Privacy policy

About us

1Sign (Social Media) is a social networking app owned and operated by Abdullah Fakhri. For privacy inquiries, contact: support@sign-sm.com.

Data we collect

• Account data: name, username, email address, phone number (optional), age, and password (encrypted and unreadable to us).
• Content you post: photos, videos, stories, comments, messages, voice messages, and live streams.
• Profile: profile photo, cover, bio, the location text you enter, and link.
• Location: only if you allow it, for the location sticker in stories and the map. You can hide it in Settings.
• Device information: device type, operating system, push notification token, and approximate IP address at login — to protect your account and alert you to logins from new devices.
• Camera and microphone: used only when you take photos, record, make calls, or go live. Nothing is recorded unless you tap to start.
• Contacts: only if you tap "Find your friends" and allow it, we check the numbers in your contacts once to show which of your friends are on 1Sign; we do not store the numbers or the list. You can stop people who have your number from finding you in Settings. We do not use tracking ads, and we do not sell your data to anyone.

How we use it

• Operating the app: showing your posts, delivering your messages, and sending notifications.
• Safety: detecting spam and fraud, rate limiting, reviewing reports, and protecting children.
• Service improvement: aggregate, non-identifying statistics.

Who we share it with

• Service providers acting solely on our behalf: Supabase (database, storage, and authentication), Expo/Apple/Google (notifications), Google MediaPipe (face enhancements in live streams — processed on your device), and STUN servers for calls.
• Calls and LIVE: LiveKit and Metered relay audio and video during calls and live streams only. We don't record calls.
• Artificial intelligence: to keep users safe, posts, comments, stories, group chat messages and profile name/bio (text and images) are sent to OpenAI for automatic detection of harmful content. Messages you send to in-app support are sent to Anthropic (Claude) so the support assistant can reply. One-to-one private messages are not sent to these services. These companies process the data only to provide their service to us.
• Link checks (SafeLink): when you tap a link in the app, we send only that link to Google Web Risk to check it isn't a phishing or malware site (the same list Chrome and Safari use). Your name, account, chat and who sent the link are never sent with it, and we don't keep the link — only a one-way fingerprint of it for a short while, so it isn't checked twice.
• Government authorities, where required by law or to protect someone from genuine danger.
• Public content (your posts and profile) is visible to 1Sign users according to your privacy settings. A private account is visible to your followers only.

How long we keep it

• We keep your data for as long as your account exists. Stories disappear after 24 hours, and disappearing messages follow the setting you choose.
• If you delete your account, we immediately delete your profile, content, and messages from our database, and your files within 30 days. We retain a minimal record (username, email, and account status) for one year to prevent ban evasion and to meet legal obligations.

Your rights

• You can update your information in "Edit profile", change your privacy in Settings, and delete your account in Settings → Delete account.
• You can request a copy of your data or ask us anything at support@sign-sm.com, and we will respond within 30 days.

Children

1Sign is not intended for children under 13. If we learn that an account belongs to a child under 13, we will delete it. For users aged 13 to 17, we apply additional protections (see the Child Safety Policy).

Security and encryption

• Private text messages are end-to-end encrypted (Curve25519 + XSalsa20-Poly1305): they are encrypted on your phone and can only be opened on the recipient's phone and your own devices. Decryption keys are stored on the device and never reach our servers, so we cannot read your messages. If you report a message, your phone sends its text along with the report.
• Chat photos, voice messages, and snaps are stored in private storage and can only be opened via temporary links by the sender and recipient.
• Phone numbers and login locations are encrypted in the database with AES-256, and the key is stored in a separate vault.
• Your login session is stored encrypted on your phone (Keychain / Keystore). All connections are encrypted (HTTPS/TLS), passwords are hashed and cannot be read, and all data is protected by row-level access controls.

Changes

Last updated: 2026-11-06. If we make any material changes, we will notify you in the app.