Privacy Policy

Effective date: 12 October 2026

This policy explains what personal data we process, why, for how long, who else receives it and what you can do about it. It covers the Novagora apps for iOS and Android, the web app at novagora.app and our support channels (together, the "Service"), and follows the GDPR and German data protection law. The Terms of Service are the contract for using the Service, and the Cookie Notice covers storage in your browser. Settings named here are in the app or on the web under Settings.

1. Who is responsible

The controller (Art. 4(7) GDPR) is Mostafa Mollaahmadi, a natural person established in Germany who operates Novagora (see the Impressum). Elsewhere in our documents he is "we" or "the Novagora team".

For every question and request about your data, write to [email protected]. We have not appointed a data protection officer, because we are not required to, and we have no representative outside Germany.

2. In short

• We process what you give us to run your account and to show your content to the audience you chose.
• We do not sell personal data, run third-party advertising or build advertising profiles.
• Your data is stored in the EU. A few service providers, some in the United States, process parts of it for us under contracts and transfer safeguards (section 6).
• You can export your data and delete your account yourself; deletion has a 30-day grace period and then anonymises the account (section 7).
• The Service is for people aged 16 and over (section 9).
• Automated checks protect the Service against spam and abuse. They can slow an account down, ask it to prove it is a person, hold its new posts or suspend it for 24 hours. You are told why and can ask a person to review it (section 5).

3. What we process, and where it comes from

Most of it comes from you and your devices. Some comes from other members (messages, mentions, reports, profile views), from Apple and Google (purchase state) and from our providers (an approximate city derived from your IP address). You need to give the sign-up data to open an account; everything else is optional unless a feature you use needs it.

3.1 Your account

• Sign-up data: email address, a unique username, a password (stored only as a salted hash) and your date of birth, which we use only to enforce the minimum age and show to no one.
• Settings: language, appearance, notification and privacy settings, and two-factor authentication. Its secret and ten backup codes are stored encrypted.
• Verification: whether and when your email address was verified, and the single-use links and codes we send to verify it, reset a password or confirm a new address.
• Password breach check: when you set a password, the first five characters of a one-way hash of it go to a public password-breach service. The password never leaves our server, and the five characters cannot be traced to you.
• Sign-up checks: we refuse addresses at known disposable email services. An account whose address is never verified is removed after 7 days.
• Invitations: while sign-up is paused, only people our Root administrators invite can sign up. An invitation holds the address, an optional note, the email's language, its expiry, when and how often it was sent and by which administrator, and a protected link token. Once you sign up it also records when and which account it created. Anyone else is told that sign-up is paused and no account is created.

3.2 Your profile

• Public profile card: display name, username, avatar, banner, bio and follower and following counts, visible to anyone who reaches your profile, also without signing in. With Pro or Ultra you can hide the counts.
• Optional fields: location, website, pronouns and time zone, each with its own audience (everyone, followers, people you follow or nobody) and per-person exceptions.
• Interests you pick during onboarding: private, used to suggest Spaces and content.
• Private account: following you becomes a request you approve, and your posts are visible only to approved followers.

3.3 What you create

Posts, articles, comments, reactions, chat messages (channels, groups and direct messages), voice notes, events and RSVPs, tasks, notes, polls and votes, files and the media you attach. Content belongs to the audience you gave it.

Images are re-encoded and their location and camera metadata (EXIF) is always removed; the original is discarded unless you add an original photo to a chat or to Files, in which case a full-resolution copy of up to 64 MiB is kept with its metadata removed (if that fails, no copy is kept). Videos are transcoded and the original discarded. Files in a Space's file area are scanned for malware.

To trace and undo changes we keep up to three earlier versions of each article and Space note plus up to ten versions someone named, the earlier text of an edited post, and up to 20 earlier texts of an edited chat message. For most content we also record who last changed and who deleted it.

3.4 Your connections

Who you follow and who follows you, follow requests, your Spaces and roles, invitations you sent or accepted, and the people you blocked or muted. No one else sees a block, and no one at all sees a mute.

3.5 How you use the Service

• Engagement signals: what you opened, liked, commented on, read, scrolled past, hid or marked "not interested", linked to your account to rank your feed (section 5).
• Score and leaderboards: points for activity such as publishing, receiving reactions, completing tasks or signing in. Leaderboards show usernames and scores; private accounts, accounts that hide from leaderboards (Pro and Ultra) and suspended accounts are not listed.
• Presence and read receipts: whether you are online, when you were last active and whether you read a message, controlled in your settings. Read receipts are mutual unless you use the one-way mode of Pro or Ultra. Visitors who are not signed in never see presence.
• Profile views: when you are signed in and open someone's profile, we record that you viewed it. Free and Pro owners see only how many people viewed their profile and anonymised hints such as "Someone from … viewed your profile"; Ultra owners see the names of the viewers. With Pro or Ultra you can browse privately: your view is counted but your name is not shown. We never record views of your own profile or between people where one has blocked the other. We keep who viewed a profile for 30 days and daily view counts per profile for 365 days.
• Help and release note votes: when you answer whether a help article or release note was helpful, we store your answer for that page, linked to your account or, if you are not signed in, to a random device ID your browser or app creates when you first vote, which we store only as a keyed hash. You can change your vote; it never counts twice.
• Devices and sessions: for each signed-in device, its IP address, the approximate city derived from it, the browser or app version and when it was last active. You can end any session in Settings. Trusting a device for two-factor authentication is stored on it for 30 days.
• Push notifications: your device's push token, if you allow notifications.
• Weekly digest: a personal summary by email that you can turn off in Settings or with the link in each digest.

