Who is responsible for my data on meinpublic?

Tien Doan, an individual in Hue City, Vietnam, is responsible for members' data on meinpublic. Write to hello@meinpublic.com about anything to do with your data; he reads every message.

Does meinpublic sell my data or show ads?

No. meinpublic never sells your data, never shows ads and has no tracking cookies. It is paid for by members: keeping a map costs $5 a month or $50 a year.

How do I delete my meinpublic account, and how long does it take?

In Settings, choose Delete my account and confirm once. Your map is hidden and your sessions end at once, everything is erased from the database and photo storage within the hour except your old handles, a deletion record and the bounce lists (see What stays), and the last encrypted backup holding it is gone within 29 days and 1 hour, since the nightly backups are kept 28 days and then deleted within a day.

Can I download everything I wrote on meinpublic?

Yes. In Settings, Export my data gives you a ZIP file: a JSON file of everything you wrote, and your photos and the logos you uploaded. The download link works for 24 hours, and the file is deleted within the hour after.

meinpublic Privacy Policy: What We Keep, Why, and for How Long

This is the meinpublic privacy policy: what meinpublic keeps about you, why, who helps run it, how long it is kept, and how to take it with you or delete it. meinpublic never sells your data and never shows ads.

Who is responsible for your data

Tien Doan, an individual in Hue City, Vietnam, is responsible for your data on meinpublic: in the law's words, he is its controller. Write to hello@meinpublic.com about anything on this page; he reads every message.

If a company is registered to take payments, this page will name it, and members are told by email before it takes over.

What we collect and why

meinpublic keeps only what it needs to sign you in, show your map the way you set it, and send you what you asked for.

