Privacy Policy

Mixed Race Community ("MRC," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at mixedracecommunity.com, use the MRC iOS app, or use our other platform services. The website and the app share one account, and this policy covers both. By using our services, you agree to the collection and use of information as described in this policy.

We collect information you provide directly, including your display name, email address, username, profile picture, banner image, bio/description, gender, location, and heritage information. We also collect content you create such as posts, comments, and connections you make on the platform.

Automatically collected information includes your IP address, browser type, device information, pages visited, time spent on pages, and cookies or similar tracking technologies used to enhance your experience. Analytics data (see Sections 5 and 14) is collected only if you accept analytics cookies.

We use your information to provide and maintain our platform services, personalize your experience and content feed, facilitate connections between community members, send you verification emails, welcome messages, and important account notifications, improve our platform through analytics and user feedback, protect against unauthorized access and ensure platform safety (including automated safety screening of what members write and upload, see Section 14), and comply with legal obligations.

Your profile: your display name, username, profile picture, banner image, and bio appear on your profile, which anyone who visits it can see, and in member search. Any heritage you choose to share, and the blend colours drawn from it, are shown only to members who are signed in: on your profile, in member search, and in matches. People who are not signed in, search engines, and link previews never see your heritage. You can change any of these at any time from your account, and remove your pictures, bio, and heritage entirely.

Your recipe book: recipe books are private until you choose to share yours. If you share it, members who are signed in can see the recipes you wrote in it (title, photo, story, ingredients, method and heritage tag) with your name and profile picture, but never your notes, ratings or cooking history.

Direct messages: when a member reports a conversation, MRC's moderators can read that conversation to review the report.

We do not sell your personal information. We may share information with trusted third-party service providers who help us operate our platform (such as Vercel for hosting, Resend for email delivery, Supabase for file storage, OpenAI and Anthropic for automated safety screening, and, if you accept analytics cookies, Google Analytics for usage statistics). The full list is in Section 14. These providers are contractually obligated to protect your data. We may also disclose information if required by law, to protect our rights, or to ensure user safety.

We use essential cookies to maintain your session and keep you logged in (via our mrc_session cookie). You can control cookies through your browser settings, though disabling essential cookies may prevent you from using certain features.

Analytics (only with your consent): if you accept analytics cookies in our cookie banner, we use Vercel Web Analytics and Speed Insights, and Google Analytics 4, to understand how the platform is used and how fast it loads. Nothing is loaded and no analytics cookie is set until you opt in.

What Google Analytics receives: a pseudonymous identifier stored in the _ga and _ga_<ID> cookies, the page path you visited, device and browser type, and approximate location (country or city) derived from your IP address. We strip query strings from page addresses and replace usernames and other identifiers in paths before anything is sent, so links containing verification or password-reset tokens, email addresses, or profile names are never shared. Google Analytics does not log or store IP addresses for users in the EU. We have turned off Google signals and ad personalisation, and we never send your name, email, heritage selections, messages, or other profile content to Google.

Withdrawing consent: you can turn analytics off at any time via Manage Cookies or Account Settings → Privacy & Consent. When you do, analytics stops immediately and the _ga cookies are deleted from your browser. Full cookie details are in our Cookie Policy.

We implement industry-standard security measures to protect your personal information, including encrypted data transmission (HTTPS), secure password hashing (PBKDF2-SHA512 with a unique salt per password), HTTP-only session cookies, and secure cloud infrastructure. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

You have comprehensive rights over your personal data. These rights apply regardless of where you are located, and we will respond to all requests within 30 days.

Right to Access: You may request a full copy of the personal data we hold about you, including a structured data export (JSON format) via your account settings under Privacy & Consent.

Right to Rectification: You may correct inaccurate or incomplete personal data at any time by editing your profile in account settings.

Right to Erasure: You may delete your account and all associated personal data at any time. Heritage data is deleted immediately upon consent withdrawal. Account deletion is permanent and irreversible.

Right to Restrict Processing: You may pause heritage-related features (blend visualization, community matching) at any time via account settings. Your data is retained but not actively processed for these features.

Right to Data Portability: You may export your data in a structured, machine-readable JSON format via account settings → Privacy & Consent → Export My Data.

Right to Object: You may opt out of analytics cookies and marketing communications at any time via account settings or by contacting us at privacy@mixedracecommunity.com.

Right to Withdraw Consent: You may withdraw any consent you have given (including consent to process heritage data) at any time without affecting the lawfulness of processing prior to withdrawal. Go to Account Settings → Privacy & Consent.

