01Who we are
Max Social ("Max Social", "we", "us") operates the Max Social mobile application and the website at maxsocialapp.com. We are the data controller for the personal data described in this policy.
We are established in the United Arab Emirates. For any question about this policy or about your data, contact privacy@maxsocialapp.com.
02What we collect
We collect four kinds of data: what you give us, what you create, what your device reports, and what you tell us in support conversations. We do not buy personal data from data brokers.
| Category | What it includes | Why we hold it |
|---|---|---|
| Account details | Name, username, email address, mobile number, password (stored only as a salted hash), date of birth, gender, nationality and country. | To create and secure your account, verify you, and meet our minimum-age obligations. |
| Profile | Profile photo, bio, interests, website and public contact details you choose to publish, verification status, creator category. | To render your profile and let people find you. |
| Content you create | Posts, photos, albums, reels, stories and highlights, comments, captions, hashtags, place tags, messages, voice notes, live streams and live chat, and the audience setting attached to each item. | To deliver the service - to show your content to exactly the people you chose. |
| Social graph | Followers and following, follow requests, close-friends lists, group memberships, blocked, restricted and muted accounts, hidden posts. | To build your feed and enforce the privacy and safety choices you have made. |
| Usage and interactions | Likes, comments, shares, saves, story views, search history, followed hashtags and topics, watch and impression events on posts and reels. | To rank your feed, power discovery and give creators their analytics. |
| Device and technical | Device model and operating system, app version, language, time zone, IP address, push notification token, and login events including approximate location and the devices you mark as trusted. | To deliver notifications, keep the service working across devices, and show you your own login history so you can spot an intrusion. |
| Where posts and sign-ins come from | When you publish a post, reel or story, and when you sign in: the IP address it came from, the approximate place that address belongs to (city and country, worked out from the IP address, not from your device's GPS) and the type of device. This is recorded automatically; it does not need a permission. | To investigate spam, fraud, impersonation and account takeover. It is seen only by our moderation team and is never shown to other people. Your own sign-ins, with their approximate place, are listed for you under Settings > Login activity. |
| Optional data | Precise or approximate location, contacts, camera and microphone input, and photo library items - each only when you turn the relevant feature on. See section 3. | To run the specific feature you asked for. Decline any of these and the rest of the app still works. |
| Transactions | Coin purchases, gifts sent and received, virtual items owned, subscription tiers, earnings entries and payout requests. | To run the coin economy, pay creators and keep the financial records the law requires. |
| Safety and support | Reports you file or that are filed about you, moderation decisions and notes, and the content of your messages to our support team. | To investigate abuse, enforce our Terms and answer you. |
We do not collect your contacts, your device's location (GPS), camera, microphone or photo library unless you grant that permission and use the feature it belongs to. The only location we record without asking is the approximate city and country of the IP address a post or sign-in came from, described above. We do not read your private messages except where we are responding to a report, complying with a legal order, or investigating a specific safety incident.
03Device permissions we ask for
Every permission below is optional and requested only at the moment you first use the feature that needs it. You can withdraw any of them later in your device settings; the feature that depends on it stops working, and nothing else does.
If you enable contact matching, we transmit your contacts to our servers to identify which of them already use Max Social. We use them for that purpose only. We do not message your contacts, do not sell or share them, and do not build profiles of people who are not Max Social users. You can turn contact matching off at any time, and ask us to delete the contact data we hold for you by writing to privacy@maxsocialapp.com.
04How we use your data
- To run the service - show your feed, deliver messages, connect calls and live streams, and store the content you publish.
- To honour your privacy choices - enforce audience rules, private accounts, blocks, restrictions and mutes on every request, on our servers.
- To personalise - rank your feed, suggest accounts, tags and topics, and surface content near you if you have enabled location.
- To notify you - send the push and in-app alerts you have switched on, honouring your quiet hours.
- To pay creators - record gifts, subscriptions and earnings, and process payout requests.
- To keep people safe - detect spam and abuse, act on reports, and enforce our Terms, including by looking at the IP address and approximate place a post or sign-in came from.
- To improve the product - understand which features are used, and diagnose crashes and errors.
- To meet legal obligations - keep tax and transaction records, and respond to lawful requests.
We do not sell your personal data. We do not share it with third parties for their own independent advertising.
05Legal bases for processing
Where the GDPR or a comparable law applies to you, we rely on these bases:
- Contract - processing needed to give you the service you signed up for: your account, your content, messaging, calls and live streams.