3.6 Purchases

Plans and credit packs are sold only through the Apple App Store and Google Play; Apple or Google takes the payment, and we never see card or billing details. We store your plan and its renewal state, the packs you bought, your credit balance and each movement in it, promotions you bought, and the purchase identifiers our purchase-processing provider and the store use so each purchase is fulfilled once and refunds can be handled.

3.7 Reports, moderation and safety

Reports you file and reports about you, moderation decisions and their reasons, restrictions, statements of reasons, review requests, the audit log of who did what, and records of a removal of all of an account's content. A reporter is never named to the person reported. Where a serious report opens a safety case, the content is preserved as evidence for the case even if it is deleted.

3.8 When you contact us

Emails to [email protected], with the sender address, content, attachments and our replies, kept in an internal inbox only the Novagora team can open.

3.9 Technical data

• Request data: IP address, requested page or procedure, time, status and user agent, in short-lived server logs for security and troubleshooting.
• Anonymous view counts: a signed-out view of public content is counted once per visitor for a short window, using a keyed one-way hash of IP address and user agent that we cannot reverse and discard after the window.
• Error monitoring: the apps, the web app and our servers send crash and error reports (the error, device or browser type, app version and a technical trace, without your name, email or content). In the browser this runs only with your Analytics consent.

3.10 Optional web analytics

Only if you allow Analytics in Cookie preferences, the production web app sends page views, sessions and feature events to our own analytics, which we run ourselves on our EU hosting under our own domain and which sets no cookies. It processes browser, device, screen and language information, cleaned page and referrer addresses, and your IP address to derive a session and an approximate location. Signed in, your internal user ID links visits and devices, so the data is pseudonymous, not anonymous. Sampled session replays and heatmaps show how pages are used; input is masked, and chats, note bodies, file previews, two-factor secrets, export links and member, moderation and audit lists are blocked or masked. We never send your written content, email address, search text or link tokens. The admin console and the mobile apps are not tracked. Withdrawing consent stops further collection but does not recall data already sent; ask us at [email protected] for access to or erasure of it.

Separately, our servers count subscription renewals, cancellations, billing issues and expiries reported by the app stores (with the plan and, for a renewal, the amount and currency) and send these counts to our own analytics without any user identifier, IP address or device data.

3.11 Abuse protection

To keep the Service usable we run automated checks against spam, fake accounts and automated misuse. Only our Root administrators see these records.

• Bot checks on sign-up, sign-in, password reset, changing an unverified address and the signed-out contact form, run by our network security provider using your IP address and device and connection characteristics; restricted accounts may see them before writing.
• Limits per IP address on sign-up and sign-in, and per account on writing: changes per minute and day, daily limits per kind of content and 2 GiB of uploads a day. Counters are kept under keyed pseudonyms.
• Abuse signals counted per hour, day or week: requests refused over a limit, reports, blocks and mutes from others, the same text or link sent to many audiences, many messages or follow requests without reply, machine-like pace and unused uploads; for a network range (first three parts of an IPv4 address or groups of an IPv6 address), sign-ups and failed bot checks; for an email domain outside large providers, sign-ups.
• Content checks: posts, comments and chat messages are compared with what the same account sent in the last 24 hours, using a fingerprint from which the text cannot be recovered and pseudonyms of the audience and linked domains (24 hours; whether a link domain was seen before, 90 days).
• Account clusters: keyed pseudonyms, never the values, of your normalised email inbox, your network range, your sign-up hour and network, and your devices' push tokens. Shared pseudonyms only add weight to signals an account already has; four or more accounts sharing one inbox alert an administrator.
• Trust level (restricted, new, basic, established or trusted), computed from account age, email verification, interaction with established members, recent abuse signals and clusters. It does not depend on your plan, is not shown to others and decides how much weight your blocks and mutes carry. An administrator can override it for 7, 30 or 90 days with a recorded reason.

4. Why we process it, and on what legal basis

Where we rely on legitimate interest we have weighed it against your interests, and you can object (section 8). Withdrawing consent does not affect processing before the withdrawal.

5. Automated decisions and profiling

5.1 Feed ranking

The "For You" feed is ranked by recency, reactions, comments and views, how closely you are connected to the author or Space, and whether the author promoted the content (always labelled). This profiling only decides what you see first; the "Following" feed is purely chronological.

5.2 Automatic restrictions

From the trust level and abuse signals (section 3.11) the Service decides automatically, without a person reviewing first, whether to restrict an account. The steps are:

1. Slowed down: at most 20 changes a minute and 1,000 a day.
2. Verification required: a bot check before posting, commenting or sending messages, valid for 30 minutes.
3. Content held: posts and articles from the last 72 hours and new ones are hidden from others until an administrator reviews them.
4. Suspended: for 24 hours, signed out everywhere, profile and content hidden, pending follow requests withdrawn.

