Privacy policy

This policy explains what personal information Mavuno collects, why, who can see it, where it's kept and the choices you have. Mavuno is run by Mentors Outreach ("we"). We follow the Australian Privacy Principles in the Privacy Act 1988.

Why this matters: what you share here can say a lot about you: where you live, your heritage, your faith, your visa or work situation. For people from migrant communities, that information can be used against them. So we keep as little as we can and are specific about every piece.

What we collect

When you join

• Your email address and a password, which we store only as a secure hash. Or, if you continue with Google, the name, email address and profile photo Google shares with us.
• Your name and username.
• That you confirmed you're 16 or older, and when. We ask for your date of birth to check this, but we don't keep it.

What you choose to add

• Profile details: photo, banner, bio, city, heritage, languages, interests, pronouns, work and links. Everything on your profile is public.
• Some of these, such as heritage, languages, or the faith spaces you join, can reveal your racial or ethnic origin or religious beliefs. That's sensitive information under the Privacy Act. All of it is optional, and we only collect it because you choose to add it.

What you do on Mavuno

• Posts, replies, quotes, photos and their descriptions, polls, events, opportunities, spaces, and posts you schedule for later.
• Private messages and photos you send in them.
• Who you follow, mute and block; your likes, saved posts, poll votes and event RSVPs; spaces you join; reports you make.
• Your settings: who can message you, read receipts, whether you appear in Nearby and suggestions, and your languages.

Collected automatically

• The last day you used Mavuno, so we can count how many members are active. It's never shown to anyone, and the daily totals we keep have no names attached.
• Your IP address and browser details, which our hosting provider records in sign-in and security logs.
• How the site is used (pages visited, how people arrived, device and approximate region), through Google Analytics, described below.
• The cookies and browser storage described below.

From other people

• Members can mention you, reply to you, add you to a group conversation or an organisation's team, and report your content.

Who can see what

• Public, including to people who aren't signed in and to search engines: your profile, published posts and replies, who you follow and who follows you, the spaces you've joined, events and opportunities, and your RSVP to an event.
• Only the people in the conversation: private messages. Moderators see a copy of a message only when someone in that conversation reports it.
• Not shown publicly: which posts you liked (the author may be told you liked their post), how you voted in a poll (only totals are shown, and only after you vote or the poll closes), what you saved, and who you muted or blocked.
• Only you: your email address, your settings, and posts you've scheduled until they go out.
• Moderators: reports and the content reported, posts waiting for review, and records of past moderation decisions. They can't see who made a report.

Why we use it

• To run Mavuno: show your profile and posts, deliver messages and notifications, and let you sign in.
• To suggest people, spaces and posts, using your city, interests and who you follow. You can turn suggestions off.
• To keep the community safe: review new members' posts, act on reports, stop spam and scams, and enforce the community rules.
• To send emails about your account, such as confirming your address or resetting your password. We don't send marketing email.
• To understand, in anonymous totals, whether Mavuno is working: how many people join, come back and get replies.

We don't use your information for advertising, we don't sell it, and we don't use your posts or messages to train AI models.

Decisions made automatically

Some decisions are made by rules in our software rather than by a person:

• Posts, events and opportunities from an account reported in the past week are held for a moderator to check before they're public, unless the report was dismissed. During a wave of spam we may also hold new members' posts for a while.
• Anything reported by three different people is hidden until a moderator reviews it.
• The same post shared three or more times within an hour waits for a moderator.
• Limits on how often you can post or send message requests to people you don't know, to stop spam.

A person always makes the final decision to remove content or suspend an account. If something of yours was held or hidden and you think that's wrong, email bakari@mentorsoutreach.org.