- Consent - camera, microphone, photo library, location, contacts and push notifications. You may withdraw consent at any time.
- Legitimate interests - keeping the platform safe and free of abuse, preventing fraud, securing accounts, and improving the product. We balance these against your rights.
- Legal obligation - retaining financial records and responding to valid legal process.
06Who we share your data with
- Other users - exactly as far as the audience setting on each item allows. See section 8.
- Service providers - the processors listed in section 7, who act on our instructions and may not use your data for their own purposes.
- Payment platforms - Apple and Google process in-app purchases. We receive confirmation of a purchase, not your card details.
- Legal and safety - law enforcement or regulators where we are legally required, or where disclosure is necessary to prevent serious harm.
- A business transfer - if Max Social is acquired or merged, your data may transfer to the successor, who remains bound by this policy until they give you notice of any change.
07Service providers we use
| Provider | What it does for us | What it receives |
|---|---|---|
| Amazon Web Services | Hosts our servers, database and uploaded media. Primary region: EU (Frankfurt). | All data described in this policy, stored on our behalf. |
| MongoDB Atlas | Managed database hosting, in the same EU region. | Account, content, social graph and transaction records. |
| Google Firebase Cloud Messaging | Delivers push notifications to your device. | Your push token and the notification content. |
| Agora | Carries real-time audio and video for calls and live streams. | Live audio and video streams and session identifiers, for the duration of the call. |
| Stripe | Processes card payments where in-app purchase is not used. | Payment details, handled by Stripe as its own controller under its privacy policy. |
| Apple & Google | App distribution and in-app purchase billing for coins. | Purchase and receipt data under their own privacy policies. |
| Google Maps & Mapbox | Draws a map when you view or share a location in a chat. Place names are worked out on our own servers from an offline list of cities (GeoNames), so your position is not sent to a third party for that. | The map area being displayed. |
| OpenAI | Powers the AI reel assistant and in-app translation. | Only the text or prompt you submit to those features. It is not used to train third-party models on your behalf. |
08What is public and what is not
This is the part most policies leave vague, so here it is plainly:
- Always public - your username, profile photo, bio and follower and following counts, unless your account is private.
- Audience-controlled - every post and story carries its own setting: public, followers, close friends, or only you. We enforce it on the server when the content is requested, not merely by hiding it in the app.
- Private by default - direct and group messages, voice notes, your search history, your login history, your blocked and restricted lists, and your notification settings. Nobody else sees these.
- Visible to the creator - if you view a story, the person who posted it can see that you did. If you gift during a live stream, your name may appear on that stream's leaderboard.
- Not reversible - anything you post publicly may be seen, screenshotted or re-shared by others before you delete it. Deleting it removes it from Max Social; it cannot remove copies other people already made.
09Coins, gifts and payments
Coins are bought through Apple or Google billing, or by card through Stripe. We never see or store your full card number. We keep a record of what you purchased, when, and the coin balance and transaction history that results, because we need it to run the coin economy and to satisfy tax and accounting rules.
If you are a creator, we hold your earnings ledger and your payout requests, along with the payout details you supply. Those records are kept for the statutory retention period even if you later close your account - see section 11.
10Push notifications
If you allow notifications, we store a push token for each device you sign in on and send it to Firebase Cloud Messaging to deliver alerts. You control which categories you receive - likes, comments, replies, mentions, tags, follows, shares, live streams, group activity, messages, story views and security alerts - each independently, and you can set quiet hours during which nothing is delivered. Revoking the permission in your device settings stops all of them.
11How long we keep your data
| Data | Retention period |
|---|---|
| Account and profile | For as long as your account is open or deactivated. After you ask for deletion, 30 days, then erased (see section 12). |
| Posts, reels, comments and highlights | Until you delete them, or your account is deleted. |
| Stories | 24 hours from posting, unless you save one as a highlight. |
| Messages and voice notes | Until deleted by a participant, or the account is deleted. |
| Live streams | The stream itself is not recorded by default. Stream metadata and chat are kept for up to 90 days for moderation. |
| Search and login history | Up to 12 months, or until you clear it - search history can be cleared in the app at any time. |
| Where a post came from (IP address and approximate place) | 12 months from when the post was published, then deleted automatically. |
| Transactions, earnings and payouts | Up to 7 years, as tax and accounting law requires. |
| Reports and moderation records | Up to 2 years after the case is closed, so repeat behaviour can be recognised. |
| Backups | Deleted data disappears from routine backups within 90 days. |
12Deactivating or deleting your account
Open Profile > Setting > Delete account. You can choose one of two things, confirm with your password (or, if your account has no password, the email address or mobile number you signed up with), and you are signed out straight away. You do not need to give a reason, and nobody has to approve it.
