Privacy policy

The short version

• We keep as little about you as the app needs, for as short a time as it needs it.
• We do not sell your information, show you advertising, or use what you share for anyone else's benefit.
• Only the people you are mutually connected with can see what you share; the founders see only what someone reports. Nothing on My100 is public, and nobody can search for you.
• What you share expires on a schedule you control, and you can delete your account, and everything of yours with it, at any time.

Ethereal Data Policy

Our intention is simple: hold the minimum of personal information, keep it for the minimum time, and then let it go. Information that no longer exists cannot be exposed, and the less we hold about you, the better protected you are. In practice:

• We collect only what the app needs to work: an email address to sign you in, a display name, a password if you choose to set one (kept only in scrambled form), your settings, and whatever you choose to add to your profile.
• What you share (posts, pictures, messages and reactions) is kept only until it expires, at most 100 days: posts on the schedule you set, and messages on the shorter of the two schedules the two people in a conversation set. Expired content is permanently removed. Each picture is kept with a small copy of itself that loads faster, and the two go together.
• A picture you pin as the header of a connection is a copy of one of your own pictures, and only you see it. It does not expire: it is kept until you unpin it, one of you disconnects, or either account is erased.
• Records of who you are connected with are kept while you are connected. An invitation is kept until it has done its job, expires or is cancelled. The counts behind your relationship scores are kept for no more than 100 days.
• Who invited you to My100, and when, is kept for as long as your account exists, so that abuse can be traced. No member ever sees it.
• A block is kept until the person who made it undoes it, or until either account is erased. The person blocked is never told of it.
• An account whose email address is never confirmed is removed, with everything in it, 7 days after it was made.
• We record that you confirmed you are 18 or over, when, and how. The date of birth you enter is checked and then discarded: it is never stored.
• The ordinary technical records that every online service produces, such as connection and error logs, are kept briefly for security and reliability and then removed. When you send us feedback or a report, what you write and your display name reach us and stay with us for as long as we need them to act on it.
• Routine backups are taken once a day so that we can recover from a failure, and they are used for nothing else. We keep one from each of the last 7 days, the last 4 weeks and the last 6 months, so something deleted, an erased account included, can remain in a backup for up to about six months before that backup is discarded.
• We do not build profiles of you, follow you across other sites, or use what you share to train artificial intelligence.

When you no longer need something, neither do we: expired content, read notifications and lapsed invitations are removed automatically. A notification nobody reads goes after 100 days. A connection request nobody answers lapses after 30 days, and both people are told. Sign-in links and sessions are deleted once they expire. A link preview card goes once nothing shows it, and 100 days after it was fetched at the latest.

What we never do

The five things My100 was built to refuse:

1. No advertising. We never sell attention, feed placement or data.
2. No influencers. There are no followers, no audiences and no public profiles.
3. No bots. My100 is for people, and there is no public API.
4. No algorithms. Your feed is your connections' posts in the order they were written.
5. No data harvesting. We do not mine your posts, sell access to them or use them to train AI, and everything expires.

Who can see what

• Your posts are shown only to the people you were connected with when you posted. Someone you connect with later never sees your older posts.
• A picture in a post or a message is served only to the people who may see that post or message.
• Your full profile is for your mutual connections. Your name, picture and tagline, and your total score, are also shown to people who might know you: the connections of your connections (on their Suggested list), anyone you send a request to, and anyone who opens an invitation you sent.
• People you might know are suggested through the connections you share, and each suggestion names the connection you share. You appear on their lists the same way.
• Your reactions are private: on someone else's post, only you and they see yours; on your own post, you see everyone's.
• Nobody can search for you. There is no directory.
• If someone reports a post, a picture, a message or a person, an automated reviewer may read what was reported, and the founders who run My100 see it, so they can act on it. They see only what was reported, never the rest of a conversation.
• The founders also have pages of their own for running My100. Apart from reports, these show only accounts and counts, such as a member's name, email address, when they joined and how many connections they have, never what anyone shares. Your choice to show or hide your email address is for your connections: the founders' pages always show it. Every action a founder takes there is recorded.
• Providers who help us run My100 (such as delivering email) may handle information on our behalf, only as needed to provide that service and only under our instructions. They never get to use your information for their own purposes.
• Pictures in link previews, the small icons of the sites they come from, and GIFs are fetched by My100 and kept on our server for up to 100 days. Your browser loads them from us, so the sites that host them never see who is looking.
• We may disclose information where the law requires it, or to protect the rights, safety or property of the people on My100 or of 4D4 Labs.

