Privacy Policy

This Privacy Policy describes how Mush ("we", "us", or "our") collects, uses, and shares information when you use the Mush web application (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect the following categories of information:

• Account information: Your name, email address, password (hashed), and profile photo. If you sign in with Google, we also receive your Google account's name, email, and profile image.
• User-generated content: Events, gear (bikes, vehicles, racks, shuttles, passes), location data, friendships, and event attendance records you create.
• Usage data: Log data including IP address, user agent, pages viewed, and timestamps of your interactions with the Service.
• Cookies: Session cookies for authentication and user preferences (such as theme).

2. How We Use Your Information

• To provide, maintain, and improve the Service.
• To authenticate you and protect your account.
• To send transactional emails (verification, password reset).
• To enable social features like friendships and event invitations.
• To debug, monitor, and secure the Service.

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

• With other users: Your name, profile photo, and event participation are visible to other users based on the visibility settings you choose.
• Service providers: We use third-party services for hosting (Render), email delivery (Resend), image storage (Cloudflare Images), and authentication (Google OAuth). These providers process data on our behalf.
• Legal compliance: We may disclose information if required by law or to protect the rights, property, or safety of Mush or its users.

4. Data Retention

We retain your information for as long as your account is active. If you delete your account, we will delete or anonymize your personal information, except where we are required to retain it for legal, regulatory, or legitimate business purposes.

5. Your Rights

Depending on your location, you may have the right to:

• Access, update, or delete your personal information.
• Object to or restrict certain processing of your data.
• Receive a copy of your data in a portable format.
• Withdraw consent where processing is based on consent.

6. Security

We use industry-standard measures including HTTPS, password hashing, and access controls to protect your information. No system is perfectly secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

9. Contact

Questions about this Privacy Policy? Reach out via the contact info on our About page.