Sigrile Privacy Policy
1. Who provides Sigrile
Sigrile is provided by Saifullah Ahad (“we”, “us”, or “our”). This policy explains how the Android app, Sigrile API, anonymous locality comparison, and narrow consent-sharing features handle information.
2. What Sigrile does
Sigrile estimates how a room releases retained heat overnight by modelling how the phone’s battery temperature follows its surroundings. It shows uncertainty and refuses an answer when the evidence is inadequate. It is a household estimate, not a certified thermometer, alarm, or safety service.
3. Information kept on your phone
- Night samples: battery temperature and level, charging regime, available current reading, screen state, actual wall and elapsed timestamps, a short accelerometer motion summary, and available ambient-light lux.
- Room setup: the room label, optional sleeper label, optional town or city, coarse rounded coordinates, optional coarse building type, calibration choice, and anonymous-locality choice.
- Derived evidence: calibration parameters, estimator checkpoints, uncertainty-bearing room curves, saved weather hours, consent links, received offers, and a bounded retry outbox.
- Preferences: Celsius or Fahrenheit, reduced motion, selected morning/evening view, and the last anonymously contributed night.
Raw night samples and curves remain in Sigrile’s private local database. Android backup is disabled. Clearing app storage or uninstalling removes local records and the Android Keystore key.
4. Locality and weather
You may type a town or city. Sigrile sends that text to Open-Meteo’s geocoding service, then rounds the returned latitude and longitude to 0.25 degrees before saving them or requesting a forecast. Sigrile requests no Android location permission and does not collect an address, precise location, route, or location history.
5. Device identity and consent sharing
When a network feature is used, Sigrile creates a P-256 signing key in Android Keystore. The service receives the public key, device model, signed timestamp and nonce, and derives a pseudonymous device identifier. The private key never leaves Android Keystore.
A 15-minute code can create a narrow consent link. The watcher may choose a display label for that relationship; the service stores it with the consent link and returns it only to that linked installation. A linked person receives only one bounded morning sentence and its status—not the room name, raw samples, curve, locality, or address. Either installation can revoke the link silently. Structured cooler-room offers expire after 12 hours; there is no public directory, rating, photo, profile, or free-text message.
6. Anonymous locality comparison
This feature is off until you opt in. An eligible night may contribute only the locality-sized four-character geohash cell, ISO night, minimum and hour, crossover hour, uncertainty, and one coarse building-type label.
The curve submission is unlinkable at the application layer. The authenticated service first blind-signs a one-use token after checking night eligibility. The app unblinds it and submits the summary without a device identifier. The contribution endpoint verifies the signature and one-use status but cannot derive which registered installation received that token. Results remain hidden until at least five independent rooms contribute.
No raw curve, name, room label, public key, address, or fine coordinate is included. Cloudflare still necessarily processes network data such as an IP address to route and protect HTTPS traffic; Sigrile’s application database does not attach an IP address to a contribution.
7. How information is used
- To reconstruct an uncertainty-bearing overnight room curve and forecast likely overnight cooling on the device.
- To fetch coarse outdoor observations and forecasts when you add a locality.
- To deliver consented morning sentences and structured offers between two paired installations.
- To publish privacy-thresholded locality medians and optional device-model calibration priors.
- To prevent replay, enforce one contribution per eligible installation-night, rate-limit abuse, and investigate an unsafe-offer report.
We do not sell information or use it for advertising, behavioural profiling, credit, employment, or insurance.
8. Service providers
- Cloudflare: hosts the API, database, temporary device channels, model-prior cache, and locality aggregates; it processes HTTPS and service-security metadata.
- Open-Meteo: processes a typed locality query and coarse rounded coordinates to return geocoding and forecast data.
9. Retention
- Signed-request replay nonces: up to 10 minutes; registration challenges: up to 24 hours.
- Expired pair codes: deleted within 24 hours; active consent relationships and morning lines: until revocation or device deletion.
- Active offers: 12 hours; offer rows: up to 30 days; safety reports: up to 180 days.
- Blind-token issuance and one-use receipt records: up to 90 days. The issuance record contains an installation and night but no token or curve; the receipt contains a token hash and night but no installation.
- Anonymous locality contributions: up to 90 days. Published model-prior cache entries expire after 30 days; de-identified calibration rows are retained up to 90 days.
- Local records: until you use the in-app deletion control, clear Android app storage, or uninstall.
10. Your controls and deletion
- Leave locality blank to keep weather and locality comparison unavailable.
- Turn anonymous locality contribution off at any time from The street · anonymous.
- Use Stop watching or Stop sharing to revoke a relationship silently.
- Open Privacy and data → Delete my Sigrile data → Delete permanently to delete the cloud identity, pair codes, relationships, morning line, offers and reports associated with this installation, then clear local data and preferences.
Anonymous contributions and de-identified model calibration already separated from the device cannot be singled out after submission; they expire on the schedules above. See the deletion instructions or email the privacy contact for help.
11. Security
Traffic uses HTTPS. Device requests use Keystore-backed ECDSA signatures, bounded timestamps, nonces, idempotency keys, and rate limits. Locality contributions use RSA blind signatures and one-use token receipts. Access codes expire, aggregates require a five-household privacy floor, and offers require two independent eligible nights. No system can be guaranteed completely secure.
12. Children and user-to-user safety
Sigrile is a general household utility and is not directed to children under 13. It has no public profiles, chat, photos, or free-text posts. Structured offers can be declined, hidden, and reported. Sigrile prohibits child sexual abuse and exploitation. Read the separate Child Safety Standards.
13. International processing and changes
Cloudflare and Open-Meteo may process information in countries other than yours under their applicable safeguards. We may update this policy when the app, providers, or legal requirements change. The current effective date remains on this page.
14. Contact
For privacy questions, deletion help, or safety reports, email [email protected].