Privacy Policy

1. Information We Collect

Account Information

Account data is used to create, authenticate, and maintain your Essyntia account.

• Email address
• Username and display name
• Supabase authentication identifiers and session data
• Password credentials handled by Supabase for password accounts
• Google account information returned during optional Google OAuth
• Date of birth and confirmation that you are 18 or older (required to use Essyntia)

Profile Information

You may provide profile and preference information, including:

• Biography and profile image
• Country or region
• Preferred language and automatic-translation preference
• Topic interests
• Essyntia State, evaluation, and Essence progression information

User-Generated Content

We process content and safety information you create or submit, including:

• Posts, comments, replies, reactions and reasoned responses
• Profile and post images, and videos you upload to posts
• Links you share to videos on other platforms and the preview Essyntia builds for them (title, author, thumbnail)
• Group participation and contributions
• Direct messages and encrypted message attachments
• Reports, moderation records and related review signals
• Review requests (appeals) you send and the team's response
• Accounts you block

System and Usage Data

The service also processes technical, security, and activity data needed to operate and understand the product.

• Request and diagnostic data such as masked IP, country or city signals, browser, user agent, and timestamps
• First-party page, search, interaction, and session-heartbeat events
• Referrer, path, feature use, and activity duration
• Message encryption version, device identifiers, public-key records, key identifiers, and encrypted-key metadata
• Language and locale signals detected from your browser
• Technical media metadata measured from your uploads (file size, duration, width and height, video and audio codec) and a poster frame generated on your device
• On the Android app: a Firebase Cloud Messaging push token, app version, and device language for each installed app, plus your notification preferences

2. How We Use Your Information

We use information to provide and secure Essyntia, personalize content, support communication, evaluate account progression, moderate abuse, translate content when requested or enabled, analyze first-party product activity, diagnose failures, and comply with applicable obligations.

• Create, authenticate, and maintain accounts
• Provide feeds, profiles, groups, direct messages, attachments, and notifications
• Personalize topics, language, translation, and interface preferences
• Operate evaluations, State, and Essence features
• Detect, review, and respond to abuse, spam, reports, and security incidents
• Measure first-party product usage and diagnose reliability
• Comply with applicable legal obligations

3. Data Storage and Security

Essyntia uses Supabase for database, authentication, realtime and file storage functions, including private storage for post videos; Vercel for application hosting and request delivery; Supabase Storage (or Cloudflare Images, when enabled) for profile and post images; and Amazon S3 for encrypted message attachment objects. Data is transmitted over HTTPS. Post videos never have a public address: each playback is authorized by the server, which checks that you can see the post, and is delivered through a short-lived signed link. Before uploading a video, the app removes the recording location coordinates from its metadata, and the server rejects videos that still contain them. Before an image is published, the app re-encodes photos on your device and Essyntia's server removes the metadata stored in the file (such as EXIF data with the GPS location and camera details, XMP and comments), keeping only the orientation; images that cannot be cleaned are rejected. While a post is hidden by moderation, its image is moved to private storage and is no longer publicly reachable.

Newer direct-message payloads may use client-side end-to-end encryption, while the service still supports legacy plaintext-compatible message records and fallback behavior. Message attachments are encrypted in the client before upload, but attachment metadata, encryption versions, device/public-key records, and routing information remain available to operate the service. No internet service can guarantee absolute security.

4. Third-Party Services

Depending on the feature and production configuration, the following providers may process information for Essyntia:

• Supabase — database, authentication, realtime, and storage
• Vercel — application hosting, delivery, and operational diagnostics
• Google — optional OAuth authentication
• Resend — delivery of account transactional emails (sign-up confirmation and password recovery); it receives your email address and the message content. Essyntia does not send promotional emails
• Cloudflare Images — profile and post image hosting and delivery when enabled
• Amazon Web Services S3 — encrypted direct-message attachment storage
• OpenRouter — when automated review is enabled, it receives only the text of posts, comments, replies and profiles to classify it against the community guidelines, and passes it to the inference provider that runs the model (currently Groq). We require zero-data-retention routes that do not collect requests; if no such route is available, the text is not sent. Images, videos, direct messages, email addresses, birth dates and account identifiers are not sent. OpenRouter and the inference provider process it under their own terms
• OpenRouter and Google (Gemini model on Google Cloud Vertex AI) — when you request a translation or have automatic translation turned on, only the text to be translated is sent, without your identity, and links, mentions and hashtags are replaced by placeholders before it leaves Essyntia. We require zero-data-retention routes that do not collect requests; if no such route is available, nothing is sent. Translations are cached on Essyntia's servers for up to 7 days. Direct messages are never sent for translation
• Google Firebase Cloud Messaging — delivery of push notifications to the Android app (notification type and a link; message notifications never include message content or the sender)
• YouTube, Vimeo, TikTok and X — when a post links to their videos, Essyntia's server requests the public title, author and thumbnail from their official oEmbed services; thumbnails are served from essyntia.com, and the provider's player (YouTube in privacy-enhanced mode) loads only after you tap play, at which point the provider's own privacy policy applies

