Privacy Policy

Effective 29 July 2026 · Applies to the Sirloop apps (Android, desktop), the Sirloop relay service, and sirloop.com.

The short version

Sirloop is built so that we cannot read your data. Everything that travels between your phone and your desktop goes through an end-to-end encrypted tunnel; the relay server only ever stores and forwards ciphertext. The apps contain no analytics, no advertising, and no third-party tracking SDKs. We do not sell data — we have almost none to sell.

What the app processes on your devices

The Sirloop app keeps its working state on your own devices: pairing keys, tunnel counters, and the run history of your own machine. This data stays local. Commands you send from the phone are encrypted on the phone and decrypted only on your paired desktop.

What the relay sees

The relay is a rendezvous mailbox. It sees: opaque encrypted blobs (which it deletes on delivery or shortly after), a random room identifier, and the ordinary metadata any web server sees (IP address and timing of requests, retained only in short-lived operational logs). The relay cannot decrypt message contents — the keys never leave your devices.

Optional account sign-in

If you choose to sign in (Google or GitHub) to simplify pairing, our identity provider (Supabase) processes your email address to issue a sign-in token. We use that token only to associate an encrypted pairing hand-off with your account for a few minutes. The hand-off blob is itself encrypted under a code that never leaves your devices. Sign-in is optional; every feature works without an account by scanning a QR code.

Payments

Paid subscriptions are processed by Stripe. We receive subscription status, not card details. Stripe's handling of your payment data is governed by Stripe's own privacy policy (stripe.com/privacy).

What we do not do

• No analytics or tracking SDKs in the apps.
• No advertising, no ad identifiers.
• No sale or sharing of personal data with data brokers.
• No access to your code, prompts, or agent output — technically impossible for us, by design.

Data retention and deletion

Relay mailboxes are ephemeral (delivered blobs are gone on read; undelivered ones expire within minutes). Un-pairing the app deletes its keys locally. If you created an account, you can request deletion by emailing us; we remove the identity record and anything associated with it.

Children

Sirloop is a developer tool, not directed at children under 13, and we do not knowingly collect data from them.

Changes

If this policy changes materially, we will update this page and note the new effective date above.

Contact

Questions or deletion requests: dev@sirloop.com.