What	Why	How long
Your email address	To sign you in, and to send what you asked for: sign-in emails, the Monday letter, the weekly digest, and a note if one of your updates, replies or answers is hidden.	While your account exists.
Your name, handle, language, theme, time zone, the default for new nodes, how often the Monday letter comes, whether the weekly digest comes, and the kinds of making you picked (readers)	To show your map, to send things in your language at your hour, and to choose what the directory shows you first.	While your account exists.
Your map's profile: your initials, one-line bio, place, the date you started in public, and the founding mark	To show your map.	While your account exists.
If you take a founding place: the day your free founding year ends, and when we told you it was coming	So you know when it ends, and so we can tell you a month before, once.	While your account exists.
If you pay for a plan: where you pay (the App Store, Google Play or Paddle), the plan, its state, when it renews, ends or first charges, whether you had a trial, and Paddle's ids for it, or for a store plan the store's product with your account id	So writing works on every device while you pay, and so you can manage or cancel it. Your plans are in your export.	While your account exists; erased with it within the hour. Before that erase, a plan paid through Paddle is cancelled, ending at once rather than at the end of its period (Paddle keeps its own records of the payment, as the seller), and your purchase records are removed from RevenueCat; a plan bought in the App Store or Google Play is cancelled by you, in the store, since we can't cancel it for you.
If the founding places are full when you accept: that you want to hear when the Builder plan opens	To tell you when you can keep your map.	Until we tell you the Builder plan is open, until you become a builder, or until you delete your account: erased with it within the hour.
If you join through a personal invite: which invite you used, and the note that came with it	So the invite works once, and so the place it held is yours.	Erased with your account within the hour.
What you write and post: areas, nodes, moons, updates, photos, links, the "because" you give, and replies. Each update keeps when it was written and when it was last edited, and each sealed node when you saw it open	To show it the way you set each node (see "What is public").	While your account exists. An update you delete is deleted at once; its photo is deleted from storage within the hour. A node you delete is hidden at once, from you too, and erased with its updates and their photos within the hour. A reply you delete, or that the update's owner deletes, is deleted at once.
Your asks: the node each one is on, the question and its context, who sees the question (members watching the node, members you pick, or all members) and who sees the answers, the members you picked, which answers you marked "This helped" and published with your decision, which update was each one's decision, and when each was asked and closed	To show your question to the members you chose, never on the public web. Who sees it is checked again every time it is read: a member who stops watching, a member you stop watching, and anyone either of you has blocked no longer see it. "This helped" is a mark only you see; the first time you mark an answer, its writer gets one ask credit, and taking the mark off takes nothing back. An ask closes when you post your decision, delete its node, or the node is no longer in progress or live. Your decision is an update on the node, citing the members you say helped; if you chose to publish the answers with it, the answers you pick show under it with their writer's name. Your asks, the answers you marked and published, and which update was each one's decision, are in your export.	While your account exists. An ask on a node you delete is hidden with the node at once and erased with it, and its answers, within the hour. If someone picks you for their ask, that goes when either account is erased.
Your answers to other members' asks	Read by the asker, and by the others who answered when the asker chose that. When the asker chose to publish the answers with their decision, they may show yours under it, with your name, to whoever can see that node, on the web too if the node is public, for as long as your answer, your account and the decision exist; otherwise never public. You can edit an answer while the ask is open. No one but the asker sees whether they marked it as helped. An answer Tiến hides after a report is seen only by you, and you're told why. Your answers are in your export.	Until you delete your account, or the asker deletes the node or their account: erased with it within the hour.
Your ask credits: each month's ask, the credits you earned, and when each was used or expired	So you can ask once a month (an unused month's ask expires at its end, in your time zone), plus once for each answer of yours someone marks as helped, which lasts six months. Credits are never sold or bought, and only you see them. Your credits are in your export.	While your account exists, never changed or removed, even when the node of an ask you answered is deleted; erased with your account within the hour.
The three things you name when you start your map (what you made, what you're making and who you're becoming), with the "because" you give each and the date a sealed one opens, kept before you keep a map	So you can start your map later without typing them again. No one else sees them, and they are in your export.	Until they become your first nodes, or until you delete your account: erased with it within the hour.
Each photo you upload, and the logo and screenshot of a node's link: the image, its size, width, height and file type, and which update or node shows it	To show it the way you set its node (see "What is public"). When you upload a photo we check its size, file type and dimensions, and a photo that still carries its location is refused and deleted when it's checked. We keep up to three smaller copies of each photo, made the first time it's shown at each size and kept as long as the photo is. A members-only or sealed update's photo is shown only through links that expire within 15 minutes. When you set a node's link, Cloudflare's browser visits the linked site from Cloudflare's network, not from your device, to take its screenshot, and its icon is fetched to stand as the node's logo until you upload your own; an address inside a private network is never visited. Your photos and the logos you upload are in your export; a link's screenshot and icon are not, since they are copies of a public page.	While your account exists. A photo you remove from an update, or whose update or node you delete, is deleted within the hour. An upload you never post is deleted after a day (an unfinished one after an hour). A link's screenshot is taken again weekly while its node is live; a screenshot or default logo is deleted within the hour after the link changes or is removed, or the node is deleted. A request to take a link's screenshot that failed every try (the node's id, your account's id and the link) is kept 1 day on Cloudflare's free plan, which meinpublic is on now, and at most 14 days on its paid plan. Erased with your account within the hour.
If you allow notifications on a phone: its push address, the phone's system, and when it was registered	To send the notifications you chose (updates from what you watch, and answers to your asks), at most one an hour. Each kind can be turned off in Settings. We also keep when your last notification went, and which updates and answers to your asks wait for the next one (a day at most), to hold them to one an hour.	Until you sign out on that phone, turn notifications off, or the phone stops accepting them; erased with your account within the hour.
