Poweredbygay.social (Mastodon Instance)
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- Staff may review your content; the policy does not describe an opt-out.
A 2018 Mastodon privacy policy: public posts, IPs kept up to a year, admins can read DMs, no sale of data.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, posts, follows, profile pictures, IP address, browser name, and cookies.
Read the exact line
Privacy policy
“When you log in, we record the IP address you log in from, as well as the name of your browser application.”
Training
They use it to run Mastodon, send email notices, and help with moderation like spotting ban evasion.
Read the exact line
Privacy policy
“To aid moderation of the community, for example comparing your IP address with other known ones to determine ban evasion or other violations.”
Sharing
Public posts go to the whole network; trusted helpers and other servers can get data; they say they do not sell it.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
Kept
Login IPs up to 12 months; request logs up to 90 days; you can delete your account anytime.
Read the exact line
Privacy policy
“Retain the IP addresses associated with registered users no more than 12 months.”
Controls
You can download an archive, delete your account, review logins, and manually approve followers.
Read the exact line
Privacy policy
“You can request and download an archive of your content, including your posts, media attachments, profile picture, and header image.”
Fine print
You must be 16+. Policy changes are only posted on this page. No terms about suing or payments.
Read the exact line
Privacy policy
“If we decide to change our privacy policy, we will post those changes on this page.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Download an archive of your posts and media
Privacy policy: request and download an archive of your content
Irreversibly delete your account
Privacy policy: you may irreversibly delete your account at any time
Review and revoke logged-in sessions
Settings: all logged in sessions are available for review and revocation
Turn on manual follower approval
Settings: toggle an option to approve and reject new followers manually
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
People who run this server, and other servers, can read your direct and followers-only posts.
Read the exact line
Privacy policy
“Please keep in mind that the operators of the server and any receiving server may view such messages, and that recipients may screenshot, copy or otherwise re-share them.”
For example, a private DM you send could be read by an admin here or on your friend’s server.
Whatever you put on your profile is public, not private.
Read the exact line
Privacy policy
“The username, display name, biography, profile picture and header image are always listed publicly.”
For example, a bio you write is visible to anyone on the web, not just people you follow.
Other Mastodon servers get copies of your posts and even some private messages.
Read the exact line
Privacy policy
“Your public and followers-only posts are delivered to the servers where your followers reside, and direct messages are delivered to the servers of the recipients”
For example, if a follower is on another site, that site stores a copy of your post.
They keep a record of where you logged in from for as long as a year.
Read the exact line
Privacy policy
“The latest IP address used is stored for up to 12 months. We also may retain server logs which include the IP address of every request to our server.”
For example, an IP from a login last winter could still be on file next fall.
They will not necessarily email you; they just update this page.
Read the exact line
Privacy policy
“If we decide to change our privacy policy, we will post those changes on this page.”
For example, new sharing rules could go live and you would only notice if you re-read the policy.
They say you should be 16 or older, but they do not describe ID checks.
Read the exact line
Privacy policy
“Our site, products and services are all directed to people who are at least 16 years old.”
For example, a 15-year-old could still type an older age and sign up.
They say they do not sell your personal info, except to helpers who run the site and when the law requires it.
Read the exact line
Privacy policy
“We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.”
For example, they should not sell your email to an advertiser.
You can wipe your account for good whenever you want.
Read the exact line
Privacy policy
“You may irreversibly delete your account at any time.”
For example, if you leave the instance, you can delete the account so it is gone.
Login traffic is encrypted and passwords are stored hashed, not as plain text.
Read the exact line
Privacy policy
“your browser session, as well as the traffic between your applications and the API, are secured with SSL, and your password is hashed using a strong one-way algorithm.”
For example, someone sniffing wifi should not see your password in the clear.
You can get a copy of your posts and pictures.
Read the exact line
Privacy policy
“You can request and download an archive of your content, including your posts, media attachments, profile picture, and header image.”
For example, before you leave you can download your posts to keep them.
Words to know
Legal words from the lines above, in plain English.
- human review
- Company staff or contractors may read your messages or content, usually to check for rule breaking. For example, a flagged private chat with an AI can be read by a person at the company.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
How we got here · grade C · score 45/100 · 13 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect account and profile info, posts, follows, plus IP addresses, browser name, cookies, and server logs.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say server operators and receiving servers may view direct and followers-only messages, with no opt-out described.
Are you profiled or tracked for advertising?
They describe cookies for preferences and login, not ads or third-party ad trackers.
Do they sell or share your data, and can you opt out?
They say they do not sell personal information, but share with trusted helpers and federate posts to other servers.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete your account at any time and download an archive. They aim to keep request logs no more than 90 days and user IPs no more than 12 months.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe SSL, hashed passwords, and optional two-factor authentication. No audit or leak history is mentioned.
Is there a real age gate, and are teens protected?
They say the site is for people at least 16 and tell under-16s not to use it, with no age-check described.
Will they tell you when the rules change, and is the policy specific?
The policy is dated March 7, 2018. They say they will post changes on this page, with no advance notice described.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
No paid plans, subscriptions, or refunds are described.
The privacy policy is 993 words at a fairly hard level (Flesch reading ease 54.4).
