terms & privacy

The sections above are what most of this means in plain language. The sections below are the formal versions. If anything conflicts, the sections below are the operative text.

Terms of Service

1. Acceptance of Terms

By creating an account, signing in, or using sodalite ("the Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree, do not use the Service.

2. Eligibility and Minors

You must be at least 13 years old to use the Service independently. Users under 13 may use the Service only with the informed, ongoing consent of a parent or legal guardian, given by signing our consent form from the parent's or guardian's own account before the minor signs up. By signing it, the parent or legal guardian:

• agrees to these Terms on the minor's behalf;
• assumes full responsibility for the minor's conduct, content, and interactions on the Service;
• represents that they have reviewed the Privacy Policy and consent to the collection of personal information from the minor as described;
• may revoke this consent, and request deletion of the minor's account, at any time from Settings → Family or by contacting us. Revoking consent locks the account until consent is given again.

We do not knowingly permit individuals who falsely represent their age or their parent's consent to use the Service. We may suspend or delete accounts we believe do not meet these eligibility requirements.

3. Account Registration

Authentication is based on possession of a phone number capable of receiving SMS, or an email address capable of receiving mail. You are responsible for maintaining exclusive access to whichever you registered with. You may not share your account, impersonate another person, or register multiple accounts to circumvent enforcement actions.

4. User Content

You retain ownership of content you create or upload ("User Content"). By submitting User Content, you grant us a worldwide, non-exclusive, royalty-free license to host, store, reproduce, display, and transmit your User Content solely as necessary to operate the Service. We never use User Content to train artificial-intelligence or machine-learning models, for analytics, or for advertising, and we never sell it. This license ends when you remove the content, except to the extent it has already been shared with other users.

You represent and warrant that you own or have the rights to submit any User Content you post, and that your User Content does not infringe, misappropriate, or otherwise violate any third party's rights.

5. Acceptable Use

You agree not to:

• harass, threaten, dox, stalk, or intimidate other users;
• post content that is illegal, fraudulent, defamatory, hateful, sexually explicit in any context involving minors, or that promotes violence or self-harm;
• impersonate another person or entity, or misrepresent your affiliation with a person or entity;
• use automated means to access, scrape, or interact with the Service;
• attempt to probe, scan, or test the vulnerability of the Service, or to breach any security or authentication measures;
• use the Service to distribute spam, malware, or any content intended to damage another user's devices or data.

6. Moderation and Enforcement

We may, at our sole discretion and without notice: remove User Content; suspend or terminate accounts; limit feature access; or cooperate with law enforcement. Message text is passed through an automated safety filter before it is encrypted (see Privacy Policy §7), and we may use automated tools to detect known child sexual abuse material. Beyond that we do not pre-screen User Content, and no person reviews it unless a user reports it and attaches it as evidence.

7. Termination

You may terminate your account at any time by using the account-deletion control in Settings. Deletion removes your profile content, uploads, and private messages you have not yet transmitted; however, content you have transmitted to other users (messages, drops, photos in albums) may persist in their accounts and we are unable to retrieve it. We may terminate or suspend accounts for violations of these Terms.

8. Service Availability; Disclaimers

The Service is provided on an "AS IS" and "AS AVAILABLE" basis. We disclaim all warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement. We do not warrant uninterrupted availability, accuracy, or data preservation.

9. Limitation of Liability

To the maximum extent permitted by applicable law, in no event will we be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits or revenues, data, or use, arising out of or related to your use of the Service. Our total aggregate liability shall not exceed one hundred U.S. dollars ($100).

10. Indemnification

You agree to indemnify and hold us harmless from any claims, damages, losses, or expenses (including reasonable attorneys' fees) arising out of your use of the Service, your User Content, or your violation of these Terms.

11. Governing Law; Venue

These Terms are governed by the laws of the State of Michigan, USA, without regard to conflict-of-law principles. Any dispute shall be brought exclusively in the state or federal courts located in Oakland County, Michigan.

12. Changes to These Terms

We may modify these Terms from time to time. If a change is material, we will post a notice in the Service prior to the effective date. Continued use after the effective date constitutes acceptance of the modified Terms.

