Privacy notice

1. Who is responsible

The intended operator and personal-data controller is Marla LLC, a limited liability company not yet formed. This notice does not represent that the entity already exists or has assumed obligations. Gino Leal currently operates the development pilot pending formation and a counsel-confirmed transition. Privacy requests in English and Spanish: [email protected].

This is the full notice for the pilot, including the Mexico section. It is not a statement that every law applies to a small pilot or that all required controls are ready. We do not sell personal data, share it for cross-context behavioral advertising or use behavioral ad targeting.

2. What information we use

We obtain information from you, your browser/device and connection, Cloudflare’s infrastructure, and people who interact with or report content. These categories can identify you directly or indirectly:

• Account and eligibility: email, optional display name, home country and postal code, interface language, adult declaration, account status and policy versions/timestamps. We use a birth date for the 18+ check but do not retain it. A failed age check can restrict sign-up on that browser for 30 days.
• Sign-in and security: email-code digests, passkey public credentials if enabled, session identifiers, sign-in timestamps, Turnstile results, device and network keys, rate-limit counters, links between accounts sharing those keys, and risk/hold signals. Marla never receives passkey private keys; your device or passkey provider keeps them, including any secure synchronization the provider offers.
• Your activity and content: posts, replies/messages, circle details, follows, saves, blocks, activity timestamps and service-action receipts (a keyed digest of the request, not its text) used to prevent duplicate or recreated actions.
• Reports and support: reported content, the reporter’s account, selected reason, details and review outcome; any information you choose to send for support or an appeal. A reported private message is shared for review only through the participant’s explicit report-evidence choice, not by opening the whole thread.
• Waitlist: email and its lookup key, language, time and reason for waiting; invitation/delivery status when available. An account need not have been created.
• Usage and administration: first-party events such as sign-up steps, active days and moderation outcomes, and administrative audit records. Analytics event rows do not contain message/post bodies, email addresses or precise coordinates, but may remain linked to an account until deletion.

Sensitive information: private-message contents, account-access credentials and content about health, religion, political opinions, ethnic origin or sexuality may receive special legal protection. You do not need to provide those details to join. Avoid unnecessary sensitive information, especially about others. A self-harm report may include health-related content. We do not use that information for advertising or to infer advertising profiles.

3. Location and audience

Sign-up uses the home postal code and country you provide, not GPS permission. We do not display your exact home postal code or live location as an account field. Cloudflare provides a connection-country hint; a country mismatch and network/device signals may affect safety checks or holds. These signals can be wrong, for example with a VPN, shared connection or travel. You may ask us to correct information or review a restriction.

Local delivery is designed around the audience/radius chosen for a post. A small local audience can still identify you from your words or surroundings; do not treat a radius as secrecy. This pilot notice does not authorize collection of precise GPS location. Any feature requiring it needs a separate, just-in-time explanation, required permission/consent and a notice update first.

4. Cookies and network identifiers

Marla uses first-party cookies for sessions, sign-in flow and security, including a random device-recognition cookie configured for about 400 days. The server stores a derived, keyed/hashed device identifier rather than a hardware fingerprint. Clearing cookies or using another browser can make a device look different; blocking necessary cookies may prevent sign-in or safety controls from working.

Under the approved design, a separate ledger will store successful account-creation timestamps and minimal device-recognition activity with the derived device key, without account email or account ID. It will enforce three successful accounts in total while that ledger is retained. Deleting an account does not immediately free a slot or remove that entry. Gino decided that the ledger record is deleted after approximately 400 days without recognized activity from that device, except a specific required legal hold. Recognized activity restarts this period; it is not measured only from the last account creation. Deletion can reset the count. Cookie lifetime and server-ledger deletion are separate controls.

Our infrastructure necessarily receives network addresses to handle requests. The app derives network/IP keys for rate limits, shared-network abuse checks and account safety links; providers may also process request/security logs under their service arrangements. A hash or keyed identifier is not necessarily anonymous. Marla’s app does not create a hardware/browser fingerprint for this account cap or use advertising cookies. Cloudflare Turnstile separately evaluates browser/device signals for bot detection.

