Last updated: 4 October 2026
This notice says what Sphyrsync collects, where it goes, how long we keep it, and what you can do about it. Sphyrsync is run by Dreamform Studios, Mashpee, Massachusetts, USA. Questions, or a request about your data: sphyrsync@gmail.com.
The short version: we keep what the app needs to work, on our own computer. Nothing goes to advertisers or analytics companies. Your data leaves our computer only to reach the places you post to, and the two AI services listed below.
Your account. Handle, display name, email address, what you said you're here for, that you confirmed you're 18 or older, and your password, stored only as a scrambled one-way hash (scrypt). We also record whether you confirmed your email.
Signing in. One cookie, sphyr, that keeps you signed in for up to 30 days. With it we store when the session started and was last used, the first 120 characters of your browser's description of itself (its "user agent"), and which screen you were last on. Failed sign-in attempts are counted for a short time, in memory, to slow down password guessing. The app also keeps a few settings on your own phone (for example, whether you've seen the tour).
What you make. The photos, videos and sound you upload (including the original file names), your drafts and projects, captions, covers, voiceovers, templates, and the finished posts. Uploads can be up to 300 MB each.
Your connected accounts. When you connect Instagram, Facebook, YouTube or Telegram, we store the access keys those services give us, encrypted, so we can post when you ask. You can disconnect at any time.
Your posts' results. For each post we record its settings (look, transitions, crop, fonts, the positions of text, but never the words) and how it does: views, how long people watched, how far they swiped, and whether they reached the end. For posts sent to other platforms we fetch the numbers those platforms report (likes, comments, views, reach, saves, shares), plus your follower count and the gap since your last post at the time you posted.
Counting views. To count a view once, we use your handle if you're signed in. If you aren't, we use a short code made from your IP address and browser, held in memory for six hours and never saved to disk. That code is still personal data in most places that regulate this, so we say so.
Likes, follows, comments and blocks. Stored so they work. Who liked a post is never sent to anyone else's app; others see only the count.
Reports and feedback. What you report or tell us, with your handle, until a person has dealt with it.
IP addresses. The internet address your upload, report or comment came from, kept for 90 days and then deleted. We keep it so a report to the police or to NCMEC can be acted on; it is kept longer only when it is part of a preserved safety case (below).
Checking uploads. Every file you upload is fingerprinted (a hash of its bytes) and compared with lists of known child sexual abuse images, and with files we have removed before. Photos, and one frame per second of videos, are also checked for nudity by a model that runs on our own computer; nothing is sent anywhere for that. A post the check flags waits for a person to look at it. When we connect Microsoft's PhotoDNA service, photos are also sent to Microsoft to be compared with its list; we'll update this notice when that happens.
Safety cases. If material is found or confirmed to be child sexual abuse material, the law requires us to report it to the National Center for Missing & Exploited Children (NCMEC) and to preserve it, with information about the account, for at least one year. That material is moved out of the app into encrypted storage that only the operator can open, and every opening is logged. Deleting the account does not delete a preserved case.
Takedown requests. If you use the takedown form, we keep your name, email, the links you gave and your typed signature, to act on the request and show that we did.
What you agreed to. Which version of these documents you accepted, when, and your browser's user agent at the time.
During the four-week test, if you're a tester: the answers you give us in person (for example, how long posting used to take you), so we can judge the test honestly.
On our own Mac in our studio in Massachusetts, in a database and on its disk. Every night it's backed up to a second drive in the studio and copied off-site to storage we control. Our secret keys are never included in the off-site copy.
We don't sell your data, share it with advertisers, or use analytics or ad trackers. The app loads no outside scripts or fonts.
/r/…) and the media files behind your posts can be opened by anyone who has the link.Sphyrsync is for people 18 or older. If we learn an account belongs to someone younger, we delete it.
If we change this notice, we'll show you the new version in the app and ask you to agree to it.
version d52983cd077e · set 7e71bff65647
← Sphyrsync