Mastodon-mstdn.io
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- Staff may review your content; the policy does not describe an opt-out.
A Mastodon server that posts much of your profile publicly, keeps IPs up to a year, and lets admins see DMs.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, posts, follows, profile pictures, IP address, and browser name.
Read the exact line
Privacy policy
“If you register on this server, you may be asked to enter a username, an e-mail address and a password.”
Training
They use it to run Mastodon, send emails, and help with community moderation.
Read the exact line
Privacy policy
“To provide the core functionality of Mastodon. You can only interact with other people's content and post your own content when you are logged in.”
Sharing
Public posts go to the whole network; they say they do not sell personal info but use helpers.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
Kept
Login IPs up to 12 months; server logs up to 90 days; you can delete your account.
Read the exact line
Privacy policy
“Retain the IP addresses associated with registered users no more than 12 months.”
Controls
You can review logins, download an archive, and irreversibly delete your account.
Read the exact line
Privacy policy
“You may irreversibly delete your account at any time.”
Fine print
Policy dated Oct 06, 2022; 13+ in the US and 16+ in the EU; no lawsuit or payment terms here.
Read the exact line
Privacy policy
“If this server is in the USA: Our site, products and services are all directed to people who are at least 13 years old.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Download an archive of your posts and media
Privacy policy: You can request and download an archive of your content
Irreversibly delete your account
Privacy policy: You may irreversibly delete your account at any time
Review and revoke logged-in sessions
Settings: All the logged in sessions are available for your review and revocation
Approve new followers manually
Settings: toggle an option to approve and reject new followers manually
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Admins on this server and on other servers can read your direct and followers-only posts.
Read the exact line
Privacy policy
“Please keep in mind that the operators of the server and any receiving server may view such messages, and that recipients may screenshot, copy or otherwise re-share them.”
For example, a private DM about a job could be read by a server operator.
Your profile is public by default, not just to people you follow.
Read the exact line
Privacy policy
“The username, display name, biography, profile picture and header image are always listed publicly.”
For example, a stranger can see your bio and profile photo without following you.
Once you post, copies can live on other people's servers even if you later change your mind.
Read the exact line
Privacy policy
“Your posts are delivered to your followers, in some cases it means they are delivered to different servers and copies are stored there.”
For example, deleting a public post here may not erase copies already saved elsewhere.
They keep the last IP you logged in from for as long as a year.
Read the exact line
Privacy policy
“The latest IP address used is stored for up to 12 months.”
For example, a login from a café Wi‑Fi could stay on file for 12 months.
They warn you that this network is a bad place for secrets.
Read the exact line
Privacy policy
“Do not share any sensitive information over Mastodon.”
For example, they tell you not to send a password or medical detail in a DM.
They say they do not sell your personal data, except to trusted helpers and when the law requires it.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
For example, they would not sell your email list to an advertiser, according to this line.
You can wipe your account yourself; they say it cannot be undone.
Read the exact line
Privacy policy
“You may irreversibly delete your account at any time.”
For example, you can delete the account from settings and it should not come back.
Login traffic is encrypted and passwords are stored as hashes, not as plain text.
Read the exact line
Privacy policy
“your browser session, as well as the traffic between your applications and the API, are secured with SSL, and your password is hashed using a strong one-way algorithm.”
For example, someone who steals a database dump should not see your real password.
They set a minimum age but only ask you not to join if you are too young.
Read the exact line
Privacy policy
“If you are under the age of 13, per the requirements of () do not use this site.”
For example, a 12-year-old could still type a birthday and sign up.
Words to know
Legal words from the lines above, in plain English.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- sensitive personal information
- Data that could hurt you if exposed, like health, religion, sexuality, race, exact location or bank details. For example, telling a chatbot about a medical condition creates sensitive data that some laws protect more strictly.
- COPPA
- A US law that limits what apps can collect from children under 13 without a parent's permission. For example, an app must get a parent's OK before it collects a 10-year-old's email address.
How we got here · grade C · score 45/100 · 13 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect account info, posts, media, follows, plus IP addresses, browser name, and server logs.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say server operators and receiving servers may view direct and followers-only messages, with no opt-out described.
Are you profiled or tracked for advertising?
They mention cookies to save preferences, not ads or third-party ad tracking.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information, but share with trusted helpers and federated servers for posts.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete your account at any time; they aim to keep request logs no more than 90 days and user IPs no more than 12 months.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe SSL, hashed passwords, and optional two-factor authentication. No audits or past leaks are mentioned.
Is there a real age gate, and are teens protected?
They say 16+ in the EU/EEA and 13+ in the USA, and tell underage people not to use the site, with no age check described.
Will they tell you when the rules change, and is the policy specific?
The policy is dated Oct 06, 2022, but it does not say they will warn you before changes.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
No paid plans, auto-renewal, or refunds are described.
The privacy policy is 1,171 words at a fairly hard level (Flesch reading ease 55.7).
