Privacy Policy

Overview

SynchroCity is a proximity-based social discovery platform committed to privacy. Our core principle: your location never leaves your device. All proximity computation happens on-device using Bluetooth Low Energy (BLE). There is no central server that knows where you are, who you met, or what you said.

1. Data We Collect

1.1 Data You Provide

Data	Purpose	Stored Where	Sent to Server
Alias	Display name	Device only	No
Interests & depth	Resonance matching	Device only	No
Skills & flags	Skill complementarity	Device only	No
Communication style	Conversation compatibility	Device only	No
Transmission	Real-time broadcast	Device only	No
Birth chart (optional)	Synastry matching	Device only	No
Birth year	Age verification	Device only	No

1.2 Data Collected Automatically

Data	Purpose	Stored Where	Sent to Server
Bluetooth beacon IDs	Proximity detection	Device, ephemeral (rotates 15 min)	No
Location coordinates	BLE estimation	Device, real-time only (not stored)	Never
Encounter records	History	Device only	Anonymized beacon IDs only
Glyphs	Reputation	Device + server (anonymized)	Yes (anonymized)

1.3 Data We Do NOT Collect

Real name Email Phone number Photos GPS history Contacts Browsing history Advertising identifiers

2. How We Use Your Data

On-device resonance matching
Encounter facilitation
Glyph accumulation
Age verification

3. Sensitive Data

Birth chart data is treated as GDPR Article 9 special category data. It is entirely optional, stored on-device only, never transmitted to any server, and can be removed at any time from your profile settings.

4. Data Sharing

We never sell or rent your data. Data may be shared only in these limited contexts:

Device-to-device: End-to-end encrypted via the Tavern Protocol
Relay server: Encrypted payloads only, auto-deleted after 60 seconds
Anonymized analytics: Aggregate, non-identifying usage patterns
Legal requirements: Only when compelled by law

5. Data Retention

Data Type	Retention Period
Profile	Until you delete it
Encounters	Configurable: 7 days to unlimited
Glyphs	Permanent (anonymized)
Beacon IDs	15-minute rotation
Encryption keys	15-minute rotation
Location	Not stored
Relay messages	60 seconds
Chat messages	24 – 72 hours

6. Your Rights

GDPR Rights

Right of access
Right to rectification
Right to erasure
Right to data portability
Right to object
Right to restrict processing

CCPA Rights

Right to know
Right to delete
Right to non-discrimination

All Users

Export all your data
Delete your account
Disable BLE broadcasting
Enable ghost mode
Remove birth chart

7. Security

End-to-end encryption: X25519 key exchange + XSalsa20-Poly1305 authenticated encryption
Rotating identifiers: Beacon IDs and keys rotate every 15 minutes
On-device computation: All matching and analysis happens on your phone
No central location database: There is nothing to breach

Adversarial Considerations — What the Architecture Does and Does Not Defend Against

SynchroCity is designed to resist the kinds of surveillance most social apps enable by default: casual data harvesting, mass metadata collection, cross-app profiling, and location-history reconstruction. It is not designed to make you invisible to a targeted adversary with unlimited resources, and we do not claim otherwise. Security researchers will (correctly) ask the following questions about any BLE proximity product; here are honest answers.

Signal-strength (RSSI) inference — can it be used to physically locate a specific person? RSSI is inherently noisy and only indicates rough proximity, not direction. Because beacon IDs rotate every 15 minutes, an attacker cannot reliably chain RSSI observations of one specific person across time windows using BLE alone. Any BLE device that broadcasts will emit a signal a nearby receiver can measure — this is a limitation of the physical layer, not something any app-level design can fully eliminate. In practice: casual RSSI collection cannot follow a specific user for long; a targeted actor combining RSSI with in-person observation can, as they can with any BLE-emitting device.
Beacon replay. Beacon IDs incorporate a rotating time-based salt and a MAC; replayed beacons outside the current window are rejected. Replay within the current 15-minute window remains theoretically possible for an attacker who captures and re-broadcasts a beacon, but the encounter flow requires a completed handshake before revealing any resonance detail, limiting what a replay attacker can accomplish.
Mesh-based following. With rotating beacon IDs, an attacker cannot reliably follow a specific user across time windows via BLE alone. Following a specific user still requires either physical co-location or correlation with an out-of-band signal (visual observation, another tracking device). SynchroCity does not create a following capability that did not already exist for any BLE device.
Targeted re-identification. The resonance-engine profile is never transmitted; it lives only on-device. Combined with rotating IDs, distinguishing one specific user's beacons from others' over multiple sessions is difficult without out-of-band context. It is not impossible — especially for a nation-state adversary combining BLE observation with other signals — and we do not claim it is.
Relay server compromise. The relay handles ciphertext only. Compromise reveals rotating beacon IDs, connection timing, and queue sizes — not message contents, identities, or locations. The relay is deliberately dumb; its security model does not depend on it being trusted.
Legal process. We can produce only what we have. On the relay side, that is rotating beacon IDs and traffic metadata; on the app side, we hold nothing about you. Message payloads are decrypted only on your device — there is nothing legible for us to hand over. This is architectural, not aspirational.

Threat model summary: SynchroCity claims a strong architectural raise-the-cost defense against casual, mass, and metadata-based surveillance. It does not claim invisibility from a targeted adversary. If your threat model includes such an adversary, no consumer mobile product — ours included — should be your only defense. We welcome scrutiny; if you find a specific attack we have not addressed, please contact us at moonlit-social-labs@proton.me.

8. Adults Only (18+)

SynchroCity is a proximity-matching product for adults only. Users must be at least 18 years of age. Age is confirmed during onboarding via an explicit 18+ affirmation that must be completed before the app can be used; the affirmation timestamp is recorded on-device as a compliance record. We do not knowingly collect data from minors. If we become aware that a user is under 18, we will terminate their account and delete any data associated with it. To report suspicion that an underage user is on the mesh, use the in-app report flow (Reasons → “underage user”) or contact us at moonlit-social-labs@proton.me.

9. International Transfers

For non-US users, where applicable data transfers occur, we rely on Standard Contractual Clauses (SCCs) to ensure adequate protection under GDPR.

10. Changes to This Policy

If we make material changes to this privacy policy, you will be notified via an in-app notification before the changes take effect.

11. Contact

For privacy-related inquiries, please contact us at moonlit-social-labs@proton.me

12. Data Protection Impact Assessment

A DPIA has been conducted for SynchroCity. The assessment concluded that the privacy-by-design architecture — with on-device computation, rotating identifiers, end-to-end encryption, and zero central data collection — provides adequate protection for all categories of processed data.

Privacy at a Glance