Short version
Murmely only processes data required to operate the service: account data, optional profile data,
featured discussion topics, discussion requests, questionnaire answers, consent decisions,
conversations, safety reports, blocks, contact requests and technical logs.
Murmely does not sell personal data and does not use personal data for targeted advertising.
Some conversation content is protected at rest in the database. However, when a report is submitted
or moderation is required, the administrator may access the information necessary to review the report
and protect users.
1. Data controller
Murmely is currently administered by its creator. The creator is responsible for the technical operation
of the application, account management, support requests and moderation follow-up.
As the number of users grows, other people may also be appointed as administrators.
For privacy-related requests, you may use the in-app contact form when logged in, or contact:
contact@murmely.be.
2. Legal basis
Murmely processes personal data on the following legal bases:
- Contractual necessity, to create an account, authenticate users and provide the core service.
- Legitimate interest, to secure the service, prevent abuse, maintain stability and process reports.
- Legal obligation, if a competent authority requires information under applicable law.
- User choice, for optional profile fields that users decide to complete.
3. Data processed by Murmely
Account and authentication data
Murmely stores a username, normalized username, email address, normalized email address,
user role, hashed password, creation date and update date. Passwords are not stored in plain text.
The email address is also stored to allow password recovery when a user forgets their password.
Authentication uses access tokens and refresh tokens. Refresh tokens are stored only as hashes
on the server side.
Optional profile data
Users may choose to provide an age, biography, social energy, relational expectations and personality tags.
These fields help other users understand the context of an exchange. They are optional unless explicitly
required by a specific feature.
Featured discussion topics and questionnaires
When a user creates a featured discussion topic, Murmely stores its title, description, selected image,
questionnaire questions, answer options and the creator's selected answers. This allows other users to
understand the topic before deciding whether they are interested.
Discussion requests and mutual consent
When a user indicates interest in a topic, Murmely stores a discussion request, its status,
questionnaire answers and consent decisions. A conversation is created only when both participants consent.
Conversations and messages
When a conversation is opened, Murmely stores the conversation and messages exchanged between participants.
This allows users to continue the exchange later. Message content is protected at rest in the database
to reduce direct exposure of conversation data.
Safety, blocks and reports
Murmely stores user blocks, user reports, report reasons, report source information and moderation status.
This is necessary to prevent blocked users from restarting interactions and to allow reports to be reviewed.
Contact requests
Murmely stores contact requests submitted from the application, including the selected request type,
message, status and processing date. This can include requests about personal data or account deletion.
Technical logs
Murmely stores technical logs to diagnose errors, investigate incidents and maintain service stability.
Logs may include technical routes, response status, execution time, correlation identifiers and diagnostic
information. Logs should not contain passwords, message content, biographies or report reasons in plain text.
4. Retention periods
| Data category |
Retention period |
Reason |
| Account data |
Kept while the account is active. |
Required to provide access to the application and identify the user's space. |
| Profile data |
Kept while the account is active, unless the user edits or requests deletion. |
Required to display the profile context chosen by the user. |
| Access tokens |
30 minutes. |
Short-lived authentication token used to access the API. |
| Refresh tokens |
Up to 30 days, unless revoked earlier. |
Used to keep a session active without asking the user to log in repeatedly. |
| Password reset codes |
30 minutes. Previous active codes are invalidated when a new request is created. |
Limits the validity window of account recovery codes. |
| Technical logs |
Maximum 30 days, except where needed for security, abuse investigation or legal requirements. |
Allows troubleshooting and incident investigation without keeping logs indefinitely. |
| Reports and blocks |
Kept as long as needed to protect users, prevent repeated abuse and document moderation decisions. |
Required for safety and moderation consistency. |
| Conversations and messages |
Kept while the account and conversation are active, unless deletion is requested or retention is required for moderation or legal reasons. |
Required to display conversation history and support moderation where applicable. |
| Contact requests |
Kept as long as needed to process and document the request. |
Required for support, privacy requests and follow-up. |
5. Hosting and processors
Murmely may use Render to host the API and PostgreSQL database infrastructure. In that context,
Render acts as a technical hosting provider and processes data only to provide the infrastructure
required for the service.
Murmely may also use an email provider to send operational emails, such as password reset messages.
6. Security measures
Murmely uses authentication tokens, hashed passwords, server-side secrets, refresh token revocation,
short-lived password reset codes and database-level protection for conversation message content.
No security measure is absolute. Murmely applies reasonable technical measures proportionate to the
current alpha stage of the service.
7. Sensitive data
Murmely does not intentionally request sensitive data such as ethnic origin, political opinions,
religion, health data, sexual orientation or biometric data.
Some fields are free text, such as biography, topics, messages, reports and contact requests.
Users should avoid entering sensitive information in those fields.
8. User rights
Subject to applicable law, users may request access to their personal data, rectification, deletion,
restriction of processing, portability or objection to certain processing based on legitimate interest.
Account deletion is not yet fully automated in the application. Users may request account or data deletion
through the in-app contact form or by contacting the address listed in this policy.
9. Moderation access
Murmely is built around mutual consent and safer exchanges. If a user reports another user, a conversation,
or a featured topic, the administrator may review the information necessary to assess the report.
This review may include profile information, the reported topic, report reason, conversation context,
and messages relevant to the report. This access is limited to moderation, user safety, abuse prevention
and legal compliance.
10. Changes to this policy
This policy may be updated as Murmely evolves, especially before a wider production release.
Material changes will be reflected on this page by updating the date at the top.