Mela
Effective August 4, 2026 · Mela is made by Cornerstone Venture Holdings LLC, a Wyoming limited liability company.
Mela helps families, friends, and communities gather — birthdays, dinners, potlucks, neighborhood meetings. To do that well, it holds information that matters to you: who you invite, when your people's birthdays are, what your community's documents say.
You shouldn't need a law degree to understand what happens to that information. This policy explains what Mela collects, why, who can see it, and the choices you have. It covers the Mela iOS app and the Mela web pages at joinmela.co, including invitation pages that work without an account.
Our privacy principles
Your account. You need an account to host events or join communities, so we collect what an account requires:
| We collect | Because | Required? |
|---|---|---|
| Name and email | Apple or your email provider sends these when you sign in; they identify your account | Yes |
| Phone, photo, bio, birthday, anniversary | They personalize your profile and reminders | No — all optional |
There are no passwords. Sign in with Apple works with Apple's private relay if you prefer to hide your email; email sign-in uses a one-time code in the app, or an emailed sign-in link on the web.
Your people. Mela keeps your private list of family and friends so you can remember birthdays and send invitations. You can type people in, or import them from your contacts. If you allow contacts access, we import only a person's name, one phone number, one email address, and birthday — never your full address book. You can revoke contacts access anytime in iOS Settings.
Your events. Event names, dates, places, descriptions, guest lists, RSVPs, potluck lists, and date polls — the things hosting requires.
Your communities. Your membership and role, what you post (announcements, potluck items, vendor recommendations, reported issues), your volunteer signups and attendance, and anything you upload.
Files and photos. Photos on events and people, community logos and documents, issue photos, and expense receipts. Files are stored with our hosting provider. Community documents live in private storage and open through short-lived links that expire after about two minutes. Photos are served through long, unguessable links, the same way invitations are (section 5) — Mela shows them only to the people involved, and a photo's link should be treated like the photo.
Many of the people in Mela never create an account. That's normal, and it's by design.
When you host a dinner, you invite your neighbor — and your neighbor shouldn't have to download an app to say yes. So hosts add guests by name and phone number or email, guests receive a link, and the link works in any browser. When you save your mother's birthday, she doesn't need an account either. When a community keeps an emergency contact list, the plumber on it has never heard of Mela.
Here is exactly what that means for the information involved:
Mela is not directed to children under 13, and you must be at least 13 to create an account.
Adults use Mela to organize family life, and that means adults may add information about their own children and other minors — a child's name and birthday on the family calendar, a children count on an RSVP so the host makes enough food. That information belongs to the adult who entered it, stays within their household or event, and is deleted with it. If you believe a child under 13 has created an account, contact privacy@joinmela.co and we will delete it.
Two features use AI, and we want you to know exactly what happens when you use them.
When you ask Ask Mela a question, Mela sends only what's needed to answer it: the text of your community's uploaded documents, and your question. The answer comes back with the document and page it rests on, and Mela checks that the quoted passage really appears there before showing it.
When you scan a potluck list, the photo you choose is sent to be read, and Mela keeps the resulting checklist — not the photo.
What does not leave Mela: your name, your email, and your account identifiers. The documents, the question, or the photo — nothing else.
What is retained: questions asked of Ask Mela are kept, with their answers, in a log the community can review. If you later delete your account, your questions stay in the log but are no longer attributed to you.
The processing is done by Anthropic, our AI provider, under commercial API terms we verified before writing this policy: Anthropic does not use content sent through its API to train its models, and its data processing agreement (including EU Standard Contractual Clauses) is part of those terms. Content flagged by Anthropic's automated safety systems can be retained by Anthropic for up to two years.
The app tells you this is happening before content is sent. And if a community's board prefers not to use Ask Mela, the documents work exactly as before — the feature is optional.
Invitations, community join pages, and program pages work through links, because guests shouldn't need accounts.
Anyone who has an event's link can open it and see what the host put on the invitation — typically the event's name, host name, date, and place. Treat a link like the invitation it is: share it with the people you'd invite. Link previews in messaging apps show the event's title and design, because that's what makes the link recognizable.
Guest lists and potluck details appear only after a guest has responded.
The Mela website sets a small number of functional cookies. There are no advertising or analytics cookies, and no third-party trackers. The public pages (the homepage, guides, feature and comparison pages) send Mela one cookieless page-view count per load: the page, the site you came from, a device type, and a one-way hash of your address and browser that changes every day and cannot be reversed. Invitation, RSVP, album and account pages send nothing.
| Cookie | What it does | How long |
|---|---|---|
| mela_vk | A random identifier that counts distinct invitation views and keeps poll votes from counting twice | 1 year |
| mela_join | Remembers which community you were joining while you sign in | 30 minutes |
| Session cookies | Keep you signed in to your web account and admin pages | Until sign-out or expiry |
The mela_vk identifier is random — not derived from your address or device — and is never used to follow you across sites. The iOS app doesn't use cookies.
If you turn notifications on, we store your device's push token and deliver through Apple's push service (or your browser's push service, for web members). A notification's content — an RSVP arriving, a birthday reminder — passes through those services to reach you.
Email from Mela is transactional only: invitations, sign-in codes, RSVP confirmations, community notices. We do not send marketing email. Our email provider records delivery results (delivered, bounced, complained) so we stop sending to addresses that don't work.
