1. Introduction
Malja (“we”, “our”, or “the Service”) is a community platform for pet rescue and coordination. We are committed to protecting your personal information and being transparent about how we use it. This Privacy Policy explains what data we collect, how we use it, and what rights you have over it.
2. Information We Collect
- Account information - when you register, we collect your email address. If you sign in with Google, we also receive your name and profile picture from Google.
- Content you create - posts (including descriptions, images, and optional location data), messages sent to other users, and any contact information you choose to include.
- Location data - only when you explicitly attach a location to a post. We never collect background location without your direct action.
- Usage data - standard web server logs (IP address, browser type, pages visited) collected automatically to operate and improve the service.
3. How We Use Your Information
- To authenticate you and maintain your session.
- To display your posts and enable communication between users.
- To moderate content and enforce our Terms of Service.
- To send account-related emails (OTP verification, password resets, message notifications).
- To improve the service through aggregated, anonymised analytics.
4. Information We Share
We do not sell your personal data. We share information only as necessary to operate the service:
- Vercel - hosts the application and processes web traffic.
- Neon - stores your account data, posts, and messages in a secure PostgreSQL database.
- Cloudinary - stores images you upload to posts.
- Resend / MailerSend - delivers transactional emails (verification codes, password resets).
- Google - if you choose Google sign-in, Google provides your name, email, and profile picture.
All third-party providers are contractually required to protect your data and may only use it to provide the services we have engaged them for.
5. Cookies
We use a single authentication cookie (set by NextAuth.js) to keep you signed in across sessions. This cookie is HttpOnly and essential for the service to function. We do not use advertising or tracking cookies.
6. Data Retention
We retain your account data for as long as your account is active. You may delete your account at any time from the Settings page, which permanently removes your account, posts, and conversation history. Images uploaded to Cloudinary may take up to 30 days to be purged from their servers.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access - request a copy of the data we hold about you.
- Rectification - correct inaccurate personal data.
- Erasure - delete your account and associated data via Settings, or contact us.
- Portability - receive your data in a portable format on request.
- Objection - object to certain processing activities.
To exercise any of these rights, use the account deletion feature in Settings or contact us at privacy@malja.app.
8. Security
All data is transmitted over encrypted HTTPS connections. Passwords are stored as bcrypt hashes and never in plaintext. We follow industry-standard security practices, but no system is completely immune to breaches. If you suspect unauthorised access to your account, please change your password immediately.
9. Children's Privacy
Malja is not intended for children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us so we can remove it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. Continued use of Malja after changes constitutes acceptance of the updated policy.
11. Contact
Questions about this Privacy Policy? privacy@malja.app