13. Contact

For questions about these Terms: hello@sodalite.app.

Privacy Policy

Privacy Policy

1. Data We Collect

• Account data: email address, and phone number if you registered with one (users who register with a phone number must also add an email address; users under 13 must provide both, and may provide a parent's or guardian's phone number instead of their own, kept as a contact number that cannot be used to sign in), username, numeric account identifier, account creation timestamp.
• Birth year: provided at registration and stored encrypted. Used to determine whether a user is under 13, between 13 and 17, or an adult, which governs parental consent and default search visibility as described in this Policy. It is not displayed to other users.
• User-submitted content: messages, photographs, drops, albums, room items, captions.
• Drop places: if you choose to add a place to a drop, your device's location at that moment, used once to look up the place's name. Only the name is stored with the drop.
• Live location: if you choose to share your location with one or more friends, your device's latitude and longitude, and the town and region it is in, sent periodically while sharing is on. Only the most recent position is stored; it is replaced on each update and deleted when you stop sharing with everyone. The position is rounded to approximately one kilometre before it is stored or shared.
• Linked music accounts: if you connect Spotify or Apple Music, the details listed under “Music services” in §4, and, while sharing is on, what you are listening to, shown to your friends.
• Call records: for each call you take part in, the one-to-one conversation or group it was in, whether it was a voice or video call, and when it started and ended. We do not record the audio or video of calls.
• Technical data: IP addresses, user-agent string, connection timestamps. Used for rate limiting, abuse prevention, and safety investigations.

2. Legal Basis for Processing

We process personal information where we have a legitimate interest in operating the Service, to perform our contract with you (these Terms), or to comply with legal obligations.

3. How We Use Your Data

• To authenticate you via SMS or email and maintain your session.
• To send you notices about reports you made, moderation decisions and your account's status, by email or, if there is no email on the account, by SMS.
• To send adult users whose accounts are not managed by a parent occasional emails about the Service. Each includes an unsubscribe link, and unsubscribing stops them.
• If you connect Spotify or Apple Music, to show the friends you choose what you are listening to.
• To transmit your content to the recipients you selected (DMs, groups).
• To operate, maintain, and secure the Service, including rate limiting and fraud prevention.
• To respond to legal, regulatory, and law-enforcement requests.

4. How We Share Data

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We share data in the following limited circumstances:

