Privacy Policy
Effective and last updated October 15, 2026
The short version
- We collect as little as we can get away with.
- No ad trackers. No third-party cookies. No selling your data.
- We strip the location data out of your photos on upload.
- Ask us and we'll delete your account and everything in it.
If you read nothing else, read that.
Who we are
Mudbath is run by Leah Rosenburg, 4575 Applecrest Circle, Castle Rock, CO 80109. Privacy questions: contact@mudbath.app.
What we collect
| What | Why |
|---|---|
| Username and display name | So people can tell you apart |
| Email address | Telling you you're approved, and password resets |
| Password hash | Login. We never see your actual password |
| Date of birth | Keeping out under-13s, and the teen protections below |
| The note you send when you ask to join | So a moderator can decide on your request |
| Your bio, profile photo and banner | Your profile |
| Posts, replies and photos | The whole point |
| Messages and group chats | Delivering them to the people in the chat |
| Follows, likes, bookmarks, blocks, mutes and settings | Making the site work the way you set it up |
| Reports you file, and moderation records | Moderation |
| IP address and browser type when you log in | Security: spotting attempts to break into accounts |
| Timestamps and basic activity | Ordering the feed, showing you new posts |
What we deliberately don't collect
- Location data from your photos. We strip EXIF on upload, including GPS. Your camera roll knows where you live; Mudbath doesn't.
- Third-party ad tracking. No pixels, no ad networks, no cross-site profiles.
- Phone numbers. We never ask for one.
- Real names. Unless you use one.
Cookies
We use two cookies: one keeps you logged in, and one protects our forms from being submitted by other sites. That's it.
We don't use third-party cookies, and we don't track your visits. Cloudflare, which carries our traffic, may set a short-lived security cookie to filter out bots.
Because there's nothing to opt out of, Do Not Track and Global Privacy Control are moot here. We honour them by default.
Who can see what
- Posts: other approved members. If your account is private, only the followers you approve. Nothing on Mudbath is visible to the public web.
- Messages: the people in the chat. Messages are not end-to-end encrypted, so whoever runs the server can technically read them. We only look when we have to: a report, a legal request, or keeping the site running.
- Moderators: your email address, age and sign-up note when you ask to join, and anything that's reported, including a reported message.
Who we share it with
We don't sell your data. We share it only with the services that make the site run:
- Hosting: DigitalOcean (our server, which holds the database, photos and backups)
- Traffic and DNS: Cloudflare (pages pass through it on the way to you)
- Email delivery: Postmark
Each of those only sees what it needs to. If we ever add a provider, we'll list it here.
We may also disclose data if the law requires it, such as a court order or reporting child sexual abuse material to the National Center for Missing & Exploited Children. And we may share what's needed to protect someone, including contacting emergency services if we believe a member's life is in danger.
How long we keep it
- Account and posts: until you delete them, or ask us to delete your account.
- A deleted post: gone from the site straight away, and its photos are erased. Its text stays in our database, out of sight, until your account is deleted.
- An unsent message: its text and photos are erased, unless it was reported first.
- A deleted account: gone from the live site straight away, and its photos are wiped from our server within a day. Copies linger in backups for up to 30 days.
- Login records (IP address and browser): 90 days.
- The moderation log (what moderators did and why): kept, so moderators can see what happened before.
Your choices
See it. Your profile and Settings show what we have.
Fix it. Change your display name, bio, photos and settings in Settings. To fix your username, email or birthday, ask us or a moderator.
Delete it. Delete posts and unsend messages any time. To delete your whole account, email contact@mudbath.app. It's real deletion, not a deactivation, and it can't be undone, so back up first.
Ask. Email us and we'll tell you what we hold and where it came from. We'll answer within 30 days.
Complain. Tell us first. We'll try to fix it.
Children and teens
Mudbath is for 13 and up. We take your word for your age rather than verify it. If we learn an account belongs to someone under 13, we suspend it and delete it.
Under 15, your account stays private, your birthday is never shown, and you aren't suggested to adults to follow. Under 18, adults can only message you if you follow each other, and content warnings stay on.
A parent or guardian can ask to see what we hold about their child, ask for changes, or ask for deletion: same email, same process.
Security
Passwords are hashed. Traffic is encrypted. Our server is access-controlled. Your photos are only served to logged-in members allowed to see them.
We're a small operation, so we won't promise perfection. If something goes wrong we'll tell you.
Where your data lives
Our providers are US companies, and our server is in the United States.
Mudbath is a US service. If you use it from elsewhere, you're using a US service on your own initiative, and you accept that it's built around US rules rather than your local ones.
Changes
We'll update the date at the top and post a note when this changes. Continued use means you accept the update.
Contact
For copyright, see the Copyright page. That goes to our designated agent, which is a different process. The Terms of Service cover the rest.