Decided by Gino — remaining before publication: implement and test ledger deletion after approximately 400 days of recognized-device inactivity. This notice does not claim that cleanup is already implemented. Define the minimal qualifying activity that restarts the clock and verify cookies/provider logs; do not substitute cookie lifetime for server deletion.

5. Why we use it and your consent

Primary purposes needed for the requested service: create and secure accounts; check adult eligibility; send sign-in, requested waitlist and admission notices; deliver posts and private communications to their intended audience; operate circles, follows, saves and blocks; enforce limits; detect abuse; handle reports, appeals and rights requests; and meet legal duties. Minimal first-party operational statistics help us diagnose failures and measure whether the pilot works.

We rely on the legal basis applicable to each use, including necessary performance of the service relationship, valid consent and specific legal duties or exceptions. We do not treat all activity as blanket consent. Where Mexico law requires express or written consent, including for sensitive information or certain transfers, we must obtain it through an appropriate separate mechanism unless a lawful exception applies. A self-harm report about another person is not automatically an emergency exception; the relevant legal basis and any health-data obligations must be established before enabling that flow.

Secondary/optional purposes: there is no marketing mailing list, advertising profiling or optional promotional use authorized by this pilot notice. If we later offer marketing or optional research, we will identify it separately, obtain required consent and let you refuse or withdraw without losing the basic service.

To withdraw consent where applicable, oppose processing or limit use/disclosure, contact the privacy address below. Explain the processing involved. We will explain any lawful reason some information must remain and any feature that cannot operate without the essential processing; withdrawal does not undo processing already lawfully performed.

6. Private messages, moderation and human access

Private replies are available in the app only to the two participants, except when both explicitly choose to publish an exchange where that feature is available. The founder’s ordinary review tools do not provide a private-thread browsing view or show held reply bodies. A participant may expressly submit one reported private message and their report details to the founder as evidence. If the person you are messaging reports your message, that copy and their report details may be read by the founder even if you do not separately consent to the report. No surrounding thread messages are automatically included in that report. Do not include unnecessary details about others.

Cloudflare infrastructure stores/processes communications. Automated safety tools process messages where configured; privacy here is an app-access rule, not a technical impossibility of access. Messages are not end-to-end encrypted in this pilot; administrators with authorized database access may technically access stored content, and providers process it as needed to operate the service. Lawful disclosures may also apply.

The active pilot uses English/Spanish word lists for slurs/threats and safety holds. Unaccepted contact can be checked or blocked; the pilot rule exempts mutual-follow chats from the server slur/threat word-list block. Separate legacy English masking and client-side checks may still affect sent or displayed text. A planned meaning-based AI safety check would run in Marla’s own Cloudflare account, but it is not yet bound or validated. We do not send content to unrelated AI companies for that planned moderation check, but Cloudflare itself is an external processor. This notice does not authorize training general-purpose AI models on private messages.

The founder can see account/support information, relevant device/network associations, public posts and operational safety signals needed for review, as well as explicitly submitted report evidence. The dashboard also has aggregate statistics with small-sample protections; not everything in the dashboard is anonymous or aggregate.

A self-harm report can alert the founder with the author’s name and reported public post. It does not automatically hide the post or punish the person. Marla is not an emergency service or continuously monitored. For immediate danger use 911; US crisis support is 988, and Mexico’s Línea de la Vida is 800 911 2000.

Decided by Gino: retain the narrow exception: review only one specific private message expressly shared by a participant in a report, plus their voluntary report explanation; no automatic surrounding messages or whole-thread access. Verify clear consent and audited access, without claiming technical impossibility of privileged access.

7. Who receives information and where

• Chosen audience and participants: people who can see your posts, the person you reply to, or both participants in a private exchange. Public displays can be copied outside Marla.
• Infrastructure: Cloudflare provides hosting, Workers, D1, Turnstile, Access and Email Sending. Workers AI would be used only if enabled later as disclosed. Data can be processed in the United States and other places where the provider operates.
• Support and safety: the founder processes requests and the limited evidence/signals described above. Approved service providers may handle a request only under the required confidentiality and processing restrictions.
• Legal/safety recipients: competent authorities in response to valid legal duties/process, NCMEC where reporting is required, or emergency responders when a lawful safety exception permits. In a DMCA counter-notice, the required identifying/contact information is forwarded to the original complainant.