Who and what you watch	To fill your inbox with their updates. The people you watch see how many people watch them, never who; if you're a reader, your public profile lists the people and public nodes you watch.	Until you unwatch, until a block between you, or until either account is erased.
Who you have blocked	So they can't watch you, reply to you, answer your asks or see your members-only nodes. They aren't told, and it isn't in their export.	Until you unblock them, or until either account is erased.
What you report: which update, reply or answer, the reason you choose, and when	So Tiến can look at it within a day. The member who posted it isn't told who reported it, and it isn't in their export. Each report is emailed to Tiến at hello@meinpublic.com, with the update, reply or answer (an answer with the question it answers) and your handle.	Until the update, reply or answer is deleted, or until you delete your account: erased with it within the hour. The email stays in Tiến's mailbox until he deletes it.
Your Monday letters: the facts from your map each was written from (titles, states, dates, your words and "because"s), the draft, Tien Doan's edits, and whether it was approved, held or sent	To write each letter and let Tien Doan read it before it's sent: every letter at first, then a sample each week, and every Vietnamese letter. Then to send it by email on Monday at 7:00 in your time zone, with a picture of your public map as it stood that week.	While your account exists.
Your answers to a letter's question: which answer you confirmed, when, and the update it posted to your map, marked as from the letter	To post it, and to count, as a number only, how many letters are answered each week.	While your account exists.
When you last opened the app (only the latest time)	To send the weekly digest only to members who didn't open the app that week.	While your account exists.
Your weekly digests: the week, whether one was sent or why not, and when	To send at most one a week. What it showed is read from what you watch, and what came to you, when it's sent, and not kept.	While your account exists.
The AI assistants you connect to your map (Claude, or another that speaks MCP): the name each one gave itself, what you allowed it (reading your map, and posting updates), when you connected it and when it last called. With each connection, Cloudflare keeps its sign-in record, and the codes and tokens the assistant uses, stored only as fingerprints that can't be turned back into them	So an assistant you connect can read your map and, if you allowed it, post the updates you ask it to, each marked with the assistant's name ("via" that name) on your timeline, with a photo from a web address when you ask for one: our server fetches it (the site that holds it sees our server, not you) and keeps it like a photo you upload, refusing any that still carries where it was taken; and so you can see each one in Settings and disconnect it, which stops it at once: every call checks that the connection still exists and that you are a builder. Your connections are in your export. What a connected assistant receives, each time it asks: your whole map, members-only nodes, still-sealed nodes' contents and updates hidden by moderation included, with your titles, "because"s and words, and photos by their description only; the results of searching your updates; and other members' maps as you see them signed in, never what their sealed nodes hold. All of it goes to the assistant you connected, which keeps and uses it under its own terms, not ours.	Until you disconnect it, or until you delete your account: erased with it within the hour, sign-in records included. A connection that isn't used for 90 days stops working. An assistant's own registration (the name it gave and where it signs in) isn't tied to you, and expires 90 days after it was last used.
Each sign-in session: its IP address and device (the browser or app)	So you can end your sign-ins in Settings (Sign out everywhere), and so misuse can be spotted. Your sessions are listed in your export.	Until the session ends: 60 days after you last used it, or when you sign out. Deleted within the hour after it ends.
The email address and IP address behind each sign-in or email-change email (an IPv6 address is kept as its first half, the /64)	To count these emails against the hourly limits that stop abuse.	1 hour, then deleted.
Your device's language and time zone when you ask to sign in, and both addresses while you change your email	To set up a new account in your language, and to finish an email change.	15 minutes, then deleted within the hour.
An email that couldn't be sent after 6 tries: its address, and the link and code it held, which stop working 15 minutes after they were made	To find out what went wrong.	1 day on Cloudflare's free plan, which meinpublic is on now; at most 14 days on its paid plan, as Cloudflare's Queues limits, linked here, state.
Addresses that bounced, or marked a meinpublic email as spam. Amazon SES keeps its own list of them too, for the same purpose, and mails each bounce report to hello@meinpublic.com, where it stays in our mailbox	So nothing is sent to them again.	Until you write to us to lift it, from both lists.
The check on the web sign-in form (Cloudflare Turnstile)	To make sure a person, not a bot, is signing in. Cloudflare reads signals such as your IP address, browser and TLS fingerprint, only to detect and block bots, not to identify, profile or target you.	As Cloudflare's Turnstile privacy addendum, linked here, sets out.
Request logs (Cloudflare Workers Logs)	To find faults: the address of each request to the API, which can include a used one-time sign-in or export link, its answer, the related details Cloudflare records, and a line for each failure.	3 days on Cloudflare's free plan, which meinpublic is on now; 7 days on its paid plan.
Error reports (Sentry)	To find and fix what broke. Before a report is sent, the request's headers, cookies, body, query string and user are removed, and email addresses and keys are taken out of its text. A report from the iOS or Android app also carries the phone's model and maker, its operating system and version, the app's version and build, and which update it runs; never the phone's name or your account. A report from app.meinpublic.com carries the app's version and the page's address, without its query string.	30 days on Sentry's free plan; up to 90 days on its paid plan, as Sentry's pricing page, linked here, states.
Visits to meinpublic.com (Cloudflare Web Analytics)	To count visits. It uses no cookies or local storage, doesn't fingerprint you by your IP address or browser, and doesn't log query strings.	Cloudflare keeps the full data 7 days, then a summary of about a tenth of it; reports cover the last 6 months, as its Web Analytics FAQ states.
How many people reach each step of getting started, each day: opening the builder, naming three things, giving an email, taking a founding place, and a reader choosing interests	To see whether getting started works. Each is one total per step per day (UTC): no account, device, IP address or anything else about who is kept with it.	As long as meinpublic runs: they are totals that name no one.
One sign-in cookie, for meinpublic.com and app.meinpublic.com	To keep you signed in on the app and on public maps. In the iOS and Android apps, the same sign-in is kept in the phone's secure storage instead. There are no advertising or tracking cookies.	Until the session ends: 60 days after you last used it, or when you sign out.