An account refused over limits an extreme number of times (500 times in an hour, or 200 times in a day for daily limits) is also suspended for 24 hours.

The logic: a step is reached only when the account's own behaviour points to abuse (the same text or link sent to many audiences, unanswered messages or follow requests, machine-like pace, unused uploads). Higher steps need a higher score and several of these behaviours at once (two for verification and held content, three for suspension). Refused requests, reports and others' reactions can only support such evidence, and clusters only add weight. Signals count half after 7 days and are ignored after 30 days, so limits ease on their own; held content waits for an administrator.

We decide automatically because spam arrives faster than people can review it and the terms promise a protected Service (Art. 22(2)(a) GDPR). Each change is recorded with a statement of reasons on the Account standing page and announced in the app, and a suspension is also emailed. You can have a person review the decision, give your view and contest it (Art. 22(3) GDPR) on that page or at [email protected], also while suspended. Decisions on reports, content removal after a report and account termination are always made by people.

6. Who receives your data

6.1 Other users

What you make visible is seen by that audience. A forwarded message shows your name and its source chat unless the forwarder or your forwarding setting leaves it out. Space owners and moderators see moderation information about their Space, never a reporter's identity. Public profiles, Spaces, articles, events and notes shared by link can be reached without signing in, and search engines may index public pages.

6.2 Service providers (processors)

These providers process data only on our instructions under a data processing agreement (Art. 28 GDPR). We name the provider behind each role on request.

6.3 Independent controllers

• Apple Distribution International Ltd. and Google Commerce Ltd. sell plans and credit packs, take payment, issue receipts and handle refunds under their own privacy policies.
• Apple's and Google's push services deliver notifications to your device.
• A public password-breach service receives the hash prefix from section 3.1, which is not personal data.
• Authorities and courts where the law requires, and law enforcement and child-safety organisations in the cases the Community Guidelines describe.

6.4 Transfers outside the EEA

Your account and original content are stored in the EU; media delivery can cache copies worldwide. Where a provider in the United States or with a global network processes data, we rely on the EU–US Data Privacy Framework adequacy decision where the provider is certified, and otherwise on the EU Standard Contractual Clauses with additional measures where needed (Art. 45 and 46 GDPR). Ask us for the safeguard that applies to a provider.

7. How long we keep it

Deleting your account: in Settings, after confirming your password, once you have handed over or deleted every Space you own. Your account is hidden and signed out at once. For 30 days you can sign in and confirm "Cancel deletion"; signing in alone does not cancel it. Then the account is anonymised: email, username, name, profile, date of birth, sessions, push tokens and connections are removed, and what you posted in other people's Spaces and chats stays, attributed to a deleted user. Unused credits are forfeited. If we schedule a deletion after a serious violation, signing in does not cancel it.

8. Your rights and controls

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21), including feed ranking and abuse protection; we then continue only for compelling legitimate grounds such as other members' safety or for legal claims. You can obtain human review of an automatic restriction (Art. 22(3), section 5.2).

Most of this you can do yourself: Settings → Download your data gives you a ZIP archive of your account data and media in a machine-readable format (ask us for the abuse-protection records of section 3.11); you can edit your profile, delete content or your account, and use the "Following" feed. With Pro or Ultra you can turn on private profile viewing.

You can withdraw consent at any time (Art. 7(3)): push notifications in your device settings, the digest in Settings, and web analytics, replays, heatmaps and browser error reports in Cookie preferences.

You can complain to a supervisory authority (Art. 77), in particular in the EU country where you live or work. The authority responsible for us is the data protection authority of the German federal state where the operator is established; the Federal Commissioner for Data Protection and Freedom of Information lists them all at bfdi.bund.de.

For anything else, write to [email protected] from your account's address or tell us how to verify the account is yours. We answer within one month, or within three months for complex requests, telling you why.

9. Children

The Service is for people aged 16 and over (Art. 8 GDPR as applied in Germany). We ask for a date of birth at sign-up, refuse younger people and delete an account we learn belongs to someone under 16. Tell us at [email protected] if you believe a child is using the Service.

10. Security

Connections are encrypted in transit and data at rest; two-factor secrets are additionally encrypted, and passwords are salted hashes checked against known breaches. Uploads are scanned and re-encoded, and private media is served through short-lived links (about one minute for downloads and two minutes for video after access is removed; a download already running or content already downloaded is not affected). The admin console is reachable only by named staff through a private network and an extra identity check. Sign-in is rate-limited, and we email you about security-relevant changes. If a breach is likely to put your rights at risk, we notify the authority and you (Art. 33 and 34 GDPR).

11. Changes

We update this policy when the Service or the law changes. Each edition has a version number and an effective date. When a change matters to you, the app asks you to read and accept the new edition, and your acceptance is recorded. Earlier editions are available on request.

12. Contact

[email protected], for every question, request and complaint about personal data.