Building privacy-first, on purpose
We collect the minimum needed to run a social app. No third-party analytics, no advertising trackers, no cross-app tracking. That is the claim. This is the practice, because a privacy policy is a promise and the interesting part is always the mechanism that makes the promise hard to break.
Sign-in has no password. There is nothing for you to reuse from another site, nothing for us to leak, and nothing in our database that is worth stealing to use elsewhere. The one-time code we send instead is stored only as a hash, expires in ten minutes, and dies after five wrong attempts. If someone read that table they would learn nothing they could use.
Sessions are short-lived tokens rather than a long-lived secret sitting on a device forever. This is unglamorous and it is most of what "account security" actually means in practice.
There are no third-party analytics SDKs. That is a stronger statement than "we do not sell your data", because an SDK is not a passive measurement tool. It is another company's code running inside the app with the app's permissions, deciding for itself what to collect and where to send it. An app that contains one can only promise as much as that other company's roadmap allows.
Ads, where they appear, are contextual: at most a coarse country and language, never a profile. There is no cross-app tracking, which is why the app never shows an App Tracking Transparency prompt. That absence is checkable from outside the company, unlike almost every other privacy claim, because there is simply nothing there to ask you for.
The website is built the same way. Strictly necessary, first-party technologies only, which is why most visitors never see a consent banner. The banner is a symptom, not a courtesy.
Where we do something that could look invasive, the design is about not needing the invasive version. Creator insights show reach, retention and the moments people replayed, and nothing that identifies a single viewer, because the useful signal for a creator is aggregate by nature. Content safety runs on uploads rather than on conversations, and the limits of what it covers are written into the source next to the code, so nobody inside the company can mistake "we classify uploads" for "we classify everything".
The reason to build it this way is not virtue, it is structure. Every absence removes a category of future decision. There is no data set that becomes tempting in a bad quarter, no partner integration to unwind under pressure, no default that could quietly change during a settings migration. The strongest privacy guarantee is not a promise not to do something. It is not having built the thing that would let you.
If you want to evaluate any company on this, including us, the question worth asking is not what they promise. It is what they would have to build in order to break the promise, and how much of it is already there.
