Overview
mitch.pro is a student community with profiles, messaging, games, school-day tools, virtual coins, and moderation features. This policy covers the mitch.pro service. It does not cover independent websites or games you open through it.
We don’t sell personal information. The default is to collect less: if a feature works without a piece of data, we don’t store it, and when we stop storing something we delete what was already collected.
What we keep
- Account: email address, username, display name, password hash, role, verification records, and optional two-factor settings.
- Profile: nickname, biography, avatar, website, graduation year, gender, referral source, background, and cosmetics you choose to display.
- Community activity: friends and requests, group membership, reports, public posts, moderation actions, and coin or shop activity.
- Games and features: scores, achievements, saved progress, playtime counts per category, preferences, and bell-schedule choices. Which games are played is also counted in total, with no account attached.
- Sign-in: a hashed session token with its creation and expiry time. It has no IP address, device, or last-used time.
- Last active day: the day (not the time) you were last active, used to end premium after seven days of inactivity.
- Safety records: anti-cheat flags (account, game, reason), a log of staff actions, network bans, and the consent record when you let admins open your cloud computer.
- Support and feedback: tickets, messages, newsletter choices, and notification subscriptions.
What we don’t keep
- Browsing history. We don’t record which pages you open, or the referrers and search terms attached to requests. Site searches aren’t logged.
- IP addresses tied to accounts. No IP or user agent is stored with your account, sessions, anti-cheat flags, staff logs, or application logs. Requests are rate-limited by IP in memory only; that is cleared within an hour and on every restart. Network bans and the support-ticket rate limit store a keyed hash of the address, never the address.
- Presence. Whether you’re online, what page you’re on, and your activity exist only in server memory, never in a database or file. After a restart everyone shows as offline.
- Trackers. No analytics, advertising, or social-media scripts run on our pages.
Staff can’t see raw IP addresses, because none are stored anywhere a staff tool reads.
How we use information
To sign you in, show profiles, deliver messages, sync settings and game progress, run rewards, answer support requests, prevent abuse, enforce community rules, investigate reports, and keep the service running.
Automated controls may rate-limit requests, reject suspicious activity, or restrict an account. Administrators may review reports and the limited records listed above when investigating safety or reliability problems.
What other members can see
Signed-in members can see your username, display name or nickname, avatar, biography, public profile fields, role, cosmetics, achievements, selected game statistics, friend status, and whether you’re online. Public posts and shared canvas activity are visible wherever the interface marks them public.
Your current page, your activity (such as “Chatting in Matrix”), and how recently you were active are shown only to you, your friends, and admins, and only if you turn on Share activity, which is off by default. Hide online hides your status from everyone, admins included. Both settings are enforced on the server, not just in the interface. The “N online” count includes members who hide their status, and is only a number.
Your email address isn’t shown to ordinary members; public references use your username. Only you and the site owner can open your cloud computer, unless you allow admins in for 24 hours, and you’re notified each time they do.
Chat and encryption
Direct and group messages labeled end-to-end encrypted are encrypted in your browser. The server stores encrypted message payloads and delivery metadata such as participants, timestamps, read state, group membership, and expiration settings. The server should not have the private key required to read normal end-to-end encrypted message content.
Encryption does not prevent a recipient from saving or sharing what they receive. If a user reports a message, information included with that report may be available to moderators. Public and premium chat rooms are shared community spaces and are not end-to-end encrypted unless the interface explicitly says otherwise.
Retention
- Account and profile data: until you delete your account.
- Login sessions: until they expire or you sign out.
- Application error logs: 30 days. They contain no IP addresses.
- Anti-cheat flags: 90 days, newest 1,000 kept.
- Cloud computer audit log: 180 days. Usage samples: 30 days. Admin access grants: 24 hours.
- Resolved support tickets: 90 days after the last activity. The hashed IP on a ticket is cleared after one day.
- Staff action log and network bans: kept, bans until lifted.
Deleting your account may not immediately remove backups, reports, or content another user has kept. We use access controls, password hashing, session protection, rate limits, and encryption. No online system is perfectly secure, so use a unique password and turn on two-factor authentication.
The same details, with how each is implemented, are in the public source.
Your choices
You can update profile fields, visibility preferences, notification choices, and security settings from Preferences. You can request an export or account deletion through Download Information or by contacting support. We may need to verify your identity before fulfilling a request.
Depending on where you live and whether a privacy law applies to the service, you may have rights to know, correct, delete, or obtain certain personal information and to receive equal service for exercising those rights. mitch.pro does not sell personal information, so there is no sale opt-out flow.
Age requirements
The service is not intended for children under 13. Do not create an account or submit personal information if you are under 13. If we learn that an under-13 user provided personal information without any consent required by law, we may close the account and delete the information.
Changes to this policy
We may update this policy as the service changes. The date at the top identifies the current version. Material changes may also be announced in the service.
Contact
Questions, corrections, access requests, or deletion requests can be sent to support@mitch.pro.