Mastodon is free, open-source decentralized social software in which each server is an independently operated entity interoperating through the ActivityPub protocol. The project states it will never serve ads or push profiles, feeds are chronological with no algorithms, and the software is developed by a nonprofit -- Mastodon GmbH in Berlin alongside Mastodon, Inc., a US 501(c)(3) (EIN 92-3333630), with a 2025 restructuring that transferred the trademark and assets to the nonprofit and replaced founder control with a board. Because anyone can run a server, data practices ultimately depend on the server a user joins -- the project's promises bind the software and flagship infrastructure, not every independent operator.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
COLLECTION
Mastodon's project site describes the software as free, open-source decentralized social media in which each server is a completely independent entity able to interoperate with others to form one global social network -- data collection practices are set by each server's operator rather than centrally.
Mastodon's about page identifies its legal entities as Mastodon GmbH, registered in Berlin under HRB 230086 B, and Mastodon, Inc., a US 501(c)(3) nonprofit with EIN 92-3333630 located in New York; the page also discloses that the German entity was incorporated as a gGmbH in 2021 and lost that nonprofit status when Germany removed software projects from eligibility.
As reported by TechCrunch on 2025-01-13, Mastodon announced a transition handing ownership of key ecosystem and platform components to a new European nonprofit organisation; TechCrunch reported on 2025-11-18 that founder Eugen Rochko stepped down as CEO with the trademark and assets transferred to the nonprofit, Felix Hlatky becoming Executive Director, and a board including Biz Stone.
Mastodon's project site states the software is developed by a non-profit organization and describes no advertising, analytics, or data-partner relationships; the federation model means posts replicate to independently operated servers whose own practices the project does not control.
Mastodon's server software is developed publicly on GitHub under the mastodon organisation, where its data handling and release history are open to independent inspection; no breach or regulatory action involving the project appears in the drafted record.
In a security advisory published by the Mastodon project on July 6, 2023 (GHSA-9928-3cp5-93fm, CVE-2023-36460, CVSS 9.9), Mastodon disclosed a critical arbitrary-file-creation flaw in its media processing code and stated the issue was found by the security firm Cure53 as part of an audit performed at Mozilla's request; the advisory credits Cure53 as finder and records the fix as shipped in versions 4.1.3, 4.0.5 and 3.5.9. This is a published third-party audit of the project's own codebase with the findings and remediation disclosed publicly rather than held back.
Mastodon publishes a responsible-disclosure policy in its official documentation (last updated September 29, 2025) that defines a reporting channel (GitHub security issue or security@joinmastodon.org), asks reporters not to disclose publicly before a fix, and publishes an explicit scope boundary: a vulnerability in Mastodon means one in the code distributed through the project's main GitHub repository, while installation-specific issues are directed to the operator of that server. The same page states that the project does not provide a bug bounty program at this time, so the program is a coordinated-disclosure policy rather than a funded bounty.
As reported by TechCrunch on 2025-11-18, Mastodon's 2025 restructuring was disclosed openly: the founder cited burnout, remained as advisor, and control passed to a nonprofit board -- a governance change announced by the project itself rather than surfaced by regulators or investigation.
Mastodon's project site states there are no algorithms or ads, that users receive posts in chronological order, and that the project will never serve ads or push profiles for users to see.