Privacy Policy
Last updated 2026-09-02.
Who operates Meloa
Meloa is currently run by an independent developer, not a registered company. Contact details are at the bottom of this page.
What we collect
Account details you provide (email, display name, username, bio, profile photo), the content you create (projects, progress posts, photos, comments), and the interactions you make (likes, follows, saves). Photos are re-processed on upload — original EXIF/location metadata is stripped, not stored. We also keep basic session data (like your IP address) briefly, to keep you signed in securely and to protect against abuse.
Why we collect it
Mainly because it's needed to provide the service you signed up for — your account, content, and interactions are the product. A smaller amount (session/security data, and basic product-usage statistics like how many people complete signup) is collected because we have a legitimate interest in keeping Meloa secure and working well. We don't rely on "consent" as a basis for this, beyond agreeing to these policies when you sign up — see our Terms of Service.
Age requirement
Meloa is intended for people 13 and older. We ask you to confirm this at signup; we do not independently verify age.
Where your data lives
Account and content data is stored in a PostgreSQL database hosted in the EU (Neon, EU-Central region). Photos are stored in Cloudflare R2. We chose both specifically for EU data residency.
Data sent outside the EU/EEA
A few of the companies that help us run Meloa (see "who else sees your data" below) are headquartered outside the EU/EEA, even where the specific service we use from them is EU-hosted. Where that means data could leave the EU/EEA, we rely on those providers' own data-transfer safeguards. This is an area we intend to have specifically checked as part of a future legal review.
Who else sees your data (sub-processors)
Neon (database hosting), Vercel (application hosting), Cloudflare (image storage), Sentry (error tracking, configured to exclude cookies, request bodies, and other sensitive content), PostHog (product analytics, EU-hosted — see "Product analytics" below), OpenAI (automated content moderation — see "Moderation" below), and Resend (delivering the small set of transactional emails we send — moderation report and feedback notifications) each process data on our behalf as part of running Meloa. We don't sell your data or share it with advertisers — there is no advertising on Meloa.
Cookies
We use one strictly-necessary session cookie to keep you signed in. Our product analytics (below) runs in a cookieless mode and sets no cookies of its own — it doesn't use local or session storage either. No advertising cookies are set.
Product analytics
We use PostHog, a third-party analytics provider (EU-hosted), to understand how Meloa is used and to improve it — things like which pages and features get used, and where people drop off partway through a flow like onboarding. This runs in PostHog's cookieless mode: instead of a persistent identifier stored on your device, anonymous activity is tied together using a short-lived, one-way hash of your IP address and browser that PostHog rotates daily and that we cannot reverse. Once you're signed in, this activity is linked to your account so we can see how signed-in usage looks over time. We don't use this data for advertising, and we don't share it beyond PostHog acting on our behalf. We don't record session replays (screen recordings of how you use Meloa) — we decided against it specifically because it would risk capturing more of what's on your screen than we have any business seeing, like photos you're previewing before deciding whether to post them.
Who can see what you post
Every project and post has a privacy setting you control: Public, Followers & Friends, or Private. We enforce this on every single page and query — including direct links — not just in the main app views.
Your rights
You can access, correct, or delete most of your own data directly from your account settings at any time. You can also ask us (see contact below) to correct, restrict, or export data we hold about you, or to object to how it's used. If you're in the EU/EEA, you also have the right to complain to your national data protection authority — in Denmark, that's Datatilsynet.
Deleting your account
You can delete your account at any time from Account settings. Your content becomes immediately invisible to everyone else. The underlying data is kept for 30 days (in case of a mistaken deletion or a legal obligation to retain it briefly) and then permanently and automatically erased.
Accessing or exporting your data
There is no automated self-service export yet. Contact us (see below) and we will provide a copy of your data manually.
Moderation
Before a project, update, or photo is published, its text and images are automatically screened by OpenAI's moderation service for categories like harassment, hate, sexual content, and violence. Most content is unaffected and publishes immediately. Content that looks clearly unacceptable is blocked before it's ever posted; content that's ambiguous is published but flagged for a human to review; a small number of severe categories also trigger an immediate alert to us. OpenAI processes this content solely to return a moderation result — it retains what's submitted for up to 30 days for abuse-monitoring purposes and does not use it to train its models. If this automated screening is temporarily unavailable, content still publishes rather than being held back, and is screened retroactively once it's back up. Reports from other users, and any resulting action (content removal, suspension, bans), are reviewed by a human moderator, not decided automatically. Every moderation action — automated or human — is logged internally for accountability.
Changes to this policy
We may update this policy as Meloa develops. Material changes will be reflected here with an updated date.
Contact
Questions about your data, or a request to access, correct, export, or delete it? meloasupport@gmail.com.