Right to Lodge a Complaint: If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local supervisory authority. For EU residents, this is your national Data Protection Authority. For UK residents, this is the Information Commissioner's Office (ico.org.uk). For California residents, this is the California Privacy Protection Agency (cppa.ca.gov).

Minimum Age: MRC is an adults-only platform. It is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If we discover that we have collected such information, we will promptly delete it.

Reporting: If you believe someone under 18 has created an account, contact us at privacy@mixedracecommunity.com and we will investigate, suspend the account, and delete the associated data.

Age Verification: We use date-of-birth verification during registration and account setup. A date of birth indicating an age under 18 is never stored. Accounts suspected of misrepresenting age will be suspended pending verification.

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and via an in-app banner. The updated policy will be posted on this page with a revised "Last updated" date. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

We process your personal data only where we have a lawful basis to do so. The following table summarises the bases we rely on:

Consent (Art. 6(1)(a)): Heritage data (racial/ethnic origin selections), marketing and promotional emails, and analytics/tracking cookies. You may withdraw consent at any time via Account Settings → Privacy & Consent.

Contract (Art. 6(1)(b)): Account creation and authentication, delivery of platform services, and transactional communications (e.g. password reset, email verification).

Legitimate Interests (Art. 6(1)(f)): Security monitoring and fraud prevention, content moderation and platform integrity, and abuse detection. We have conducted and documented legitimate-interest assessments for each of these purposes.

Legal Obligation (Art. 6(1)(c)): Age verification obligations, responding to lawful requests from law enforcement or regulatory authorities, and retaining records required by applicable law.

What We Collect: Heritage selections submitted by users constitute racial and ethnic origin data, which is classified as special category data under GDPR Article 9 and equivalent legislation worldwide.

Lawful Basis: We process this data solely on the basis of your explicit consent (Art. 9(2)(a)). You provide this consent during onboarding by actively selecting your heritage and confirming the consent prompt.

Purposes: Heritage data is used exclusively to generate your personalised heritage blend visualisation and to facilitate community matching with users who share similar backgrounds.

Visibility: Heritage you choose to share, and the blend colours drawn from it, are shown only to members who are signed in, on your profile and in matches. People who are not signed in, search engines, and link previews never see it. If you do not share any heritage, nothing is shown.

Withdrawal: You may withdraw consent at any time by navigating to Account Settings → Privacy & Consent → Manage Heritage Data. Withdrawal does not affect processing that occurred prior to withdrawal.

Consequence of Withdrawal: If you withdraw consent for heritage data processing, your blend visualisation and heritage-based matching features will be disabled and all stored heritage selections will be permanently deleted within 72 hours.

We retain personal data only for as long as necessary for the purposes described in this policy or as required by law.

Account Data: Retained until you request account deletion.

Posts and Comments: Retained until deleted by you or upon account deletion.

Direct Messages: Retained until deleted by you or upon account deletion.

Session Data: Retained for 30 days from the last activity.

Audit Logs: Retained for 2 to 7 years depending on the type of event and applicable legal requirements.

Moderation Records: Retained for 7 years to support appeals and regulatory compliance.

Consent Records: Retained for the lifetime of your account plus 7 years after account deletion, to demonstrate compliance with applicable law.

Analytics Data: Google Analytics event data is retained for 2 months, then deleted by Google; aggregated, non-identifying reports may be kept longer. The _ga cookies expire after up to 2 years, or immediately when you withdraw analytics consent.

Data Processing Location: Your personal data is processed primarily in the United States, where our core infrastructure is hosted.

Transfer Mechanism: Where we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to a country not deemed to provide an adequate level of data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms under UK GDPR.

Sub-Processors: All third-party processors listed in the 'Third-Party Services' section of this policy are bound by Data Processing Agreements that include appropriate transfer safeguards.

We use the following third-party service providers to operate the platform. Except where noted, each is bound by a Data Processing Agreement and their own privacy policy.

Vercel: Hosting and CDN. Your data passes through Vercel's global edge network. Privacy Policy: vercel.com/legal/privacy-policy

Neon Postgres: Primary database. All user account data, posts, messages, and platform content are stored here. Privacy Policy: neon.tech/privacy

Supabase: File and image storage (profile pictures, banner images). Privacy Policy: supabase.com/privacy

Resend: Transactional email delivery (verification emails, notifications). Privacy Policy: resend.com/legal/privacy-policy

Upstash Redis: Rate limiting and session caching. Minimal data (IP addresses, session tokens) stored transiently. Privacy Policy: upstash.com/trust/privacy.pdf

Cloudflare Turnstile: Bot protection on forms and authentication flows. Privacy Policy: cloudflare.com/privacypolicy

