Privacy Policy

Account data: your email address, full name, handle, and — if you add them — a bio, an avatar image, and the grammatical-gender preference used to word reviews about you.

Content you create: reviews, ratings, trait tags, relationship labels, comments, photos, follows, likes, and review requests.

Technical data: log records (IP address, browser, timestamps) generated when you use the service, and a small amount of data from our anti-abuse check (hCaptcha) at sign-up and sign-in.

We do not ask for or store payment data, government IDs, or precise location.

We use only strictly necessary cookies: a session cookie that keeps you signed in, and a cookie that remembers your language choice. We don't use advertising or third-party analytics cookies.

To run your account and provide the service — legal basis: performance of a contract with you.

To word reviews correctly (gender preference), and to remember your language — legal basis: your consent, which you can change any time in Settings.

To keep MailMan safe: prevent duplicate accounts, spam, and abuse, and moderate reported content — legal basis: our legitimate interest in a safe service and compliance with the law.

By default your profile is public: your name, handle, bio, avatar, average rating, review count, follower count and trait tallies can be seen by anyone, including people without a MailMan account. The full text of individual reviews is visible only to signed-in members. The site is not currently indexed by search engines.

You can make your account private in Settings. Then your rating, review count, trait tallies and portrait are visible only to you and to followers you have approved; your name, handle, bio and avatar stay public.

Reviews still in the 24-hour window, or declined, are visible only to the reviewer and the person reviewed.

Reviews you write about other people appear on their profile and follow that profile's visibility, not yours.

Your email address is never shown to anyone.

We use service providers to operate MailMan: Supabase (database, authentication, and file storage), Vercel (application hosting), and Resend (account emails). hCaptcha (Intuition Machines) processes a bot-detection signal at sign-up and sign-in. Vercel Web Analytics counts visits in aggregate, without cookies, and does not identify you individually.

These providers act on our instructions and only to provide their service. We do not sell your personal data and we do not share it for advertising.

We may disclose data if required by law or a valid legal order.

Your profile's Portrait is assembled automatically, but deterministically: it only counts the tags people chose and quotes lines from reviews they wrote. There is no automated decision that produces legal effects on you or significantly affects your interests (LGPD art. 20). You can hide the Portrait at any time.

Our providers may process data on servers outside Brazil. Where that happens, we rely on the LGPD's provisions for international transfer and choose providers that offer an adequate level of protection.

Account and content data is kept while your account exists. When you delete your account, your profile, reviews, comments, likes, and requests are erased, usually within a few days.

Limited technical logs may be kept for up to 6 months after that for security and to meet legal obligations (the Marco Civil requires application providers to keep access logs for 6 months), then deleted or anonymised.

You can ask us to: confirm we process your data and give you access to it; correct incomplete or wrong data; anonymise or delete data; give you your data in a portable form; tell you who we've shared it with; and withdraw consent.

You can do the main ones yourself: “Download my data” and “Delete account” are in Settings, and profile fields are editable there. For anything else, email mailman.contato@gmail.com and we'll respond within the LGPD's timeframes (immediately or within 15 days for access requests).

If you're not satisfied, you can complain to the ANPD (Autoridade Nacional de Proteção de Dados).

Access to data is protected by row-level security rules, encrypted connections, and scoped credentials. No system is perfectly secure, but we work to protect your data and will notify you and the ANPD of a breach where the law requires.

MailMan is not for anyone under 18. We don't knowingly collect data from them. If you believe a minor has an account, email mailman.contato@gmail.com.

We may update this policy. Significant changes will be signalled in the app. The “last updated” date above always reflects the current version.