Privacy Policy

What We Collect

We keep data collection to the absolute minimum needed to run the platform:

• Username and display name — chosen by you during registration.
• Passkey credentials — cryptographic public keys for authentication. We never see or store your private key.
• Email address (optional) — only if you choose to add one for account recovery. We will never send marketing emails.
• Session data — IP address and user agent string for active sessions and remember-me cookies.
• Content you post — topics, comments, images, and videos you upload.
• Basic analytics — page views with anonymized data to understand how the site is used.

What We Don't Collect

• No phone numbers
• No real names (unless you choose one as your display name)
• No location data
• No third-party tracking cookies
• No advertising identifiers
• No data from other sites or services

How We Use Your Data

• Authentication — your passkey credentials verify your identity when you sign in.
• Account recovery — if you've added an email, we can send a one-time recovery link (max 1 per 24 hours).
• Rate limiting — IP addresses help prevent abuse and spam.
• Content display — your posts and comments are shown to other users.
• Site improvement — anonymized analytics help us understand what works.

What We Will Never Do

• Sell your data to anyone, ever
• Show you advertisements
• Share your information with third parties for marketing
• Send you unsolicited emails (recovery emails are the only exception, and only when you request one)
• Use your data for AI training
• Track you across other websites

Data Storage & Security

Your data is stored on our own servers. We use passkey (WebAuthn/FIDO2) authentication, which is phishing-resistant and more secure than passwords. All connections are encrypted via HTTPS. Session cookies are HTTP-only, secure, and SameSite.

Uploaded media is auto-converted to WebP format for efficiency. We do not extract or store EXIF metadata from your images.

Your Rights

• You can delete your content at any time
• You can remove your email address at any time
• You can view and manage your active sessions
• You can sign out of all devices at once

If you want your account completely removed, contact us at support@mallworld.org.

Open Source

We plan to open-source this platform so anyone can audit exactly how we handle data. Transparency isn't just a policy — it's a principle.

Changes

If we ever update this policy, we'll announce it in the News section and update the date above. We won't quietly change terms on you.

Contact

Questions or concerns? Reach us at support@mallworld.org.