• Service providers. We use Twilio to transmit SMS verification codes and, for accounts without an email address, notices; an email-delivery provider to transmit email verification codes, notices and the emails about the Service described in §3; and Cloudflare to host the Service (databases, object storage, code execution) and to help connect calls. Calls may also be relayed through Metered. These providers process data on our behalf under contractual confidentiality.
• Bot protection. We may use Cloudflare Turnstile to distinguish people from automated traffic. When a Turnstile check runs, Cloudflare processes your IP address and information about your browser and device, and may set a cookie recording that the check was passed; we receive only the result of the check. Cloudflare processes this information under its own Turnstile Privacy Policy.
• Place lookups. When you add a place to a drop, we send that location, rounded to about 11 meters and without your account details or IP address, to Google Maps Platform and to Photon, a geocoding service operated by komoot that uses OpenStreetMap data, solely to find the place's name. We cache names by location, not by user, for up to seven days. Place names from OpenStreetMap are © OpenStreetMap contributors and available under the Open Database License.
• Location services. While you share live location, the app in your browser sends your position directly to BigDataCloud's reverse-geocoding service to look up the town name; that request comes from your device, so BigDataCloud also receives your IP address. When a friend views your shared location on a map, their device loads the map tiles, centred on your position, directly from the tile servers of the OpenStreetMap Foundation (tile.openstreetmap.org), which therefore also receive that friend's IP address. Map data is © OpenStreetMap contributors.
• Calls. To set up a call, your device asks a STUN server operated by Cloudflare how it can be reached, which shows Cloudflare your IP address. One-to-one calls, and group calls that do not use our media server, then try to connect your device directly to the other participants' devices, which discloses your IP address to them. Calls that cannot connect directly go through a TURN relay server, if one is available. With “hide my IP address in calls” turned on (a setting in the web and desktop apps that applies to each device separately, and that is always on for accounts managed by a parent), your device connects only through a TURN relay server whenever one is available, so the other participants see the relay's address instead of yours. Relay servers may be operated by Cloudflare, by Metered, or by us; the relay sees your IP address and forwards your audio and video, encrypted, without decrypting it. Group calls may instead go through Cloudflare's media server, which sees your IP address and decrypts and re-encrypts the audio and video to forward it to the other participants (see §7). We do not record calls.
• Beta tests. If you join a beta test in Settings → Beta tests, we copy your username, email or phone number, birth year and settings to beta.sodalite.app, a separate copy of the Service we run on the same infrastructure, along with your friendships and blocks with others who joined too. The copy is encrypted with the beta service's own keys. Your messages, groups, drops, photos and encryption keys are not copied. Leaving the beta test, or deleting your account, deletes the copy, which is then removed within ninety (90) days like any deleted account. Accounts managed by a parent and users under 13 cannot join.
• Content loaded from other services. Some features make your device load content straight from another company's servers, which therefore receive your IP address and what was requested: a YouTube link in a message shows as an embedded player from YouTube (youtube-nocookie.com, operated by Google) when the conversation is shown; album artwork for music a friend shares is loaded from Spotify's or Apple's servers; the whiteboard loads its drawing software from unpkg.com, a public code host; and choosing a font other than the default in Settings loads it from Google Fonts. The default font is served by us.
• Music services. If you connect Spotify, we receive and store, encrypted, the access tokens Spotify issues, your Spotify account ID and display name, and use them to read what you are playing, have recently played and your top tracks. If you connect Apple Music, we store the token Apple issues, encrypted, and your Apple Music storefront (the country of your account). You can disconnect either in Settings.
• Legal requests. We may disclose data in response to a validly served subpoena, court order, or other legal process, including drops that have expired from the app. Stored message contents are encrypted with the recipient's key. Because we also hold that key in wrapped form to support device recovery, we may be technically capable of producing message contents in response to validly compelled legal process.
• Safety. We may share data where we reasonably believe disclosure is necessary to prevent imminent harm.

5. Data Retention

Active account data is retained while your account is active. Drops, including their captions, places, photos and comments, are retained in encrypted form after they expire from the app; expiry hides a drop, it does not delete it. Upon account deletion, data associated with your profile, uploads, and unsent content is removed within ninety (90) days. Content you transmitted to other users may remain in their copies of their conversations. Call records are kept while your account exists; when it is deleted, its call records, including the other participant's records of its one-to-one calls, are removed with the rest of its data. Records of server errors, which can include your username and the request that failed, are kept for as long as we need them to diagnose problems and investigate abuse; they have no fixed time limit. Request logs held by our hosting provider, Cloudflare, are kept for its standard retention period. Information collected by Cloudflare Turnstile is kept by Cloudflare as described in its Turnstile Privacy Policy. The IP addresses an account uses are kept separately, encrypted, as a security record for one (1) year after each address was last used, and may be produced in response to legal requests. Reports and records of moderation actions are kept for as long as they are needed for safety, including after the accounts involved are deleted. Family alerts and group join requests are kept until the parent's or the child's account is deleted. Database backups are deleted within thirty (30) days of being made.

6. Children's Privacy (Under 13)

If we learn that we have collected personal information from a child under 13 without the verifiable consent of a parent or guardian, we will delete that information as quickly as possible. Parents and legal guardians of users under 13 may:

• review the personal information we have collected from the account, by downloading a copy of it under Settings → Family (it excludes the content of messages and the child's journal; contact us for those);
• delete the account and its data, under Settings → Family;
• refuse further collection of the child's data by withdrawing consent under Settings → Family, which locks the account immediately.

Each of these can also be requested by contacting hello@sodalite.app.

Parental tools. A parent or guardian who manages an account can see the account's friends and groups and who is in each group, approve or decline the groups it joins, and receive alerts when it joins or asks to join a group, blocks or reports someone, or when the safety filter holds back a message to or from it. Alerts identify the people and groups involved, never the content of messages. Accounts of users under 18 are hidden from username search by default.

