Privacy Policy

Last updated: 9 June 2026

Who we are

Mutiny is made by Second Order Labs Ltd, a company registered in England and Wales (company number 17077703), with its registered office at 3rd Floor, 86–90 Paul Street, London, EC2A 4NE, United Kingdom. We are the data controller for the personal data described in this policy.

You can contact us about anything in this policy at hello@secondorderlabs.net.

What we collect

Account information

When you sign in with Apple, Google, or an email link, we receive your email address, your name (if your sign-in provider shares it), and an account identifier from that provider. If you set up a passkey, we store its public key — passkeys never give us access to a password or your device.

Content you create

Mutiny exists to support a goal you care about, so we store what you put into it: your goal and the details you describe about it (such as why it matters and what success looks like), your check-ins and any comments you add to them, the reactions and notes you exchange with allies, and your check-in schedule. We also store your first name and timezone for your profile.

Device and technical data

If you enable notifications, we store a push notification token for your device so Apple or Google can deliver them. We also record your device platform and app version so the app behaves correctly and we can diagnose problems.

Usage analytics

We use PostHog, hosted in the European Union, to understand how Mutiny is used — which screens are viewed, which features are used, and when errors occur. Analytics are tied to a pseudonymous user identifier, not used for advertising. We do not record your screen or use advertising identifiers.

What we don't collect

We don't collect your location, contacts, photos, or browsing activity, and we don't track you across other apps or websites. The camera is used only to scan ally invitation QR codes — images are processed on your device and never stored or uploaded.

Sensitive information in your goals

The goal you choose may reveal something personal — about your health, habits, or circumstances. We treat everything you write in Mutiny as private content: we use it only to provide the app to you and the allies you invite, we never use it for marketing or profiling, and our team does not read it except where strictly necessary to investigate a problem or a report of abuse.

How we use your data

• To provide Mutiny — storing your goals and check-ins, connecting you with allies, and syncing across your devices. Legal basis: performance of our contract with you.
• To send notifications — check-in reminders and updates from your allies, only if you grant notification permission, which you can withdraw at any time in your device settings. Legal basis: consent.
• To improve the app and fix problems — analytics and error reports. Legal basis: our legitimate interest in running a reliable product.
• To keep the service safe — preventing abuse and securing accounts. Legal basis: our legitimate interest in protecting our users and service.

What your allies can see

Mutiny is built around accountability between people who trust each other. When you invite someone as an ally and they accept, they can see your first name, your goal, and your check-ins, including any comments you write — and they may receive notifications when you check in. You choose who to invite, and you can remove an ally at any time, which ends visibility in both directions.

Who we share data with

We never sell your data and we don't share it with advertisers. We use a small number of service providers to run Mutiny:

• Supabase — hosts our database and authentication, in Frankfurt, Germany (EU).
• PostHog — usage analytics, hosted in the EU.
• Apple and Google — sign-in and delivery of push notifications to your device.
• Capgo — delivers app updates.

Each provider processes data only on our instructions. We would also disclose data if legally required to do so, or as part of a sale or restructuring of our business — in which case this policy would continue to apply to it.

Where your data is stored

Your data is stored in the European Union, which the UK recognises as providing adequate data protection. Where a provider such as Apple or Google processes limited data (like push notification delivery) outside the UK or EU, it does so under recognised safeguards such as standard contractual clauses.

How long we keep your data

We keep your data for as long as your account is active. Routine database backups are retained for a limited period (no more than 35 days) before being overwritten.

Deleting your account

You can delete your account at any time from Settings inside the app. Deletion removes your profile and personal content: your goal details and check-in comments are permanently erased, your devices and sign-in identities are removed, and your email address is deleted from our systems. Reactions you previously sent to allies remain on their check-ins, without your name attached.

If you can no longer access the app, email hello@secondorderlabs.net from the address linked to your account and we will delete it for you.

Your rights

Under UK data protection law, you have the right to:

• access a copy of your personal data;
• correct inaccurate data;
• have your data erased;
• receive your data in a portable format;
• restrict or object to certain processing;
• withdraw consent where processing is based on it.

To exercise any of these rights, email hello@secondorderlabs.net. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

Children

Mutiny is not intended for children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Changes to this policy

If we make material changes to this policy — for example, if we introduce new features that change what we collect — we will update this page and let you know in the app before the changes take effect.