Privacy Policy

Draft pending legal review.

What we collect

• From the account you sign in with (Discord, Google or X): your account ID, name and avatar
• What you add: your profile, links, uploads, connections and crews
• Usage events, such as signups, invites, and map and path views, linked to your account
• Daily totals for your page, which only you can see: views, link clicks, and counts by referring site, device type and country. They don't record who visited
• If you turn on suggestions: scrambled IDs and sizes of your Discord servers, never their names
• If you verify an account elsewhere: its name, ID and link. We never keep the token used to check it
• If you import a data export: the file is read in your browser, and only the usernames are sent to us. We use them to look for people already on Mutuals, keep only the matches, and discard the rest. Only you see those matches

Who sees what

Your page is public, and search engines can find it. Your settings control who can see your connections. Crew pages list members publicly unless a member's map is set to private.

If you join the web, anyone can see your map and your connections with other people on it. People who know you elsewhere can see you as a suggestion if they import a list or check their follows, unless your map is private or you've turned this off. Nothing connects unless you both agree.

Services we use

We use providers for hosting, database, file storage, rate limiting and image moderation. Uploaded images are sent to a moderation provider for checking. If you turn on live status, it comes from Lanyard, a third-party service. If you verify an account or look for mutuals on GitHub or Bluesky, we read public data from those services.

Keeping the site safe

Moderators can see files you upload, including ones waiting for review. When we remove a file, we keep its reason and a fingerprint, which can't be turned back into the file, so it can't be uploaded again. If you ask for an account check, a person visits that profile. If someone sends a request to remove an image, we keep what they wrote, including their name and contact details, so we can act on it and show we did. If your page was taken down or you can no longer upload, and you delete your account, we keep a scrambled version of your sign-in, so signing up again doesn't undo that. It identifies nobody unless you sign in again. Where the law requires it, we report apparent child sexual abuse material to the National Center for Missing & Exploited Children and keep the files and account details for that report, even if the account is deleted.

Your choices

You can hide connections, make your map private, turn off suggestions (which deletes the server data), stop people who know you elsewhere from finding you, clear anything you imported, download your data, and delete your account, which removes your page, connections and uploads. After that, only your username is kept for 30 days, attached to nothing, so nobody can pretend to be you.