This list is short because we collect little automatically:
| What | Why | What it contains |
|---|---|---|
| Crash and error reports | So we can fix what breaks | What went wrong, where in the code, device model, OS version, app version — configured to exclude personal information |
| Infrastructure logs | Our hosting providers keep short-lived request logs, as nearly every online service's do | Standard web-request data, including IP addresses |
| Abuse prevention | To rate-limit hostile traffic | IP addresses, held transiently with short expirations |
| Service health | To know Mela is up | Synthetic test events and daily aggregate counts with no personal information |
Mela contains no advertising SDKs, no analytics SDKs, and does not request your device's location. Places on events are text you type, not GPS.
We use information to run Mela: deliver invitations and RSVPs, remind you about your dates, operate communities, answer questions from uploaded documents, send notifications you asked for, keep the service secure, respond when you write to us, and meet legal obligations.
We do not sell personal information. We do not use it for advertising. We do not use it to train AI models. We do not combine it with outside data sources to profile you.
| Information | Visible to |
|---|---|
| Profile basics (name, photo) | People you interact with — hosts you RSVP to, communities you join |
| Your people and their dates | Only you and your household |
| Event details | The event's participants (and anyone with the link — section 5) |
| Community content | That community's members |
| Membership requests, question log, admin records | That community's administrators |
Inside Mela the company, production access is limited to authorized personnel. By that we mean something specific: the people — employees, contractors, or service providers — whose role requires access, and only for five purposes: user support, security, abuse investigation, technical troubleshooting, and legal compliance. Mela is a small company today, so that list is short, and access is limited to what the task requires.
Mela runs on a deliberately small set of providers. Each exists for one reason, and each processes your information only to provide its service to us:
| Category | Provider | Why it exists in Mela |
|---|---|---|
| Infrastructure | Supabase | The database and file storage everything lives in |
| Infrastructure | Vercel | Hosts the website and invitation pages |
| Authentication | Apple | Sign in with Apple |
| Notifications | Apple | Delivers push notifications to your device |
| Resend | Delivers invitations, codes, and notices | |
| Artificial intelligence | Anthropic | Answers Ask Mela questions and reads potluck photos (section 4) |
| Diagnostics | Sentry | Receives crash and error reports so we can fix them |
| Maps | Apple | Suggests places when you type an event location |
| Search | Rainforest API | When you search gift ideas, your search text fetches product results; no account information goes with it |
| Rate limiting | Upstash | Holds short-lived counters that block abusive traffic |
| Fonts | Google Fonts | Serves the typeface on invitation pages — your browser fetches it directly from Google |
Beyond these providers, we disclose personal information in only three situations: to the people the product is designed to show it to (section 10); when law, subpoena, or court order requires it, or to protect the safety of our users or others; and in a merger, acquisition, or sale of assets — where this policy continues to apply and we will tell you about any change in ownership.
If you have an account:
| You can | How |
|---|---|
| See and correct your information | Everything is viewable and editable in the app |
| Delete your account and its data | Profile → Delete account |
| Turn off permissions | Contacts, notifications, camera, and photos — each in iOS Settings, anytime |
| Request a copy of your data | Write to privacy@joinmela.co; a person will respond as applicable law requires. There's no export button yet — we'd rather tell you that than pretend |
Deleting your account removes your account, your people, your events and their content, your uploaded files, and your device tokens. Three honest exceptions: content you contributed to shared spaces (a community announcement, an Ask Mela question) remains without your name on it; communities with other members continue under a new owner; and details a host holds about you as their guest belong to that host — covered next.
If you don't have an account and someone entered your information into Mela — as a guest, a contact, or on a community list — you can ask to see it, correct it, or have it removed. Write to privacy@joinmela.co. We verify requests using the identifiers available (such as the phone number or email that was entered) and act on them. When we remove information this way, we may briefly tell the organizer that a removal happened — without detail beyond that.
We answer rights requests within the time applicable law requires. If we can't verify a request, we'll tell you rather than act on it.
California residents have the right to know what personal information we collect (sections 1 and 8 are that disclosure, in full), to access it, correct it, delete it, and to equal service if you exercise those rights. The mechanisms in section 12 serve all of these.
You may use an authorized agent for requests; we verify the agent's authority and your identity before acting.
Mela version 1.0 is offered on the United States App Store, and Mela is operated from the United States. If you use Mela or open a Mela link from elsewhere, your information is processed in the United States and wherever our service providers operate. Where providers move data across borders, they rely on their own compliance frameworks — for example, our AI provider's data processing terms incorporate EU Standard Contractual Clauses.
If you're in the European Economic Area or the United Kingdom: our legal bases are contract (running the service you signed up for), consent (contacts access, notifications, AI features), and legitimate interests (security and keeping the service working). You have the rights in section 12, plus the rights to object, to restrict processing, and to complain to your data protection authority.
No service can promise perfect security, and we won't. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires. Security researchers: security@joinmela.co.
We keep personal information while your account is active, or while the event or community it belongs to exists. Deleting something — an item, a person, your whole account — takes effect in our production systems right away. Residual copies in our providers' encrypted backups are removed according to those providers' backup retention schedules. Records needed for legal compliance, abuse prevention, or resolving disputes are kept only as long as those needs last.
If we change this policy in a way that matters, we'll say so in the app or by email before the change takes effect. This page always shows the current version and its effective date.
| For | Write to |
|---|---|
| Privacy rights and requests | privacy@joinmela.co |
| Support | support@joinmela.co · hello@joinmela.co |
| Legal | legal@joinmela.co |
| Security reports | security@joinmela.co |
| Abuse | abuse@joinmela.co |
Cornerstone Venture Holdings LLC
30 N Gould St #37410, Sheridan, WY 82801, United States