Your choices

• You can see and change your profile and your settings, including how long your posts and messages live, at any time.
• You can disconnect from anyone. Your conversation with them and each other's posts go at once, for both of you, and so do the reactions you left on each other's posts. They get a single notice that you left.
• You can delete your account at any time: open your Profile, scroll to the very bottom and tap Delete your account. You will be asked to type the word delete first, so a stray tap changes nothing. Everything of yours is removed at once and for good, and your email address is free to use again. This cannot be undone. The people you were connected with lose their conversations with you, their own messages included, and the SP you earned together, and each of them gets a single notice that you left.
• If we close an account, we keep a one-way hash of its email address (never the address itself) for 30 days, only so that address cannot join again in that time.
• When you change your email address, we keep the old address for 7 days, only so the link we send there can put it back if you did not make the change. Then it is deleted. If you lose your email address and ask us for help, we send one sign-in link to the new address you give us; our record of that keeps a one-way hash of the address, never the address itself, for 100 days.
• Three things sit outside your account: an invitation someone else sent to your address that was never used (it stays with the sender until it expires), any feedback or report you sent us, and the brief technical records and backups above, which age out on their own.
• Depending on where you live, you may have further rights over your information. If you ask, we will honor them as the law requires: write to hello@my100.org.

Email

We send email to run the service: sign-in links, the invitations you send, and notices about your account. Mail comes from the my100.org domain, and replies reach us.

When your email address changes, the old address gets a notice with a link that undoes the change for 7 days. If a founder sent you a recovery login link in the 7 days before, that notice carries no undo link and says to write to hello@my100.org instead. If a founder sends you a recovery login link, any undo link already sent to the old address stops working.

If you ask never to get an invitation email from My100, we keep a one-way hash of your address (never the address itself) for good, so that none reaches it again.

Push notifications

If you turn on notifications on a phone or computer, we keep the address your browser gives us for sending them to that device, and delete it when you turn them off, when you sign that device out from another one or end all your sessions, or when you delete your account. Each notification travels sealed through the push service your browser uses, which learns that something arrived for that device, never what it says.

Cookies

Only what signing in needs: a cookie that keeps you signed in, and one that remembers you when you ask us to. No advertising or tracking cookies.

Security

We protect your information with reasonable technical and organizational measures, and our Ethereal Data Policy means there is little to protect for long. No online service can promise perfect security. If we learn of a breach that affects you, we will tell you.

Age

My100 is for people 18 and over. We do not knowingly collect information from anyone under 18, and the join form turns away a date of birth under 18. An existing account that answers the age question under 18 stays locked behind that question, and the founders are told. To have such an account deleted, write to hello@my100.org.

Where information is handled

4D4 Labs is based in the United States. Your information may be handled there and in other countries where we or our providers operate, always under this policy.

If My100 changes hands

If 4D4 Labs merges with or is acquired by another organization, or My100 is transferred, your information may move with it. This policy keeps applying to it until it is replaced, with notice to you.

Changes and questions

This policy may change as My100 grows. When it does, the date at the top changes with it, and a short notice in the app tells you. Questions about this policy, or about your information, can reach us through the app, by replying to any email from My100, or at hello@my100.org. Data requests and legal notices go to that address too. The rules for using My100 are on the terms page.