Last updated August 20, 2024

This privacy policy describes how sub.club ("we", "us") collects, protects and uses the personally identifiable information you may provide through the sub.club website or its API or through third party clients. The policy also describes the choices available to you regarding our use of your personal information and how you can access and update this information. This policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

What information do we collect?

• Basic account information: If you register on the sub.club server, you may be asked to enter a username, an e-mail address and a password. You may also enter additional profile information such as a display name and biography, and upload a profile picture and header image. The username, display name, biography, profile picture and header image are always listed publicly.
• Posts, following and other public information: If you’re a Creator on sub.club, the display names and Mastodon account name of the people who follow your feed or are subscribers will be available to us. When you submit a message, the date and time is stored as well as the application you submitted the message from. Messages may contain media attachments, such as pictures and videos. Public and unlisted posts are available publicly. Your posts are delivered to your followers, in some cases it means they are delivered to different servers and copies are stored there. When you delete posts, this is likewise delivered to your followers. The action of reblogging or favouriting another post is always public.
• Direct and followers-only posts: All posts by sub.club users are stored and processed on the server. Followers-only posts are delivered to your followers and users who are mentioned in them, and direct posts are delivered only to users mentioned in them. In some cases it means they are delivered to different servers and copies are stored there. We make a good faith effort to limit the access to those posts only to authorized persons, but other servers may fail to do so. Therefore it's important to review servers your followers belong to. You may toggle an option to approve and reject new followers manually in the settings. Please keep in mind that the operators of the server and any receiving server may view such messages, and that recipients may screenshot, copy or otherwise re-share them. Do not share any sensitive information over Mastodon or ActivityPub.
• IPs and other metadata: When you log in to sub.club, we may record the IP address you log in from, as well as the name of your browser application. All the logged in sessions are available for your review and revocation in the settings. The latest IP address used is stored for up to 12 months. We also may retain server logs which include the IP address of every request to our server.

What do we use your information for?

Any of the information we collect from you may be used in the following ways:

• To provide the core functionality of sub.club. For example, you post to sub.club by sending a direct message from your public Mastodon account to your sub.club account. Before posting to sub.club, we verify that the direct message originated from the associated Mastodon account.
• To aid moderation of the community, for example comparing your IP address with other known ones to determine ban evasion or other violations.
• The email address you provide may be used to send you information, notifications about other people interacting with your content or sending you messages, and to respond to inquiries, and/or other requests or questions.
• To personalize your sub.club user experience.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information when you enter, submit, or access your personal information. Among other things, your browser session, as well as the traffic between your applications and the API, are secured with SSL, and your password is hashed using a strong one-way algorithm. You may enable two-factor authentication to further secure access to your account.

What is our data retention policy?

We will make a good faith effort to:

• Retain server logs containing the IP address of all requests to this server, in so far as such logs are kept, no more than 90 days.