| Deactivate | Delete | |
|---|---|---|
| What it is | A break. Temporary. | Leaving for good. Permanent after 30 days. |
| Straight away | You are signed out on every device. Your profile, posts, reels, stories and comments are hidden from everyone, and you no longer appear in search or suggestions. | |
| Coming back | Sign in again at any time. Everything is exactly as you left it. | Sign in within 30 days and the deletion is cancelled; everything is as you left it. |
| After 30 days | Nothing changes. The account stays deactivated until you sign in. | You can no longer cancel deletion or sign in. Permanent erasure runs in our daily deletion process after the 30-day period ends. |
When a deletion is carried out, we permanently erase your profile and everything that identifies you on it (name, email address, phone number, photo, bio, birthday, address, sign-in methods and devices), every post, reel and story you made and where it was posted from, your comments and likes on other people's posts, your followers and the people you follow, your group memberships, your notifications and your login history. Copies in our routine backups are overwritten within 90 days.
Three things survive that, and only these:
- Messages other people hold - a message you sent stays in the other person's copy of the conversation, shown from "Deleted user", exactly as an email you sent would.
- Financial records of coin purchases, gifts and payouts, kept for up to 7 years because tax law requires it, reduced to the transaction facts and no longer linked to a profile.
- Moderation records where you were the subject of an upheld report, kept for up to 2 years so that a banned user cannot simply re-register.
Signing in during the cancellation period restores your account, but sessions ended when you closed it stay signed out. Each device needs a new sign-in.
Can't sign in to delete your account? Use Forgot password on the sign-in screen, or contact privacy@maxsocialapp.com for help with an account-deletion request. We may need to verify that the account is yours. Accounts closed by us for breaking our Terms cannot be reopened by signing in.
13Your rights
Depending on where you live, you have some or all of these rights. We honour all of them for every user, wherever you are, because it is simpler and fairer than doing otherwise.
- Access - ask what personal data we hold about you and get a copy.
- Rectification - correct anything inaccurate. Most of it you can edit yourself in the app.
- Erasure - delete your account and data, as set out in section 12.
- Portability - receive your data in a machine-readable format.
- Restriction and objection - ask us to pause a particular use, or object to processing based on legitimate interests.
- Withdraw consent - revoke any device permission at any time, in your device settings.
- Complain - raise a complaint with your local data protection authority. We would rather you came to us first, but it is your right either way.
To exercise any of these, write to privacy@maxsocialapp.com. We respond within 30 days. We do not charge for this, and we will never restrict your account for making a request.
14How we protect your data
- All traffic between the app and our servers is encrypted with TLS. The website is served over HTTPS only.
- Passwords are stored as salted hashes. Nobody at Max Social can read your password.
- Sessions use short-lived access tokens that refresh automatically, so a stolen token has a narrow window of use.
- Real-time connections are authenticated - the server verifies your signed-in identity on every socket handshake rather than trusting what the client claims to be.
- Optional two-factor authentication with single-use recovery codes.
- A visible login history and trusted-device list, so you can spot and act on access you do not recognise.
- Databases run in a private network with restricted administrative access and automated encrypted backups.
No system is perfectly secure. If a breach affects your personal data and puts you at risk, we will tell you and the relevant regulator without undue delay.
15International transfers
Our servers are in the European Union (Frankfurt). Some of our service providers operate elsewhere, including the United States. Where data leaves the EEA or the UK, we rely on Standard Contractual Clauses or another approved transfer mechanism, and we take the additional measures those clauses require.
16Children and minimum age
Max Social is not intended for anyone under 13, and we ask for a date of birth at sign-up. Where local law sets a higher minimum age for consent to data processing, that higher age applies to you.
We do not knowingly collect personal data from children under 13. If you believe a child has created an account, tell us at privacy@maxsocialapp.com and we will verify and delete the account and its data promptly. Parents and guardians may contact us about a minor's account at the same address.
17Changes to this policy
We update this policy when the product or the law changes. The "last updated" date at the top always reflects the current version. If a change materially affects your rights or how we use your data, we will notify you in the app or by email before it takes effect, so that you have a real chance to object or close your account.
18Contact us
We read everything sent to these addresses, and a person answers.