OpenAI: Automated safety screening. The text of posts and comments is sent to OpenAI's API to check it against our Community Guidelines as you write, before a post or comment appears, and again when you edit one, so a draft you type and then delete may still have been checked. Your display name, pronouns, and bio are checked the same way when you change them, and so are photos you upload, including photos sent in messages. The text of direct messages is not sent to OpenAI: it is checked against a word list on MRC's own servers. Under OpenAI's API defaults, this content is not used to train OpenAI's models, and OpenAI may retain it for up to 30 days to monitor for abuse before it is deleted. Privacy Policy: openai.com/policies/privacy-policy

Anthropic: Automated safety screening of still frames taken from videos you upload, checked before you can post the video. Under Anthropic's commercial API terms, this content is not used to train Anthropic's models. Anthropic's Data Processing Addendum, with Standard Contractual Clauses, is incorporated into its Commercial Terms (anthropic.com/legal/data-processing-addendum). Privacy Policy: anthropic.com/legal/privacy

Have I Been Pwned (Pwned Passwords): Anonymous password-breach check. When you choose a password, your browser, the MRC iOS app, or our server sends only the first five characters of a one-way SHA-1 hash of it, so we can warn you if that password has appeared in a known data breach. Your password, email address, and name are never sent, so no Data Processing Agreement applies. Privacy Policy: haveibeenpwned.com/Privacy

Vercel Web Analytics and Speed Insights: Page-view and performance measurement, only with your analytics consent. Privacy Policy: vercel.com/legal/privacy-policy

Google Analytics 4 (Google LLC): Usage statistics, only with your analytics consent. Receives a pseudonymous cookie identifier, redacted page paths, device and browser type, and approximate location. Google signals and ad personalisation are disabled. Privacy Policy: policies.google.com/privacy · How Google uses data: policies.google.com/technologies/partner-sites

Google: OAuth sign-in. If you choose to sign in with Google, your Google account information is shared with us per Google's OAuth flow. Privacy Policy: policies.google.com/privacy

Sentry: Error monitoring and performance tracing. May capture sanitised stack traces and request metadata. Privacy Policy: sentry.io/privacy

Shopify: Payment processing for the MRC shop, when it is open. MRC does not receive or store payment card data. Privacy Policy: shopify.com/legal/privacy

Printify: Print-on-demand fulfilment. Your shipping address is shared with Printify only when you place an order. Privacy Policy: printify.com/privacy-policy

MRC does not store, process, or transmit credit or debit card data. All purchase transactions are handled directly by Shopify, a PCI DSS Level 1 certified payment processor.

Print-on-demand order fulfilment is managed by Printify. Your shipping address is transmitted to Printify solely for the purpose of fulfilling your order.

MRC's payment compliance scope is PCI SAQ-A, meaning we have no contact with cardholder data at any point in the transaction flow.

Privacy enquiries and data subject rights requests: privacy@mixedracecommunity.com

Security vulnerabilities and incident reports: security@mixedracecommunity.com

General enquiries: community@mixedracecommunity.com

We aim to respond to all data rights requests within 30 days. Complex requests may take up to 90 days, in which case we will notify you of the extension.

Version: 2026.10.1

Last updated: October 4, 2026

Material changes to this policy will be communicated via email to registered users and via an in-app notification banner. The previous version of this policy is available upon request.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). This section describes your rights and how to exercise them.

Categories of Personal Information Collected: Identifiers (name, email address, username), internet or other electronic network activity information (browsing history, posts, interactions), and protected classification characteristics under California or federal law (heritage/ethnic origin data).

Sources of Collection: We collect personal information directly from you when you create an account, fill out your profile, or interact with the platform. We also collect information automatically via cookies and similar technologies when you use our services.

Business Purposes for Collection: We use your personal information to provide community features and platform services, personalise your experience (including heritage blend visualisation and community matching), maintain the security and integrity of our platform, and comply with legal obligations.

We Do Not Sell Personal Information: MRC does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. We also do not share your personal information for cross-context behavioural advertising.

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom we share it.

Right to Delete: You have the right to request deletion of your personal information. You can delete your account and all associated data at any time via Account Settings, or by contacting us.

Right to Opt-Out: You have the right to opt out of the sale or sharing of your personal information. Since we do not sell or share personal information for advertising purposes, no opt-out mechanism is required. You may still opt out of analytics cookies via your account settings.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights. You will not receive different pricing, quality of service, or access to features for exercising your rights.

How to Exercise Your Rights: You can exercise your California privacy rights through your Account Settings (Privacy & Consent section), or by emailing us at security@mixedracecommunity.com. We will verify your identity before processing your request and respond within 45 days.