The email form on meinpublic.com stores nothing itself. meinpublic never sees your card: in the apps Apple or Google sells the plan, and on the web Paddle does, and each takes the payment and keeps its own records of it under its own policy.

What is public

You choose who sees each node, every time:

Public, the default: anyone, on the open web at meinpublic.com followed by your handle, including search engines and AI assistants. Being found is the point of a public map.
Members only: signed-in members.
Sealed: everyone sees a shape and the date you set, nothing else. On that date it opens.

Asks are never on the public web. You choose who sees each question (members watching the node, members you pick, or all members) and who sees the answers. Whoever can see a node with an open ask sees "Has an open ask" on it, and nothing of the question or its answers. Your decision is an update on the node, with the members it cites; if you chose "published with the decision", the answers you pick show under it with their writer's name, for as long as the answer, its writer's account and the decision exist. Only you see how many people watch you.

Replies are never on the public web. Only signed-in members who can see the update read them, and only the update's owner sees how many there are.

If you're a reader with a handle, you have a public profile at meinpublic.com followed by your handle. It shows your name, the month you joined, and the people and public nodes you watch.

One function on the server decides what every page, share card, file, email and AI answer may show, so a node you keep private stays private.

Who helps us run meinpublic

These services process data for meinpublic. Each gets only what its job needs, and works under its own privacy policy, linked from its name.

Service	What it does for meinpublic	What it gets	Where
Cloudflare	Runs the website and the API and their logs, stores photos, export files and the encrypted backups (R2), runs the queues, Turnstile and Web Analytics, takes the screenshots of nodes' links (Browser Run), keeps the sign-in records of the AI assistants you connect (Workers KV), and forwards mail sent to hello@meinpublic.com	Every request, what you post, the links whose screenshots it takes, your AI assistants' sign-in records, the encrypted backups, and mail sent to hello@meinpublic.com, bounce reports included	Its global network
Neon, part of Databricks	The database (Postgres)	Everything your account holds	AWS, Singapore
Amazon Web Services (Amazon SES)	Sends email, and keeps the list of addresses that bounced or complained	Your email address and each email's text, and in the Monday letter a picture of your public map	Singapore
Anthropic	Writes the joining sentences of your Monday letter, for Tien Doan to approve	For that week's letter only: the titles, states, progress and dates of the few nodes it mentions, and the words of those nodes' updates that week. Never your name, your email or the "because" you gave a node (see below)	United States
Expo	Builds and updates the app, and sends its notifications through Apple's and Google's push services	Your device's operating system and a random token, to tell whether you have the latest update; the push address of each phone you allow notifications on, and each notification's text	United States
Sentry	Error reports	Scrubbed error and crash reports, with the device details above	United States
GitHub, part of Microsoft	Runs the nightly backup: copies the database, encrypts it, and stores it with Cloudflare	The database for the few minutes the backup runs; an encrypted copy for a day when a backup is run by hand	United States
RevenueCat	Purchases in the iOS and Android apps: checks them with the App Store and Google Play, and tells meinpublic when a plan starts, renews, lapses or is cancelled, from when paid plans start, and counts the plans in its charts, which only meinpublic sees. Its record of you is deleted when you delete your account	Your meinpublic account id (as its app user id), and your purchases and the store's receipts for them	United States
Paddle	Payments on the web, from when paid plans start: Paddle sells the plan as its reseller (the merchant of record), handles tax, and tells meinpublic when a plan starts, renews, lapses or is cancelled	Your meinpublic account id and which offer you were given (with each checkout), the email address you sign in with (filled in at checkout, where you can change it), your payment and billing details, and your purchases and receipts. Paddle holds your payment details under its own policy, as their controller	United Kingdom, United States, Ireland and Canada

Nothing on meinpublic buys attention, and no one pays to reach you. Tien Doan built it as "a healthy place where I can share my journey, see other people's journeys and help them with theirs," in his words, and selling the people in it would end that.

