Freedom, plurality, safety: Keeping Mastodon private and secure

Social networks have long accustomed us to the idea that users love getting together and making friends. But once Facebook, Instagram, X (ex-Twitter), TikTok, etc. became too big for those who prefer smaller communities. Pushed out of the original social network, they decided to join Mastodon.

Mastodon is an open-source software based social platform, similar to X, but decentralized. It works on multiple decentralized servers (called “instances”), brought together to form a single network and interact with each other. Users can select instances according to their preferences and settings, but still communicate with members from other instances. That offers better customization and control.

Kaspersky experts have prepared useful tips and insights to help users strengthen their privacy level and keep personal data secure.

What about privacy policy?

Specific privacy policies are issued for each instance. On the whole, they all contain basic clauses regarding data collection, usage, storage and security, and about sharing information with third parties. On the odd occasion, you might come across a particularly law-abiding server that mentions users’ rights to delete, amend, or do other things with collected personal data — usually these are EU servers that are subject to the GDPR.

So, let’s set up a privacy setting

Some settings can look familiar if you’re an X user. There are several types of Mastodon accounts: public (available for everyone), unlisted (your posts are still visible to everyone, but they’re not listed on public timelines), and available only for your followers.

It is important to note that each server has its own privacy policy, so don’t forget to explore all details before registration. Bearing this in mind, a safe tip is to only use instances that you trust, and do not share any personal data with users that use servers that you don’t trust.

Posts can also have three privacy levels. The ones visible to everyone, those visible to followers, and ones that only appear to users mentioned in the post.

A good option is to establish rules and exceptions for auto-deleting posts and so that archivists can export and download the complete archive of all