Legal

Privacy Policy

Last updated: 2026-07-03

m3llo is operated by Mollo Tech AB ("we", "us", "our"). This policy explains what personal data we collect when you use the m3llo app and the m3llo.app website, why we collect it, and your rights under the General Data Protection Regulation (GDPR).

Short version: we collect what the service needs to work, we keep it in Europe wherever we can, we do not sell it, and there is no advertising anywhere in m3llo.

1. Data controller

2. What we collect

• Account data: your email address (for authentication) and chosen nickname.
• Content you create: chat messages, reactions, and clips you or your crewmates capture (see section 4).
• Crew activity: which crews you belong to, voice session participation and duration, streaming sessions, and games detected as running while you use m3llo. This data powers the crew feed, session replays, and weekly recaps, which is the core of the product.
• Technical data: IP addresses and connection metadata needed to establish voice and streaming connections and to keep the service secure. Server logs are kept briefly for operations and security.
• Website analytics: anonymous, cookieless usage statistics via Plausible Analytics. No individual tracking, no advertising identifiers.

3. Voice and streaming

Live voice and game streams are transmitted in real time and are not recorded or stored by us. Where possible, connections are made directly between crew members (peer-to-peer). For larger crews, media is relayed through our infrastructure in Europe without being stored.

4. Clips

Any member of a voice session can capture a clip: the last 30 seconds of the session's mixed audio. By joining a voice channel in a crew, you should be aware that crewmates can capture clips of the conversation. Clips are:

• Visible only to members of the crew they were captured in. Clips are never public by default.
• Stored on European infrastructure.
• Retained for 7 days on the free tier, after which the cloud copy is deleted automatically. Paid plans can retain clips longer.
• Deletable by the person who captured them and by crew administrators.

If you do not want to appear in clips, leave the voice session or ask your crew to not capture clips. Contact us if a clip containing your voice needs to be removed and the crew cannot resolve it.

5. Game data and third-party game services

The crew feed can show how your play sessions went. For most games this data is read locally on your machine, from official integrations the games themselves provide (for example Counter-Strike 2's Game State Integration), and only session summaries — game, duration, wins and losses, basic match stats — are shared with your crew.

For League of Legends and Teamfight Tactics you can optionally link your Riot ID. If you do, we store your Riot ID and the player identifier (PUUID) Riot assigns to it, and our backend fetches your own recent match results from the Riot Games API after your play sessions (match outcome, your score line, champion played) to enrich your session summaries. We never request data about players who have not linked their account, the results are visible only to your crews, and you can unlink your Riot account at any time, which deletes the stored link and stops all Riot API requests for your account.

m3llo isn't endorsed by Riot Games and doesn't reflect the views or opinions of Riot Games or anyone officially involved in producing or managing Riot Games properties. Riot Games and all associated properties are trademarks or registered trademarks of Riot Games, Inc.

6. Why we process your data

7. Processors we use

• Render: hosting for our backend, including authentication and chat.
• Cloudflare: content delivery, clip storage, and edge services.
• Google Cloud: voice and streaming relay infrastructure, hosted in the EU.
• Plausible Analytics (Plausible Insights OÜ, EU): cookieless website analytics.

All processors are bound by data processing agreements. Where a processor's parent company is outside the EU, transfers are protected by EU Standard Contractual Clauses.

8. Data retention

9. Your rights

Under GDPR you have the right to:

• Access your personal data and receive a copy of it
• Correct inaccurate data
• Delete your account and data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, email privacy@m3llo.app. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

10. Security

Data is encrypted in transit. Voice and streaming use DTLS-encrypted WebRTC connections. Access to production systems is restricted, and we review our security posture regularly. The client and backend source code is open at GitHub, so you can verify how your data is handled.

11. Self-hosted instances

m3llo is open source and can be self-hosted. This policy covers only the hosted service at m3llo.app. If you use a self-hosted instance, the person or organization running that instance is the data controller for it, not us.

12. Children

m3llo is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will remove it.

13. Changes

We may update this policy. Material changes will be announced in the app or by email, and the date at the top of this page always reflects the current version.

14. Contact