Where it's stored, and who helps us

We use a small number of service providers. Some of them are outside Australia, and we've listed the countries:

• Supabase stores our database, sign-in and uploaded photos. They're hosted on Amazon Web Services in Mumbai, India. Supabase is a US company, and its staff in the United States may access our systems to provide support.
• Vercel runs the website. Pages are prepared on its servers in Mumbai, India, next to our database, and delivered from servers around the world, including in Australia. Vercel is a US company.
• Google, in the United States, if you choose to continue with Google.
• Translation: when you press Translate, the post opens in Google Translate in your browser, which sends its text to Google. If we add a built-in translation service, we'll name it here first.
• Google Analytics, to understand how people find and use Mavuno: pages visited, how you arrived (for example from a search or a shared link), your approximate region, device and browser. Google processes this in the United States. Its advertising features and Google Signals are turned off, so it isn't used for ads or linked to your Google account. You can opt out with Google's browser add-on or by blocking cookies for mavuno.au.
• Fathom Analytics, if enabled: anonymous visit counts processed in the United States. Fathom uses no cookies and can't identify you.
• OpenAI, in the United States, only if we turn on automatic safety checks: the text and images of posts from newer members are sent to it to check for harmful content, and anything it flags waits for a moderator.
• Videos from YouTube and similar sites only load from them when you press play.

We stay responsible for how these providers handle your information. They may only use it to provide their service to us.

We may also share information when the law requires it: with eSafety when it issues a notice; with the police where someone's safety is at risk; and in reports of child sexual abuse material.

How we protect it

• Everything is encrypted in transit and stored encrypted. Passwords are hashed, never stored as written.
• Database rules decide who can read each row, so private messages and settings can't be read by other members even through our API.
• Every photo is re-encoded on our servers before it's stored, which removes the location and camera details phones attach.
• Only a small number of moderators and administrators have extra access, and their moderation actions are recorded.

If a data breach is likely to cause serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner (OAIC) as quickly as we can.

How long we keep it

• Your account and content stay until you delete them.
• A post you delete is erased once its 30-second undo has passed. Replies from other people stay, under a "deleted" placeholder.
• When you delete your account, we immediately erase your profile, posts, likes, the messages you sent, your photos and your scheduled posts. Copies in our provider's backups are overwritten when those backups expire.
• Translations we've saved are deleted after 7 days.
• We keep a record of moderation decisions (what was decided and why) so decisions stay consistent and can be reviewed.

Age

You need to be 16 or older to have a Mavuno account. If we believe an account belongs to someone under 16, we'll deactivate it and delete its information. Any information collected to check someone's age is used only for that check and then destroyed. If your account was closed by mistake, email bakari@mentorsoutreach.org.

Cookies and browser storage

• Sign-in cookies, to keep you signed in. These are necessary.
• A small cookie that records the day you were last counted as active, so it happens at most once a day.
• While you sign up, your date of birth is kept in a cookie for up to 30 minutes, so the age check works when you continue with Google. It's deleted as soon as your account is created. If you tell us you're under 16, a cookie without any personal details stops that browser signing up again for 24 hours.
• Your theme, and drafts of posts you haven't finished, are kept in your own browser. Drafts are cleared when you sign out.
• Google Analytics cookies (names starting with _ga), which count visits to mavuno.au. They're set for this site only and last up to two years.

We don't use advertising cookies or track you across other sites.

Your choices and rights

• Get a copy of everything we hold about you from Settings → Account.
• Correct your profile at any time in Settings. For anything you can't change yourself, email us.
• Delete your account from Settings → Account.
• Limit who reaches you: turn off Nearby and suggestions and choose who can message you in Settings → Privacy. Mute or block anyone.
• You can use Mavuno under a name that isn't your legal name, as long as you're not pretending to be someone else.

For any privacy request, email bakari@mentorsoutreach.org. It's free, and we'll reply within 30 days.

Complaints

If you're unhappy with how we've handled your information, email bakari@mentorsoutreach.org and we'll respond within 30 days. If you're not satisfied with our answer, you can complain to the OAIC on 1300 363 992.

Changes to this policy

When we make a significant change, we'll update the date at the top and let you know in Mavuno before it takes effect.