Privacy Policy

Last updated: 29 September 2026

This policy explains what Mish ("we", "us") collects when you use the app, why, who can see it, and what you can do about it. We've tried to keep it short and plain.

What we collect

Your account

• Your email address and password (the password is stored scrambled by our database provider; we can never see it).
• Your display name, @username, bio, profile photo, and your date of birth (kept private: only you can see it; it's used to check your age and nothing else).
• Whether your account is personal or a business account.
• Your interests, if you choose any (like "beaches" or "live music"). They're private and only used to sort Near me for you.

Where you are (only when you ask)

• Your area: the suburb and town you pick (for example "Aitkenvale, Townsville"), and a few recent place names so you can switch back quickly. Never your exact position.
• Checking in: when you tap Complete mission, Mish reads your phone's location once and compares it with the mission's spot. We only save how far away you were (for example "40 m"), not where you were.
• "Use my current location": Mish reads your location once and your phone's built-in map service (Apple's or Google's) turns it into a place name. We only save the place name. Your spot (rounded to about 100 m) is kept on your phone only, to measure Near me distances, and is never sent to us.
• Missions with friends: so tagged friends can join within 2 hours, we keep the spot hidden from everyone (including your friends) until the joining window closes, then delete it within the hour.
• Crew Missions: to stop a crew doing two at the same spot on the same day, we keep a rough area (rounded to about 100 m), hidden from everyone, and delete it the next day.
• How far away: while a mission's page is open (and Mish is on your screen), it shows how far you are from the spot, updating as you walk. It stops as soon as you leave the page or the app, and it's never saved or sent to us.
• Near me distances: pulling down to refresh Near me reads your location once (only if you've already allowed it) and keeps it on your phone only, rounded to about 100 m.
• Place picks: when you tap "Use my location" to start a mission, your spot is sent (through our server) to Google Maps, or as a backup to Photon, a free map service using OpenStreetMap, to suggest nearby place names. Mish doesn't save your spot; only the name you pick is saved.
• We never track your location in the background.
• Photos: before any photo leaves your phone, Mish saves a fresh copy of it. That strips out the hidden details phones put inside photos, like the exact GPS spot where it was taken.

What you post and do

• Photos, captions, stories, comments, likes, "Crew's Thoughts", and missions you save.
• Crews you create or join, people and crews you follow, plans and your In / Maybe / Out answers.
• Chat messages, photos and voice notes you send.
• Your points, levels and streaks.
• The days you open Mish (just the date, once a day), so we can count how many people use it and how many come back. We only ever look at totals, never at one person.
• Reports and blocks you make.
• Feedback and ideas you send us. Bug reports also include your phone type, its software version and the Mish version, plus any screenshots you attach.

Sponsored missions

• When you see a sponsored mission, we record that you saw it (at most once a day). Businesses only ever see totals (for example "120 people saw it, 8 crews took it"), never who.

Business accounts

• Your business's name, category, logo, address and map pin, and website. These are public, because they're how crews find you.
• Payments are handled by our payment providers (see below). We never see or store your card details.

Who can see what

• Strangers can only see your name, @username and profile photo, unless you make your profile public.
• Crews and profiles are private by default. Crew posts are visible to the crew, and to other people only if the crew is public.
• Group chats, invite codes, round trackers and members' suburbs are only ever visible to members.
• Stories follow your privacy settings and stop showing after 24 hours. After that, the story's files stay stored privately until you delete them or your account.
• Blocking someone hides you from each other everywhere in Mish.
• Photos are stored privately and only shown through links that expire.
• Exact spots are never shown to anyone, only place names.
• Where you're based: you choose who sees it on your profile: Everyone, Followers (people you've let follow you, and your crews) or Only me. New accounts start on Followers.
• Where your posts were: each post can show or hide its place. A hidden post only shows the kind of mission (for example "Beach mission"), and our servers never send its place to anyone except you, the people in it and the crew it's for. You set a default in Privacy and can change it on any post.

Who helps us run Mish

We use a few trusted services. They only get what they need to do their job:

• Supabase: stores Mish's data and photos, in Sydney, Australia.
• Expo: delivers app updates to your phone, and sends push notifications through Apple and Google (they get the notification's text).
• Resend: sends the emails with your sign-up and password codes (it gets your email address).
• Apple and Google: your phone's map service turns a location into a place name; the app stores deliver Mish.
• Google Maps: suggests nearby places from a location when you start a mission (it gets the location, not your name or account).
• Photon (by komoot), using OpenStreetMap: when you search for a place, the words you type are sent there to find matches. It's also the backup for place suggestions.
• Anthropic (Claude): writes missions from public information about places and events, and checks sponsored missions against our Advertising Policy. We don't send it your personal information.
• Payment providers: will process payments from business accounts. We'll name them here before payments open.

Some of these companies store data outside Australia. We only use services with strong security and privacy practices.

Why we use your information

To run Mish: showing your crew's missions, checking you're at the spot, sharing your posts with the people you choose, sending notifications, keeping points and streaks, keeping people safe (reports, blocks, moderation), fixing bugs, and improving Mish. We don't sell your information, and we don't use it to target you with outside ads. Sponsored missions are shown by area only, never by profiling you.

Your choices and rights

• See and change your info: in Settings (the ☰ on Me): Account for your profile, and Privacy and safety for who sees what.
• Take a break: Settings → Account → Suspend. Everything is hidden until you log back in.
• Delete your account: Me → ☰ Settings → Account → Delete account. This straight away and permanently deletes your account and everything you put on Mish: your profile, posts, photos, stories, voice notes, chat pictures, comments, likes and messages. Crews you started carry on for their other members (a crew with nobody else in it is deleted). Reports other people made about you are kept, without your name, to help keep Mish safe.
• Location: you can turn off location for Mish in your phone's settings at any time. You just won't be able to check in.
• Questions or requests: email hello@mishsocial.com. We'll reply within 30 days.
• Complaints: if you're not happy with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Age and young people

Mish is for people aged 16 and over (Australia's minimum age for social apps). If we learn that someone under 16 has an account, we'll delete it.

For 16- and 17-year-olds:

• accounts start private (they can choose to make them public, like on Instagram);
• adults they don't already know (who aren't in a crew with them, and who they don't follow) can't message them or find them in search;
• 18+ missions (like bars and drinks deals) and alcohol offers are never shown to them.

Business accounts are for people 18 and over.

Keeping your information safe

Every table in our database has access rules, so people can only see what they're allowed to see. Photos are private and only shown through expiring links. Secret keys are never in the app. No system is perfect, but we take this seriously and will tell you if something goes wrong that affects you.

Changes

If we change this policy in a way that matters, we'll tell you in the app before it takes effect.

Contact

Email us at hello@mishsocial.com.