Privacy Policy

sinister.wtf is a private, invite-only social platform accessible at sinister.wtf and its associated subdomains. References to "we," "us," or "our" in this Privacy Policy refer to the operators of sinister.wtf.

This Privacy Policy applies to all users of sinister.wtf and any of its subdomains, including but not limited to dashboard, docs, status, terms, and privacy subdomains. It governs how we collect, use, and protect information in connection with your use of the platform.

We collect the minimum amount of information necessary to provide the platform. Below is a complete account of what we collect and why.

INFORMATION YOU PROVIDE DIRECTLY

INFORMATION COLLECTED AUTOMATICALLY

We use the information we collect exclusively for the following purposes:

• Providing and operating the sinister.wtf platform and its features.
• Authenticating your identity when you log in or perform sensitive account actions.
• Sending transactional emails — password resets, 2FA codes, invite confirmations, and critical security notices. We do not send marketing emails.
• Preventing abuse, spam, and unauthorised access through rate limiting and security monitoring.
• Displaying your public profile to other users of the platform in accordance with your settings.
• Investigating and resolving reports of Terms of Service violations.
• Maintaining the integrity and performance of platform infrastructure.

We do not use your data for any purpose not listed above. We do not build behavioural profiles, segment users for advertising, or perform automated decision-making that produces legal or similarly significant effects.

We believe these commitments deserve their own section, stated plainly and without qualification:

• We do not serve advertisements or work with ad networks of any kind.
• We do not share your personal data with third parties except as described in Section 7 (essential service providers only).
• We do not use your email address for marketing, newsletters, or promotional communications.
• We do not install third-party tracking pixels, session recording scripts, or cross-site tracking of any kind.
• We do not use your data to train machine learning models or AI systems, ours or anyone else's.
• We do not sell, licence, or otherwise commercialise aggregated or de-identified user data.
• We do not knowingly retain data longer than necessary for the purposes stated in this policy.
• We do not hand data to government or law enforcement agencies except where legally compelled by a valid legal order, and we will notify affected users where permitted by law.

sinister.wtf uses a minimal set of cookies and browser storage technologies, strictly limited to what is necessary for the platform to function.

We do not set advertising cookies, analytics cookies, or any cookie that is shared with or readable by third parties. You may clear all cookies at any time through your browser settings; doing so will log you out of the platform.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

• Account data — retained for the duration your account is active. Upon account deletion, personal data is permanently purged within 30 days.
• Server logs — retained for a maximum of 30 days for security and debugging purposes, then automatically deleted.
• Security records — in cases of confirmed abuse, a minimal record (hashed identifiers only) may be retained for up to 12 months to prevent re-registration.
• Backups — encrypted backups may retain data for up to 60 days, after which they are cycled out and destroyed.

sinister.wtf uses a small number of third-party infrastructure providers to operate the platform. These providers act as data processors — they handle data only on our instruction and are contractually prohibited from using it for their own purposes.

We do not integrate with any advertising networks, data brokers, social media tracking services, or analytics platforms. The list above is exhaustive — we do not share data with any service not named here.

We take the security of your data seriously. The following measures are in place to protect your information:

• All data in transit is encrypted using TLS 1.2 or higher. Unencrypted HTTP connections are redirected to HTTPS.
• Passwords are stored exclusively as bcrypt hashes with a sufficient work factor — we have no ability to read your password in plaintext.
• Two-factor authentication (TOTP) is available and encouraged for all accounts.
• Database access is restricted to platform infrastructure; no external parties have direct database access.
• Data at rest is encrypted by our infrastructure provider.
• Session tokens are rotated on privilege escalation and invalidated on logout.
• Rate limiting and anomaly detection are in place to detect and block credential stuffing and brute force attacks.

Regardless of where you are located, we recognise the following rights with respect to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may correct inaccurate data through your account settings or by contacting us.
• Right to erasure — you may request deletion of your account and all associated personal data. We will fulfil this within 30 days.
• Right to portability — you may request an export of your data in a machine-readable format.
• Right to object — you may object to any processing of your personal data that you believe lacks a lawful basis.
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us through the channels in Section 12. We will respond within 30 days. We will never charge a fee for reasonable data requests.

sinister.wtf is not directed at children under the age of 13. We do not knowingly collect personal data from anyone under 13 years of age. If we become aware that we have inadvertently collected personal data from a child under 13, we will take immediate steps to delete that data.

Users between the ages of 13 and 17 may use the platform only with the express consent of a parent or legal guardian, as described in our Terms of Service. If you are a parent or guardian and believe your child has registered without your consent, please contact us immediately.

We may update this Privacy Policy from time to time. We will indicate the date of the most recent revision at the top of this document. For material changes — such as new categories of data collected or new purposes for processing — we will notify users through the platform and, where appropriate, via email.

Your continued use of sinister.wtf after an updated policy takes effect constitutes acceptance of the revised terms. If you do not agree to the revised policy, you must cease using the platform and may request deletion of your data.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out through the following channels:

• Discord: discord.gg/thecom
• Platform: contact via the sinister.wtf dashboard

For formal privacy requests — data access, deletion, or portability — please use "Privacy Request — sinister.wtf" in the subject line. We will acknowledge your request within 5 business days and fulfil it within 30.