Privacy Policy
Data controller: The Sukun Life Ltd (thesukunlife@gmail.com)
Applicability: Global (incorporating GDPR, UK Data Protection Act 2018, CCPA/CPRA, and US state privacy frameworks)
1. Introduction and overview
The Sukun Life Ltd ("we", "us", or "our") is dedicated to protecting the privacy, dignity, and spiritual values of our community members. This Privacy Policy details how we collect, process, secure, and delete personal data when you use the Sanctuary mobile application.
2. Personal data we collect and how we collect it
| Category | Specific data points | Purpose | Lawful basis (GDPR Art. 6 / 9) |
|---|---|---|---|
| Account identity | Email address, name, username, profile picture | Authentication, account recovery, communications | Art. 6(1)(b) Contract performance |
| User content | Videos, photos, captions, comments | Publishing media, fulfilling core app functionality | Art. 6(1)(b) Contract performance |
| Verification data (automated) | Live camera frames captured in-app during the face check (not stored) | Confirming a live person who presents as female | Art. 9(2)(a) Explicit consent |
| Verification data (manual) | Live visual confirmation via Google Meet | Confirming eligibility without automated scanning | Art. 6(1)(f) Legitimate interests (safety) |
| Device and notifications | Push notification token, device type and operating system | Sending the notifications you have allowed | Art. 6(1)(b) Contract performance |
| Technical / telemetry | IP address, OS version, device type, crash traces | Security monitoring, server performance, crash fixes | Art. 6(1)(f) Legitimate interests |
| Community safety | User reports, moderation records, block lists | Platform enforcement, quarantine kill-switch | Art. 6(1)(c) Legal duty and Art. 6(1)(f) Safety |
| Messages | The messages you send and receive, who they are with, when they were sent and read, which message a reply answers, and that a message was deleted | Delivering your messages to the member you write to | Art. 6(1)(b) Contract performance |
| Photos in messages | The photos you send in a message (up to five at a time) and the photos you receive | Delivering them to the member you write to | Art. 6(1)(b) Contract performance |
Messages. You can send messages to a member when you both follow each other. Your messages are stored in our database (Supabase) so that you and the member you write to can read them on your devices. They are sent over an encrypted connection but are not end-to-end encrypted, and they are not scanned by any automated service. Only you and that member can read your conversation. Our team cannot browse conversations: when a member reports a message she received, our moderation team can read that message and a few messages before and after it to review the report, and each such view is recorded. A notification about a message shows who sent it, never what it says. If you delete a message, its text is erased for both of you and "This message was deleted" is shown in its place. A message that has been reported cannot be deleted until our team has reviewed it. When you open a conversation, the time you read it is stored so the App can show what is new. If you and the other member both have "Show when I've read or am typing" switched on (Settings > Privacy; it is on unless you switch it off), each of you sees "Seen" under your newest message once the other has read it, and "typing…" while the other is writing to you (this signal goes live between your two devices and is not stored); if either of you switches it off, neither of you sees either. You can delete a conversation for yourself: its messages so far are removed from your view, the other member keeps her copy, and a message you reported stays with our team until it is reviewed.
Photos in messages. You can send photos in a message, from your camera or your photo library. They are stored privately in our storage (Cloudflare R2), are not checked by any automated service, and can be opened only by you and the member you sent them to; when a member reports a message in your conversation, our moderation team can also open the photos in the messages shown with the report. The App has no way to save or share a photo from a message, and screenshots are blocked. If you delete a photo message, its photos are deleted for both of you. Our moderation team may remove a reported message, with its photos, for both members. When you and the other member have both deleted a conversation for yourselves, the photos in it up to then are deleted, except a photo in a message that is still being reviewed after a report.
3. Ephemeral biometric processing notice
3.1. Zero persistent storage: If you elect automated identity verification, Sanctuary uses Amazon Web Services (AWS Rekognition) to evaluate the camera frames of your face check. The analysis is performed in volatile memory to confirm that a live person is present and presents as female. We do not compile, extract, store, or retain facial landmark templates, mathematical vectors, or the original images. Once the verification response (pass/fail) is received, the data is purged.
3.2. Manual non-biometric alternative: Automated verification is entirely voluntary. If you choose our manual verification flow, you will participate in a brief live Google Meet call with our female moderation staff. No video, audio, or photographic assets are recorded or stored.
4. Third-party sub-processors and infrastructure
We share personal data strictly with vetted technical sub-processors under Data Processing Agreements (DPAs) with Standard Contractual Clauses (SCCs) where required:
- Database and authentication: Supabase Inc. (hosted on AWS infrastructure in EU and UK cloud regions).
- Media and asset hosting, and server functions: Cloudflare, Inc. (Cloudflare R2 and Workers; encrypted at rest).
- Automated verification engine and image safety checks: Amazon Web Services EMEA SARL (AWS Rekognition; ephemeral processing, zero retention).
- Transactional communications: Resend, Inc. (transactional email delivery and security codes).
- Content safety filtering: OpenAI, L.L.C. (OpenAI Moderation API; text scanned in transit for abusive content; zero-training terms applied). Messages between members are not sent to it.
- Photos in messages are not sent to the image safety checks (AWS Rekognition).
- Push notifications: Expo (Expo Push Notification service), Google LLC (Firebase Cloud Messaging, for Android) and Apple Inc. (Apple Push Notification service, for iPhone). They deliver notification messages to your device.
- Stability and error reports: Functional Software, Inc. (Sentry), application error reports.
- Manual video verification: Google LLC (Google Meet; direct, encrypted video stream; zero recording policy).
Note: We do NOT integrate any advertising technology, marketing tracking pixels, or data broker SDKs (for example Meta Pixel, Google AdMob, AppsFlyer).
5. International data transfers
Personal data collected within the UK and European Economic Area (EEA) is stored primarily on servers located in the EU and the UK. Where data is transferred to sub-processors outside the UK/EEA (for example in the United States), transfers are executed pursuant to the EU-US Data Privacy Framework, the UK Extension to the EU-US DPF, or standard Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office (ICO).
6. Data retention and erasure schedule
- Active accounts: We retain your account data and content for as long as your account remains active.
- Deleted accounts: Upon initiating an in-app account deletion via Settings > Delete Account, your personal identifiers, profile, and content are permanently deleted across Supabase and Cloudflare R2 within seventy-two (72) hours.
- Moderation and safety records: Where an account is terminated for severe harassment, predatory behavior, or Terms violations, we may retain limited moderation records solely to enforce platform bans and for legal defense.
- Messages: kept while both members' accounts exist. When either member deletes her account, the whole conversation, including the other member's messages in it, is deleted. Deleting a conversation for yourself only hides it from you: the messages stay stored for the other member until either account is deleted. Photos in messages are kept with their message and deleted with it; once both members have deleted a conversation for themselves, its photos are deleted (a photo in a message under review after a report is kept until the review ends).
7. Your legal rights (UK GDPR, EU GDPR, CCPA/CPRA)
Under applicable privacy laws, you maintain the right to:
- 1 Access and rectification: Request a copy of your personal data or request corrections. You can download a copy of your data yourself in the App under Settings > Download my data (it includes your conversations and the messages you can see in them).
- 2 Erasure ("right to be forgotten"): Demand deletion of your data via the in-app deletion pipeline or by email.
- 3 Withdraw consent: Withdraw biometric or processing consent at any time (which will end your ability to hold an active verified account).
- 4 Lodge a complaint: Lodge a complaint with the UK Information Commissioner's Office (ICO) (ico.org.uk) or your relevant EU Data Protection Authority.
To exercise any right, contact our Data Governance lead at: thesukunlife@gmail.com.