Privacy Policy

Last updated: 30 September 2026

Who runs Sinter

Sinter is operated by Sinter. Privacy contact: privacy@joinsinter.com. General help: support@joinsinter.com. Security reports: security@joinsinter.com. Sinter is for people aged 16 and over. It is a free service with no ads and no payments.

What we store and why

Account and sign-in: account identifier, display name, identity provider user ID, login records, session cookie. Purpose: authentication, sessions, abuse limits. Profile: introduction, skills, interests, availability, visibility settings, message policy. Purpose: self-introduction and direct-message policy. Community and build activity: posts, comments, votes, saved posts, memberships, invitations, applications, tasks, discussions, artifacts and revisions, build decisions, updates, resources, chat messages, direct messages, blocks. Purpose: public conversation, collaboration, and the build record. Images: files and metadata (including crop points) held separately from the main database. Purpose: image display and moderation. Reports and moderation: reports, saved copies of evidence, decisions, notices, appeals and resolutions, audit logs of who viewed evidence. Purpose: reviewing reports, deciding, handling appeals, keeping an audit record.

Showcase images, badges and public profiles

A public build has a Showcase page that anyone can read without signing in, including search engines and services that generate link previews. The page credits builders by display name, links to their profiles, and shows their role, contribution summary and earned contribution standing. Its Open Graph (OG) share image uses contributor handles, or display names when no handle is set, alongside the build name and recorded builder and milestone counts. The page description can also include the build purpose and contributor credit. We use this information to credit shared work and let people share public builds.

Badges shown alongside public contributions, such as founding-member or contribution badges, can reveal membership or work you have done and connect it to your public profile. A public profile lists public activity and the profile details and selected builds you have chosen to make public. A private profile hides that aggregation; it does not remove your name, picture, badges or credits from contributions you already made in public. Profile visibility and build visibility are separate choices. Private builds have no public Showcase page or OG image.

Sinter generates Showcase images from the current public build record when requested. Sinter caches public Showcase pages for up to two minutes and images for up to five minutes. Social networks, messaging services, search engines and people who copy or download a preview may retain their own copies for longer. Editing a name updates newly generated previews; making a build private prevents new public access after Sinter's existing cache expires. Sinter cannot recall copies held elsewhere.

Before sharing, use "View showcase" to check the credits and preview. You can edit your profile and its visibility in Settings; a build owner can change the build visibility. Making your profile private alone does not hide public build credits or previously shared images. For a correction, removal or objection concerning a public credit or badge, contact privacy@joinsinter.com. The retention periods and other rights on this page also apply to the underlying account and contribution records.

Site statistics

Sinter keeps aggregate, first-party statistics that don't use cookies about site usage: page views by page type, visit duration and bounce rate (approximate), country location from our hosting provider, not from storing your IP, and device type (mobile, tablet or desktop). These numbers are never tied to your account, never shared with or fed by a third-party tracker, and no individual visit is ever reconstructable from them. Purpose: understanding and improving the service. We do not collect age beyond the 16-and-over confirmation at signup, so there is nothing to show or aggregate about age here.

Cookies and browser storage

Sinter sets no advertising or analytics cookies and no third-party trackers. The only cookies are strictly necessary: a session cookie that keeps you signed in, a short-lived cookie while a sign-in is in progress, a single-use cookie for the second step when two-factor is on, and one preference cookie that remembers whether your sidebar is open. None of them follows you across other sites, carries an advertising identifier, or is shared with anyone; the session cookie is removed when you sign out or when it expires. See Cookies and consent for the complete list and why no consent banner is needed.

Everything else is a setting you asked for, kept in your own browser and never sent to us as an identity: your theme, chat-panel state, recent searches, feed sort and view density, the "new comments" marker, draft image descriptions, a dismissed notice, low-data mode, and unsent post or edit text. Clear them any time in your browser settings; the site still works and your choices reset.

Nothing non-essential is stored before you make a choice, so no consent banner appears because only essential cookies are used. If we ever add non-essential storage, we will ask for a genuine opt-in first that is as easy to refuse as to accept, and this page will say so.

Where data is kept

Cloudflare stores data, images and backups on our behalf as our hosting provider.

