Last updated September 24, 2026

Privacy Policy

This policy explains the information Sinther currently processes and why. It is written to match the present codebase rather than claiming privacy features that are not implemented.

1. Information you provide

2. Technical information

The service necessarily processes technical information needed to deliver requests and prevent abuse, such as network requests, authentication/session data and timestamps. Firebase Hosting may process IP addresses and request information as part of hosting/security operations. Supabase processes authentication, database and realtime traffic. Cloudflare R2/Workers process uploaded and delivered media.

3. Browser storage

Sinther currently uses browser local storage for the Supabase sign-in session, encrypted-DM private key material on the device, Bite volume/mute preferences, and an optional developer performance flag. Private account-only database values are stored separately from the public profile directory and protected with row-level access rules. The application code does not currently set advertising or analytics cookies. See the Cookies Policy for details.

4. How information is used

Information is used to provide accounts, profiles, feeds, messaging, encryption features, servers, notifications, moderation, realtime updates, media delivery, security, abuse prevention and user-selected preferences. Sinther does not currently include an advertising or analytics SDK in this build.

5. Encryption limitations

Only rooms specifically presented as encrypted direct messages use Sinther's client-side encrypted-message flow. Regular DMs, server messages, profile data and social content are not represented as end-to-end encrypted. Even for encrypted rooms, operational metadata such as account identifiers, timestamps or delivery-related information may exist outside the encrypted body.

6. Service providers and external connections

Remote Google Fonts were removed from this build so simply opening Sinther no longer contacts Google Fonts. Core application fonts now use system-local fonts.

7. Public information

Public-profile information and content you choose to publish may be visible to other users subject to the product's privacy controls. Server visibility depends on server settings. Private-account controls limit certain in-app access but are not a promise that public-facing information can never be copied by another user.

8. Retention and deletion

Public profile data, posts, messages and server records are generally retained until they are deleted, moderated, or removed as part of an account/service lifecycle. Stories stop being presented as active after 24 hours, but removal of the underlying database/media object may occur later rather than exactly at the 24-hour mark. Custom status text is cleared by the application after its 24-hour lifetime. Moderation/security records and provider logs may be retained longer when reasonably needed for abuse prevention, security, disputes, legal obligations, backups or provider operations. Exact retention schedules for every category are not yet finalized.

This build does not yet expose a complete self-service account deletion/export/privacy-request workflow. That is a launch-readiness item and should be completed, with a monitored privacy contact, before relying on this policy as the sole mechanism for jurisdiction-specific data-rights requests.

9. Privacy rights

Depending on where you live and whether a particular privacy law applies to Sinther, you may have rights to request access to personal data, a copy of it, correction, deletion, information about disclosures, or to opt out of certain sale, targeted-advertising or qualifying profiling uses. The reviewed build does not intentionally sell personal data or include targeted-advertising functionality. A monitored request and appeal mechanism still needs to be added before broader launch where such rights apply.

10. Children

Sinther is not intended for children under 13. If the operator learns that an under-13 user has provided personal information in circumstances where collection is not permitted, the account and associated information should be reviewed and removed as legally required.

11. Security

Sinther uses access controls, authentication and database row-level-security rules, but no internet service can promise absolute security. Do not share login tokens or encrypted-DM private keys.

12. Your choices

Current controls include profile visibility, direct-message restrictions, blocking, notification-category preferences, server privacy controls and public-profile customization. Additional legal access/deletion/correction workflows may be required depending on where the service is offered and its scale.

13. Contact

Sinther does not currently publish a dedicated privacy contact address in this build. A monitored privacy/contact channel should be added before broader public launch, especially before relying on this page to satisfy jurisdiction-specific request requirements.