What MEKU collects, and what it never sees.

We collect the minimum needed to run a social app with a wallet: your account details, what you post, and the transactions you sign. We never see your PIN, your recovery answer, or your private keys. We do not sell your data and we do not run third-party advertising trackers.

Your email address, password (stored only as a hash), username, and anything you choose to add to your profile — display name, bio, links, avatar and banner. Posts, replies, likes, bookmarks, follows, direct messages and reports are stored so the app can function.

Your Arc wallet address, balances and transaction history are onchain and therefore public by nature. We store a reference to your wallet and a local record of transfers so Activity can show usernames and tip context. Your 6-digit PIN and recovery answer are stretched with PBKDF2 and stored only as salted hashes — they cannot be recovered or read by anyone at MEKU.

Basic technical data needed to serve and secure the app: IP address, device and browser type, timestamps, and error diagnostics. We record aggregate post impressions, deduplicated per viewer, to show view counts. We do not build advertising profiles.

When you open a dApp inside MEKU, requests pass through our proxy so we can apply phishing screening, rate limits and SSRF protection. We log the requested host and timing for abuse prevention. We do not store page contents, and a site can never read your PIN or sign anything without your explicit confirmation.

To operate your account, deliver feeds and messages, process transfers you authorise, prevent fraud and abuse, respond to support requests, and meet legal obligations. Nothing more.

Service providers acting on our instructions only: our hosting and database provider, and Circle for wallet infrastructure. We also disclose data where legally required. We do not sell personal data to anyone.

Posts, replies, likes, your username, avatar, banner and follower lists are visible to anyone, including logged-out visitors and search engines. Direct messages are not public. Anything published onchain is permanent and outside our control.

Account data is kept while your account is active. Deleting your account removes your profile, posts, replies and messages from MEKU within 30 days, except records we must keep for security or legal reasons. Onchain transactions cannot be deleted.

Row-level security on every table, server-side transaction signing, PIN lockout on repeated failures, signed URLs for media, and revocable sessions. No system is perfect — tell us immediately if you suspect a problem.

You can access, correct, export or delete your data, and object to certain processing. Most of this is available in Settings; for anything else, email us and we will action it within 30 days.

MEKU is not intended for anyone under 13, or under the minimum digital-consent age in your country. We delete accounts we learn belong to children.

We will update this page and change the date above when the policy changes; material changes are announced in the app. Questions or requests: mekuapp0@gmail.com.