Privacy Policy

1. Introduction

sent.fyi ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our secure secret-sharing platform. Please read this policy carefully. By using sent.fyi, you consent to the data practices described herein.

2. Data Controller

For users in the European Union and European Economic Area, the data controller is sent.fyi Ltd, registered in Estonia (registry code pending). For all other users, the data controller is sent.fyi Ltd. You can contact our Data Protection Officer at [email protected].

3. Information We Collect

Account Information: When you sign up, we collect your email address and account credentials (hashed and salted). We may also collect your name and organization name if you choose to provide them.

Shared Content Metadata: We store metadata about secrets, texts, and files you share — such as creation timestamps, expiry settings, access logs, and recipient email addresses (if provided). We do NOT have access to the content of your encrypted secrets, texts, or files. Content is encrypted client-side using AES-256-GCM before it reaches our servers.

Usage Data: We automatically collect certain information when you access the platform, including IP address, browser type, operating system, referring URLs, and timestamps of access. This data is used for security monitoring, fraud prevention, and service improvement.

Payment Information: If you subscribe to a paid plan, payment processing is handled by our third-party payment processor (Stripe). We do not store your full credit card details on our servers. We receive a tokenized reference and the last four digits of your card for billing purposes.

4. How We Use Your Information

We use the collected information to: (i) provide, maintain, and improve our services; (ii) authenticate your identity and secure your account; (iii) send administrative notices, security alerts, and support communications; (iv) detect, prevent, and address fraud, abuse, and security incidents; (v) comply with legal obligations; and (vi) enforce our Terms of Service.

We do NOT use your encrypted content for any purpose — we cannot read it. We do NOT sell your personal data to third parties.

5. Legal Basis for Processing (GDPR)

For users in the EU/EEA, we process your personal data on the following legal bases: (i) performance of a contract — when processing is necessary to provide our services to you; (ii) legitimate interests — for security monitoring, fraud prevention, and service improvement, where such interests are not overridden by your data protection rights; (iii) legal obligation — when we are required to comply with applicable law; and (iv) consent — where you have explicitly given consent for specific processing activities.

6. Data Storage and Encryption

Your data is stored in the region you select during signup. EU users' data is stored in Falkenstein, Germany. US users' data is stored in Ashburn, Virginia.

All secret, text, and file content is encrypted client-side using AES-256-GCM before transmission. Encryption keys are managed by our Vault service. We operate a zero-knowledge architecture: we cannot access your unencrypted content.

Account credentials are hashed using bcrypt with a unique per-password salt. All data in transit is protected by TLS 1.3. Data at rest is encrypted using AES-256.

7. Data Retention

Shared secrets, texts, and files are automatically deleted upon expiry or after the burn-on-read event occurs. Once deleted, the content is irrecoverable.

Metadata and audit logs are retained for the duration of your account plus a maximum of 90 days after account deletion, unless a longer retention period is required by law.

Account information is retained until you delete your account. You may request account deletion at any time by contacting [email protected].

8. Data Sharing and Disclosure

We do not sell, trade, or rent your personal data. We may share information in the following circumstances:

Service Providers: We may share data with trusted third-party vendors who assist us in operating our platform (e.g., hosting providers, email delivery services). These vendors are bound by data processing agreements and confidentiality obligations.

Legal Requirements: We may disclose information if required by law, court order, or governmental regulation, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. You will be notified of any such change.

9. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights:

Right of Access: You can request a copy of the personal data we hold about you.

Right to Rectification: You can request correction of inaccurate or incomplete data.

Right to Erasure: You can request deletion of your personal data, subject to legal retention requirements.

Right to Restrict Processing: You can request that we limit how we process your data.

Right to Data Portability: You can request your data in a structured, machine-readable format.

Right to Object: You can object to processing based on legitimate interests.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. International Data Transfers

Your data is stored in the region you select. We do not transfer data between regions. For EU users, data remains within the European Union. For US users, data remains within the United States. If we ever need to transfer data across regions, we will implement appropriate safeguards (such as Standard Contractual Clauses) and notify you in advance.

11. Children's Privacy

sent.fyi is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on our platform. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the platform after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: [email protected] Data Protection Officer: [email protected] Postal: sent.fyi Ltd, Estonia (full address available on request)