supersync — Privacy Policy

Last updated: 2026-09-22

supersync is an end-to-end-encrypted sync buffer. It moves small pieces of text and files between your own devices, and to people you choose, without the service being able to read them.

This policy explains exactly what our servers can and cannot see. We have tried to write it so that a person can check it against the software rather than take it on trust.

Who we are

supersync is operated by djb consulting (“we”, “us”), Amsterdam.

For any privacy question, or to exercise any of the rights below, contact supersync@derekbillingsley.com.

The short version

• Everything you store is encrypted on your device before it leaves it. We hold no key that can open it.
• We can see your email address, and technical information needed to route and bill for sync: account and device identifiers, approximate sizes, timestamps, and who you share with.
• We cannot see the content of anything you store — not the value, not its name, not its type, not a filename, not a single byte of a file.
• We do not use analytics, advertising, crash reporting, or tracking of any kind. The application contains no third-party analytics or advertising code.
• We do not sell or share personal information with anyone for their own purposes.

What we collect

Information you give us

Your email address. Required to create an account. We use it to identify the account, to send you a sign-up code, and to contact you about the service if we must. It is the only directly identifying information we hold.

During sign-up we also temporarily store a hashed one-time code and a count of failed attempts. The record is destroyed when the code is used or expires, whichever comes first.

Information generated by using the service

To move your data between devices, our relay necessarily stores and processes:

• Account and device identifiers. The names you give your devices are encrypted on your device before they are sent, and we cannot read them.
• Device public keys and certificates. Public key material only. No private key of yours ever reaches us.
• Encrypted entries and files. We store the ciphertext until every one of your devices has confirmed receipt, or until a retention limit is reached. We cannot decrypt any of it.
• Approximate sizes, rounded into buckets rather than recorded exactly.
• Timestamps and access patterns — when entries were created, expire, and were fetched.
• Sharing relationships. If you share an entry with another person, we store which account shared with which, when, and how large it was. We cannot see what was shared.

Information collected automatically

We do not store your IP address. Our relay does not record it and our load balancer is not configured to log requests. Your IP address is necessarily visible to our hosting provider while a request is in transit — as it is to any service you connect to — but we do not retain it.

Operational logs record events rather than people: that a sign-up code was sent, that an account was created, that a cleanup deleted a number of rows. Accounts and devices appear as internal identifiers. Email addresses do not appear in them at all. Logs are deleted after 30 days.

On your device

The application stores your data in an encrypted local database. The key for it is held in your operating system's keystore, or derived from a passphrase you choose. Neither the key nor the passphrase is ever transmitted to us.

Application settings and your recovery code acknowledgement are stored locally.

What we cannot see

This is the central claim of the product, so it is worth stating precisely. Our servers cannot see:

• the value of anything you store, including passwords, notes and snippets;
• the name you gave it, its type, or its tags;
• the filename, or any byte of any file;
• the names you give your devices;
• whether an entry was deleted, how many times it has been edited, or whether you marked it to be read once. One exception: a large attached file is stored separately, and when its entry is deleted we can see the file being cleaned up;
• any encryption key of yours.

All of these are encrypted on your device with keys derived from a root key that is generated on your device and never sent to us. This is not a policy commitment we could quietly change — it is a property of the encryption. We could not read your data if we were asked to, compelled to, or compromised.

What we deliberately do not protect against

supersync does not hide metadata. Somebody with access to our servers — including us, or anyone who compelled or breached us — could learn that an account exists, how many entries it holds, roughly how large they are, when they were written and read, and which accounts share with which. Hiding that would require a fundamentally different and much larger system, and we have not built one.

supersync also does not protect you against a compromised device. If somebody can run code as you on your computer or phone, they can read what you can read.

Permissions the app asks for

Who else is involved

We use these providers to run the service. They process data on our behalf, under contract, and only for that purpose:

We do not sell personal information, and we do not share it with anyone for their own advertising or analytics.

How long we keep things

• Encrypted entries and files are deleted once all of your devices have confirmed they have them, or after 30 days, whichever comes first. The service is a relay, not a backup — your data lives on your devices.
• Shared entries are deleted 30 days after the recipient last read them, or when you withdraw the share.
• Sign-up codes expire within minutes and the record is then destroyed.
• Your account record and email address are kept until you delete your account.
• Operational logs are deleted after 30 days.
• Database backups are kept for 7 days. Deleting your account removes it from the live database immediately; it can persist in a backup for up to a week, after which the backup itself is deleted. If we ever had to restore from one, we would re-apply any deletion requested in the meantime.

Deleting your account

You can delete your account from inside the application, at any time, without contacting us: Settings → Start over. The same is available from the command-line client with ssc account delete.

Deleting removes your account record, your email address, your devices, and any encrypted data we are still holding. It cannot remove copies already on your own devices, or copies somebody you shared with has already saved — we have no access to either.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal information we hold, to object to or restrict processing, and to complain to a regulator.

In practice, almost everything we hold is already visible to you from inside the application, and you can delete all of it yourself. The command-line client will also write you a complete copy of what this service holds about you, and change the email address on your account:

ssc export
ssc account email <new address>

Changing your address sends a code to the new one, and a notice to the old one.

For anything else, or if you would rather we did it, write to supersync@derekbillingsley.com and we will respond within the period the applicable law requires.

Children

supersync is not directed at children and we do not knowingly collect information from them.

International transfers

Our infrastructure is hosted in Canada (ca-central-1). If you use the service from elsewhere, your information is transferred there.

Changes to this policy

If we change this policy we will update the date at the top. If a change affects what we can see, we will say so prominently rather than quietly revising the text.