Your data leaves Vietnam, for the places in the table's last column.

What Anthropic keeps is as its privacy center states it for API customers, checked on October 20, 2026: inputs and outputs are not used for training by default, and are deleted within 30 days, except content flagged under its usage policy, which it may keep for up to 2 years.

How long we keep things

What	How long
A sign-in session	60 days, renewed each time you use it. It ends at once when you sign out, or with "Sign out everywhere". An ended session is deleted within the hour.
A sign-in link and code, or an email-change code	15 minutes, and each works once; what it holds is deleted within the hour after.
A node you delete	Hidden at once, from you too; erased with its updates within the hour.
An export link	24 hours. The file is deleted within the hour after.
The nightly backups of the database	28 days, encrypted, then deleted within a day.
The database's own change history	6 hours on Neon's free plan, which meinpublic is on now; 7 days on its paid plan. It is for restoring a mistake.
Your account, after you delete it	At once: your map is hidden, your sessions end, and your email address and name are removed from the account. Within the hour: everything is erased from the database and photo storage, except the three things below under "What stays". The database's change history keeps it up to 6 hours longer (7 days on Neon's paid plan), and the nightly backups made before then keep an encrypted copy until each expires, 28 days after it was made; the storage deletes an expired backup within a day. So no copy is left 29 days and 1 hour after you delete your account.

What stays after your account is erased, and why

Three things stay, none of them your content:

Your handle, and any handle you used before, as bare names with nothing linking them to you, so nobody can take them and pass for you: nobody, not even you if you sign up again.
A deletion record: only the account id and when it was deleted, kept in the database and in storage, so a restore from a backup erases you again. Nothing in it names you.
An address that bounced or marked a meinpublic email as spam stays on the lists that stop sending to it.

Your rights, and how to use them

You can use these at any time, and none of them costs anything:

Export: Settings, then Export my data, gives you a ZIP file: a JSON file of everything you wrote, and your photos and the logos you uploaded, by a link that works for 24 hours.
Delete: Settings, then Delete my account, confirmed once. Or write to hello@meinpublic.com from the address you signed up with, and we delete it for you.
See and correct: your name, handle, email, language, theme, time zone, your one-line bio, the default for new nodes, the letter's frequency, whether the weekly digest comes and the kinds of making you picked are all in Settings.
Sign out everywhere: in Settings, it ends every session at once.
Withdraw consent or object: turn the Monday letter or the weekly digest off, make a node members only or sealed, or write to us.
Ask what we hold about you, or ask us to stop or restrict something: write to hello@meinpublic.com.

How fast we answer a request

We confirm a request within 2 working days, then act on it within the time Vietnam's Decree 356/2025/ND-CP sets:

To show, correct or hand over your data: 10 days.
To withdraw consent, restrict or object: 15 days.
To delete your data: 20 days, or 30 days where a processor holds a copy, such as the backups.

If you are unhappy with an answer, tell us first. In Vietnam, you can complain to the agency in charge of personal data protection under the Ministry of Public Security. In the EU or the UK, you can complain to your country's data protection authority.

Age

meinpublic is for people 16 and older. 16 is the GDPR's default age for agreeing to an online service on your own, and Vietnam's Law on Children counts everyone under 16 as a child.

If you are younger, please don't sign up. If we learn that an account belongs to someone under 16, we delete it, and a parent can write to hello@meinpublic.com to ask us to.

Keeping it safe

Every connection to meinpublic is encrypted.
There are no passwords to leak: you sign in with a link or code sent to your email.
The nightly backups are encrypted before they are stored, in a private bucket the app itself can't reach.
Keys and passwords are never in the code, and every change to the code is scanned for them.

If a breach is likely to harm you, we tell the agency in charge of personal data protection within 72 hours of finding it, as Vietnam's Law on Personal Data Protection requires, and we tell you by email.

Changes to this policy

When this policy changes in a way that affects you, members get an email at least 30 days before the change takes effect. The date at the top of this page is when it last changed.

meinpublic Privacy Policy: What We Keep, Who Sees It, and How to Delete It