Privacy Policy

Last updated: September 2026

1. What We Collect

Meutch collects only the information you choose to provide when using the platform: your name, email address, and your approximate location (stored as latitude and longitude). If you provide a street address during registration, we use it only to look up coordinates and then discard it.

We also store the content you create: items you list, messages you send, circles you join, and feedback you give. This is the data needed to make the platform work.

2. Cookies

Meutch uses only two cookies, both essential for logging in:

  • Session cookie — keeps you logged in during your visit. Expires when you close your browser.
  • Remember-me cookie — an optional cookie set only if you check "Remember this device for 30 days" when logging in. Lets you stay logged in between visits.

Both cookies are secured (HttpOnly, SameSite=Lax, and transmitted over HTTPS). We do not use any tracking cookies, advertising cookies, or analytics cookies.

3. What We Don't Do

  • We do not share your data with any third party. No advertisers, no data brokers, no one.
  • We do not use any third-party tracking or analytics services. We do keep our own record of activity on the site, described in section 4.
  • We do not send marketing emails. The only emails you may receive are account-related (confirmation, password reset) and optional digest summaries of activity in your circles. Meutch may also send site-related update emails.
  • We do not monetize your data. Meutch is a nonprofit, volunteer-run project.

4. Activity Log

Meutch keeps its own log of things that happen on the site, so that we can answer questions like "why can't I sign in?" and so that we can tell whether someone is trying to break into an account. Log entries record what happened, when, which account it involved, the IP address the request came from, and the browser or app that made it. An entry can also include details about the event itself, such as what was typed into a form or what a setting was before you changed it.

Activity log entries are deleted after 90 days. They are never shared with anyone outside the project, and they do not contain the contents of your messages.

5. Account Deletion

When you delete your account:

  • Your profile is anonymized — your email address is replaced and your name is removed.
  • Your items are removed, unless one of your items is currently on loan to another user. In that case, the item stays in the system until the loan ends, so the borrower's history is preserved.
  • Any pending loan requests you sent or received are canceled.
  • Your circle memberships are removed.
  • Messages you sent remain in the conversations of the recipients, to preserve their message history. However, your name is no longer associated with those messages.
  • Activity log entries about the account, including IP addresses, are kept for up to 90 days after deletion and are then deleted along with everything else in the log. We do not erase them immediately: a deletion is sometimes the last step of an account takeover, and that window is exactly when we would need to see it.

6. Data Security

We take reasonable measures to protect your data, including encrypting passwords (using industry-standard hashing), requiring HTTPS for all connections, and securing our servers. However, no online service can guarantee absolute security.

7. API Access

If you use the Meutch API, authentication is handled through JSON Web Tokens (JWT) sent via HTTP headers. No browser cookies are used for API access.

8. Questions?

Meutch is open source. You can review the code, report issues, or ask questions on our GitHub issue tracker.