Mexico: processors are not the same as transfers. Cloudflare processing solely on our instructions is processing by an encargado, subject to proper arrangements. Disclosure to a separate recipient acting for its own purposes, inside or outside Mexico, can be a transfer. Sharing with a chosen audience and lawful authority/NCMEC disclosures require the correct legal analysis too. We do not infer consent to every international transfer from your joining Marla.

Required before Mexico admission: confirm recipients, countries, purposes, processor agreements and the applicable transfer exceptions/consent. Add a clear accept/refuse mechanism for any consent-required transfer; do not perform that transfer without it. No unrelated advertising transfers are authorized. Any future proposal to change the no-sale/no-behavioral-targeting commitment cannot retroactively authorize sale or ad-targeting use of data collected under this notice; mandatory rights and fresh-consent requirements still apply.

8. Retention and deletion

The following launch schedule was approved by Gino on Nov 7, 2026; it is not a statement that all purge jobs are implemented.

Legal preservation: applicable law or a valid preservation duty can require specific data longer. For a required NCMEC CyberTipline report, US law generally requires preserving reported contents and reasonably accessible contextual material for one year after submission; a court or other legal duty can require longer. The ordinary 30-day evidence schedule must not erase required evidence.

Launch blocker: current erasure paths can clear report excerpts and do not yet demonstrate legal-hold protection. Purge scheduling, waitlist cleanup, audit/key retention and backup limits also need implementation/verification. Do not publish automatic deletion or preservation guarantees until tested.

9. Your choices and requests

You can edit available account settings, block contact, sign out, delete your content/account in the app, or email [email protected] for access, correction, a portable copy where applicable, deletion/cancellation, objection, consent withdrawal or limiting use/disclosure. You do not need to create an account to send a request.

Tell us your name or account identifier, a reply method, what right/change you want and enough detail to find the relevant information. Do not send a sign-in code or an ID document in the initial email. We will arrange proportionate identity/authority verification where required, using existing account controls where appropriate. An authorized representative can act with proof of authority. Information collected to verify a request is used for that purpose, not advertising.

We explain any lawful denial, partial response, retention exception or needed clarification. Necessary processing may mean a requested feature cannot continue; we do not punish you for exercising legal rights. Requests are generally free; any exceptional lawful copying/shipping cost must be explained in advance. Retention exceptions are not blanket permission to keep everything.

10. Mexico — full notice and ARCO rights

This notice is intended to address the Ley Federal de Protección de Datos Personales en Posesión de los Particulares issued in 2025, as applicable and amended. The Spanish version is available through the language link. The controller’s physical address, consent flows and other marked gaps must be resolved before Mexico admission.

You may exercise Access, Rectification, Cancellation and Opposition (ARCO), revoke consent where applicable and ask to limit use/disclosure at [email protected]. The privacy contact handles these requests. Identify the right sought, the relevant data (not required to specify all data for an access request), your name and notification method, and evidence of identity/representative authority through the proportionate verification process. For rectification, state the change and supporting information. Access is provided in a readable electronic copy or another agreed lawful format.

We communicate our determination within 20 business days from receipt and, if the request is granted, implement it within 15 business days after communicating that determination. Each period may be extended once for an equal period when justified, with notice. Any legally permitted clarification, exception or suspension must be explained; it is not an open-ended delay. Cancellation may require a restricted blocking period for legal responsibilities before final deletion.

If you disagree with the response, you may start a rights-protection proceeding before the Secretaría Anticorrupción y Buen Gobierno, within 15 business days after the response is communicated for the response-challenge route described in Article 40, subject to the applicable statutory procedure. If we fail to respond on time, you may apply once our response deadline expires. Other situations, including incomplete compliance, are governed by applicable law; keep your request and proof of delivery. No internal appeal waives or postpones that route.