Providers process data under their own terms and Essyntia's configuration. Essyntia does not use an advertising SDK or sell personal information based on observed current product behavior. We may also disclose information to competent authorities or organizations designated by law, such as the National Center for Missing & Exploited Children (NCMEC), when the law requires it, for example where there are signs of child sexual exploitation, or to respond to valid legal requests.

Automated moderation assists review and safety workflows; on its own it never suspends or closes accounts or removes content, and appeals are always decided by a person. Translation providers receive the text submitted for translation and the requested language information. For each automated review, Essyntia keeps the classification result (categories, severity, confidence and policy version), not another copy of the text. If content that had been reported is deleted, we keep the report record with a minimal copy of that content (text and references to its files), accessible only to the moderation team, to resolve the report, handle appeals and meet legal obligations.

5. Cookies and Local Storage

Essyntia uses cookies and browser storage for authentication, locale and theme preferences, session identifiers, and encrypted-message device keys and caches.

• Supabase authentication session data
• Language, locale, and theme preferences
• First-party session identifier
• IndexedDB and WebCrypto material used by encrypted messaging
• Temporary client caches for decrypted attachment access

The current product does not include an advertising SDK or third-party advertising pixels. Service providers may still receive ordinary request data needed to deliver their services.

6. Data Retention

Account, profile, content, preference, message, key, moderation, and first-party activity records are retained while needed to provide and secure the service. Exact provider backup and diagnostic retention can differ from live application records.

• Active account and profile records are retained while the account exists
• User content and direct-message records are retained until removed through an available product action or account deletion
• Encrypted attachment objects are retained until their metadata is deleted or cleanup rules expire them
• Reports, moderation data, appeals, diagnostics and security records are retained as needed for review, reliability, abuse prevention or applicable obligations, including after the content or account they refer to is deleted
• Content with an open child-safety report cannot be deleted until a person finishes reviewing it; meanwhile it stays hidden
• Provider backups and logs may expire on provider-managed schedules
• Videos you upload but do not post are deleted automatically within a day; deleting a post deletes its video and image files

The self-service deletion flow removes the live account and associated records described on the Account Deletion page after storage ownership can be verified. Other participants’ direct-message rows and independent content remain, although comments or replies attached to a deleted post can be removed with that thread. Limited provider backups, security records, or records subject to a legal obligation may remain until their applicable retention period ends.

7. Your Rights and Choices

Depending on your account and location, you may access or correct profile and preference information, change language and interaction controls, delete available content, or delete your account from Settings.

• Access — review account, profile, content and settings information available in the product
• Correction — update supported profile and preference fields
• Deletion — use Settings → Account → Delete account, subject to safe storage-ownership checks
• Language — change preferred app and translation language
• Content — delete content where a deletion action is available
• Moderation — see the decisions that affect your account and ask a person to review them in Settings → Moderation and appeals
• Blocking — block or unblock any account from its profile or a post menu; manage blocked accounts in Settings → Privacy
• Notifications — turn push notification categories on or off in Settings, or turn them off in Android settings

If you cannot sign in or a safe ownership check prevents automatic deletion, write to privacy@essyntia.com. We may need enough information to verify the request without exposing another account. If a child-safety review of your content is open, account deletion can be completed once it ends.

8. Minimum Age and Children's Privacy

You must be 18 or older to use Essyntia. Essyntia is not directed to children or to anyone under 18. We ask for your date of birth and a confirmation that you are 18 or older when you create an account or complete onboarding, including when you sign in with Google, and we use your date of birth to check that you meet this requirement. Accounts that have not completed this confirmation cannot use the service until they do. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will restrict it and take steps to delete the account and its associated data. If you believe someone under 18 is using Essyntia, contact privacy@essyntia.com.

9. International Users

Essyntia serves users across regions, and providers may process information in countries other than the country where a user lives. Provider locations and appropriate transfer terms depend on the configured service and account contracts.

10. Changes to This Policy

We may update this policy as the product, providers, or legal requirements change. The revised policy will identify its updated date.

11. Contact

For privacy questions, access concerns, or deletion support, contact:

privacy@essyntia.com