How we get consent. An account for a child under 13 can only be created with a one-time code that a parent or guardian receives by signing our consent form from their own adult account. The form records the parent's full legal name, the child's first name, the parent's drawn signature, the version of this Policy they agreed to, the time, and the IP address they signed from. We store it encrypted and keep it for as long as the child's account exists and afterward as our record that consent was given.

Data collection for users we have reason to believe are under 13 is limited to the minimum necessary to operate the Service - specifically: an email address and a phone number (the child's own, or a parent's or guardian's number kept as a contact that cannot be used to sign in), for authentication and account recovery, birth year, IP addresses (for security and abuse prevention, kept as described in §5), chosen username, numeric account identifier, content voluntarily created by the user, and, if the user connects a music account (which a parent can turn off), the music-account data described in §1. We do not use children's data for advertising, profiling, or sale to third parties.

7. Encryption and Security

Data is transmitted over HTTPS and stored on Cloudflare infrastructure. Each user's account is associated with a public/private keypair generated on the user's device at first sign-in. Public keys are uploaded to our servers; private keys remain on the user's devices and, in encrypted ("wrapped") form, on our servers solely to enable recovery on a new device after a verified login.

Direct messages and group messages are passed through an automated safety filter (described below), then encrypted with the recipient's public key (or, for groups, with each member's public key) before being stored. A database breach or backup leak, on its own, would yield ciphertext: the key needed to unwrap a user's private key is held separately from the database, not inside it.

The safety filter checks the text of each message against a list of blocked words, including disguised spellings of them. It does not look at photos, voice notes, or video. A message that matches is stored and shown to its sender like any other, but it is not delivered to the recipient. The filter does not log the match or the word. If the sender's account is managed by a parent, the sender is told the message wasn't delivered; if the sender or the recipient is a managed account, that account's parents receive an alert naming the people involved, but not the message or the matched word.

This is not end-to-end encryption, and we want to be precise about that. Two properties of the design mean we are not technically prevented from reading message contents. First, the safety filter operates on plaintext: your device sends the message text to our server, which scans it and then performs the encryption. Second, the wrapping key that protects your private key is held by us, so that you can sign in on a new device and recover your history - which also means we can unwrap your key. We do not read user messages as a matter of practice, and access is limited to what is necessary to operate and moderate the Service, but you should not use sodalite on the assumption that we are cryptographically incapable of reading what you write. If that property is what you need, use a service that offers true end-to-end encryption and accept that losing your device means losing your history.

Drops - the caption, the place name, the photo and any comments - are encrypted with a key specific to the account that posted them before they are stored, and stay encrypted after they expire. That key is derived from a secret we hold, so the same caveat applies: we are technically able to decrypt a given account's drops, and would do so only for a safety investigation or validly compelled legal process.

Calls are encrypted in transit with SRTP, the standard for WebRTC calls; we do not add a second layer of encryption. In one-to-one calls, and in group calls that connect devices directly, the audio and video are encrypted between the participants' devices, and relay servers forward them without being able to decrypt them. The information the devices use to set up that encryption passes through our servers, so this is not end-to-end encryption either. Group calls that go through Cloudflare's media server are encrypted only as far as that server, which decrypts each participant's audio and video and encrypts it again to send it to the others.

Other limitations. Push notifications, by their nature, are delivered through Apple, Google, or browser-vendor infrastructure and may include a short message preview. Photos, videos and voice notes sent in messages are encrypted on the sender's device with a key for that file, and the key travels inside the encrypted message, so the caveat above applies to them too. Photos in group albums, profile pictures and custom ringtones are not encrypted: they are stored as uploaded. Uploaded files are served at unguessable links without a sign-in check, so anyone who obtains a link can open the file it points to, and a copy may remain in caches after the file is deleted.

8. International Users

The Service is operated from, and data is stored in, the United States. By using the Service, you consent to the transfer of your data to the United States, which may have different data-protection laws than your country of residence.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise these rights, contact hello@sodalite.app. We will respond within 30 days.

10. Changes to This Policy

We may update this Policy. If a change is material, we will post a notice in the Service prior to the effective date. Continued use after the effective date constitutes acceptance of the updated Policy.

11. Contact

For privacy concerns or data requests: hello@sodalite.app.