How long we keep it

Sessions and sign-in states expire and are swept shortly after expiry. Account data is kept for the life of the account plus 30 days for appeal, then credentials and identifiers are erased and shared work is attributed to "Deleted user". Public posts, comments and build content are kept for the life of the site; private build content for the life of the build plus 12 months after archiving, counted from last activity. Deleted images are erased; a limited record of deletion is kept. Moderation evidence, reports, appeals and decisions are kept for 24 months after the case closes. Audit logs are kept for 36 months. Service activity records are kept for 30 days without request bodies or tokens. Backups roll over a 30-day window.

How private messages are protected

In short: direct messages here are not end-to-end encrypted. They are encrypted in transit and at rest, and a reported message is readable by moderation.

Direct messages on Sinter are not end-to-end encrypted. They are protected in transit and encrypted at rest on our servers, which means the operator can technically read them - but not by browsing. End-to-end encryption and moderation of reported content cannot both hold: a report has to carry the message it is about, so the platform must be able to read that one message. A private message is only opened when it is reported, and then only that one message, as a frozen copy attached to the report. There is no "read anyone’s messages" tool, and no operator can open a conversation to browse it.

Read receipts are mutual. When they are on, the other person can see when you have read their newest message, and you can see when they have read yours. If you turn receipts off, you stop sending your own and you also stop seeing anyone else’s - a one-way switch would let one person watch while staying invisible. Turning receipts off never changes your unread counts or the messages themselves.

Operator visibility into private messages is bounded in three ways. It is reported-evidence-only: a moderator can open the single reported message as a frozen copy, never the conversation around it. It is time-boxed: the live evidence read is only available for 180 days after the report is filed, after which the case record and the access log remain but the raw copy read is refused. And every open is logged with who, which report and when, before the copy is handed over - an unrecorded read is not delivered.

Your choices and rights

Joined only the waitlist? To withdraw consent or erase your email, optional answer and waitlist record without an account, write from the listed address to privacy@joinsinter.com; the owner verifies the request and removes that record. Backups follow the rollover period above.

Invitation-only group chats store group names, emoji icons, membership intervals, invitations, messages, reactions and your private silence/archive/read settings. Invitees see invitation details and the active roster, but no messages until they accept. New members see only post-join messages; former members retain only their previous membership intervals. Blocking someone in a shared group does not stop them reading your new group messages if you stay. Silencing suppresses group alerts without discarding unread state.

Group chats are not end-to-end encrypted. A moderator can open a report, with an audited read within 180 days. A message report includes the message and up to five messages on each side that the reporter was entitled to read. An invitation report includes invitation details; a whole-group report includes the group name, icon and owner. These reports grant no ability to browse private groups. Your identity as reporter is not shared with group members. Your export includes your own authored messages, reactions, membership snapshots, settings, invitations and report receipts; it excludes other members' messages and private settings. Account deletion ends participation, revokes invitations and transfers ownership or closes the group; retained shared contributions show "Deleted user".

Group invitations expire after 72 hours. Terminal invitation name/icon snapshots and stored withdrawn message bodies are cleared after 30 days, unless preserved under a hold. Messages remain for the active group life, including messages from members who leave, plus 12 calendar months after closure. After that anniversary, expired messages, reactions, invitation records, membership history and private settings are erased. Calendar anniversaries use UTC and clamp 29 February to 28 February in the next year. Archiving or silencing does not close a group. Holds suspend erasure; release resumes the original retention clock. A limited record of creation is retained to prevent duplicate groups. Saved moderation evidence is retained separately for 24 calendar months after the final case decision or appeal review; pending appeals, unconfirmed case closure dates and holds prevent evidence erasure. Account deletion preserves shared messages with "Deleted user" attribution and clears normal retained attribution snapshots. These operations do not recall screenshots or other people's copies; backups follow the rollover period above.

Get a copy of your data at any time via "Download your data" in Settings. Delete your account via account settings; read the deletion confirmation first because shared contributions remain visible as "Deleted user" while personal identifiers are erased. You can edit profile data in the app, and you can send access, correction, deletion, restriction, portability or objection requests to privacy@joinsinter.com. You can also complain to your local data protection authority.