly delete your account at any time.”
For example, if you leave the server, you can delete the account so it cannot be logged into again.
They hash passwords and let you turn on two-factor login.
Read the exact line
Privacy policy
“your password is hashed using a strong one-way algorithm. You may enable two-factor authentication to further secure access to your account.”
For example, even if someone steals the database, they should not get your real password.
Kids under 13 in the US (or 16 in the EU) are told not to use it; there is no extra age check described.
Read the exact line
Privacy policy
“If you are under the age of 13, per the requirements of () do not use this site.”
For example, a 12-year-old could still type a birthday and sign up if nobody checks.
Cookies remember your settings; they do not describe advertising trackers.
Read the exact line
Privacy policy
“These cookies enable the site to recognize your browser and, if you have a registered account, associate it with your registered account.”
For example, staying logged in on the same browser uses a cookie.
Words to know
Legal words from the lines above, in plain English.
- human review
- Company staff or contractors may read your messages or content, usually to check for rule breaking. For example, a flagged private chat with an AI can be read by a person at the company.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- sensitive personal information
- Data that could hurt you if exposed, like health, religion, sexuality, race, exact location or bank details. For example, telling a chatbot about a medical condition creates sensitive data that some laws protect more strictly.
- COPPA
- A US law that limits what apps can collect from children under 13 without a parent's permission. For example, an app must get a parent's OK before it collects a 10-year-old's email address.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
How we got here · grade B · score 53/100 · 14 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect account info, public profile, posts, follows, IP addresses, browser name, cookies, and server logs—more than just what you type.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say server operators and receiving servers may view direct and followers-only messages, with no opt-out described.
Are you profiled or tracked for advertising?
They describe cookies for preferences and do not describe ads or third-party ad tracking.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information, but share with trusted third parties, other servers for federation, and when required by law.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete your account and download an archive. They aim to keep request logs no more than 90 days and user IPs no more than 12 months.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe SSL, hashed passwords, and optional two-factor authentication. No independent audit is mentioned.
Is there a real age gate, and are teens protected?
They say the site is for people 16+ in the EU/EEA and 13+ in the USA, with no age-check process described.
Will they tell you when the rules change, and is the policy specific?
The policy is dated October 6, 2022, but it does not say how they will notify you of changes.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
The documents do not describe paid subscriptions or refunds.
The privacy policy is 1,183 words at a fairly hard level (Flesch reading ease 53.5).