The categories, primary purposes, optional purposes, recipients/transfers, retention and update methods are described above and below. We do not rely on silence for sensitive-data consent where express written consent is legally required. Consent withdrawal/limits follow the contact and verification procedure above; we respond within applicable legal periods and explain any continuing lawful duty.

11. United States — applicable privacy rights

Depending on your state and whether the relevant law applies to Marla, rights may include knowing/accessing categories and specific data, a portable copy, correction, deletion, restricting sensitive-data use, and opting out of sale, sharing, targeted advertising or certain legally significant profiling. These include CCPA rights as amended by the CPRA when applicable. We do not sell or share data for cross-context behavioral ads and do not use behavioral ad targeting.

Contact [email protected]; authorized agents may submit requests with required authorization. We do not require identity verification for an opt-out where law prohibits it. Global Privacy Control or another legally recognized universal opt-out signal does not cause us to sell or share data; we must honor applicable signals where law requires. No applicable financial-incentive program is offered.

Where CCPA applies, we acknowledge a know/delete/correct request within 10 business days and respond within 45 calendar days, with a permitted additional 45 days only after timely notice and explanation. Opt-outs are handled as soon as feasible and within the applicable legal maximum, generally 15 business days for California. Other state deadlines and exceptions may differ; we follow the applicable rule rather than using a universal extension.

If we deny a request, we explain why and any available appeal. To appeal, reply to the privacy contact with “Privacy appeal” and the original request. We respond within the applicable state deadline, or explain that no statutory appeal applies; we do not require a moderation appeal first. You may complain to your state attorney general or applicable privacy regulator, including California’s privacy agency where relevant. No discrimination for exercising rights.

The categories in section 2, sources, purposes, recipients and retention above describe our pilot practices; we have no sale/sharing-for-behavioral-ads practice. Before a covered broader launch, the notice-at-collection and state-specific rights/deadline/appeal requirements must be checked, including any required additional request methods. This notice does not claim all state privacy laws apply.

12. Children and account eligibility

Marla is intended only for adults 18+. We do not knowingly permit accounts for people under 18. If we learn we collected personal information from a child under 13 in a way covered by COPPA, we stop the collection/use and delete it as required, subject only to a specific lawful preservation duty. An age declaration is not an exemption from COPPA.

Parents/guardians or anyone with a concern can contact [email protected] without an account. Provide enough information to locate the account, not extra information about the child. We verify requests proportionately and do not ask a child to send ID documents through ordinary email.

13. Email and possible future features

Sign-in codes, requested waitlist/admission notices and essential account/security notices are service communications. Joining a waitlist or accepting Terms does not subscribe you to marketing. You can withdraw a waitlist request at [email protected]; essential account messages may continue while you use the account.

If optional commercial email is offered later, it needs separate permission where required, accurate sender/subject information, a valid postal address and a clear working opt-out. We honor commercial-email opt-outs within 10 business days or sooner if local law requires, and keep only a minimal suppression record as needed to respect the choice. No unrelated promotion is bundled into sign-in emails.

No paid features are active. Before launching an optional paid feature, we will provide the necessary terms and data notices and obtain required consent. This notice does not authorize storing government IDs, creating biometric templates, charging you or profiling people for ads.

14. Security, changes and contact

We use access restrictions and security controls appropriate to the service, including protected administration and bot checks. No online system can promise perfect security. We must notify affected people of qualifying breaches as the applicable law requires, including immediate notice of breaches significantly affecting patrimonial or moral rights under Mexico law. Do not use this pilot for information you cannot risk disclosing.

We will show an updated version/date and communicate material changes in-app and/or by email before a new use where law requires. A new consent-required purpose or transfer needs the required consent before processing, not just a changed document. The notice must be available at or before collection.

Privacy requests and questions: [email protected]. Marla LLC is the intended future operator/controller and is not yet formed; Gino Leal currently operates the development pilot pending formation and a counsel-confirmed transition. The formation state remains TBD. Physical/service address: Marla LLC, Tucson, Arizona. Mandatory privacy and consumer rights where you live remain available regardless of Arizona law in the Terms.