Privacy Policy

Last updated: 3 September 2026

Sift is an iOS app that saves the content you come across on Instagram, organizes it for you, and brings it back when it is useful. This policy explains what data is processed when you use the app, where it is stored, and how you can delete it.

Data controller: Yasin Çetin, Türkiye. Contact: hellosiftapp@gmail.com. "We" in this policy means that controller.

Summary

• What you save lives on your device first.
• AI analysis runs on your device if your device supports it, and in the cloud if it does not; you are told which during onboarding.
• You can use the app without an account. Your data syncs across devices only once you sign in.
• There is no advertising tracking, no advertising identifier, and no sharing of your data for advertising.
• There is anonymous usage analytics measuring which screens get used. It is on by default and can be switched off in Profile → Privacy. Nothing you save ever enters it.
• Saved content (titles, links, notes) is never written to logs or crash reports.
• Notifications are scheduled on your device only; we run no notification server.
• You can permanently delete your account and all of your data from inside the app.

Data we process

Content you save

When you save a post to Sift we process: the content's link, its caption text, the thumbnail address, the short summary, tags and category produced by the AI, the date you saved it, its status (new / viewed / tried / archived), the reminder date if you set one for it, and any personal note you add.

To fetch an item's title, description and thumbnail, the app requests the link directly from your device; no server of ours sits in between.

If you change the category the AI picked, that correction (old category, new category, date) is recorded inside your own account. We keep it only to measure how accurate the classification is and to improve it for you over time.

Account information

On first launch the app creates an anonymous session whose identifier is a random string that does not identify you. If you choose to sign in with Apple or Google, the name and email address that provider shares with us is associated with your account. Sift never sees or stores your password.

Until you sign in, none of your content leaves your device: an anonymous session does not sync, and your archive stays local. Sync begins the moment you sign in with Apple or Google, and everything saved up to that point moves into your account.

Technical data

The app has no server of its own: your device talks only to Google Firebase (authentication, sync and, where needed, cloud AI) and to the address of the link you saved. We do not collect advertising identifiers and do not track you across apps or sites.

To verify that requests reaching Firebase really come from the Sift app, we use Apple's App Attest (via Firebase App Check). This proves the device is running the app; it does not identify you.

Usage analytics

We use Google Firebase Analytics to measure which screens get used and which features people reach for. What is measured is counts and a fixed set of event names — nothing you save, no captions, links, notes or anything the AI wrote about them ever enters these events; the fields an event may carry are a closed list in the code.

The measurement is tied to a per-device Firebase app instance id. That id is not an advertising identifier and cannot be used to track you across apps — Sift deliberately omits the Firebase component that would collect the advertising identifier. Analytics is on by default, is mentioned on the first-run screen, and can be switched off at any time in Profile → Privacy; collection stops the moment you switch it off.

Purchase state

The app includes RevenueCat's SDK for paid features we intend to offer later. Nothing is for sale in this version and the app never starts a purchase; the SDK only generates an anonymous user id on first launch and can ask whether the device's Apple Account already holds a Sift purchase. That id is not associated with your name, your email, or anything you save.

How we use the data

• To show you what you saved and make it searchable.
• To categorize and summarize content automatically.
• To sync your data across your devices, if you have an account.
• To show the end-of-day summary and any reminders you set on individual items, if you allowed notifications.
• To keep the service secure (for example, verifying that requests really come from the app).
• To measure anonymously which screens and features get used, so we can decide what to build next.

We do not sell your data, do not share it for advertising, and do not allow anyone but you to reach your archive.

Legal basis

We process your personal data on the following legal bases (GDPR Art. 6 / Turkey's KVKK Art. 5):

• Performance of a contract — storing what you save, organizing it, making it searchable, and syncing it if you have an account. Without this the app cannot do its job.
• Consent — notifications. They are optional; you can withdraw consent at any time (turn off notification permission), and withdrawal does not affect processing already carried out.
• Legitimate interests — protecting the service from abuse (verifying that requests really come from the app), measuring how accurate the classification is, and measuring anonymously how the app is used. You can object to that last one at any time by switching analytics off in Profile → Privacy.
• Legal obligation — where the law expressly requires it.

Where your data is processed

Our providers — Google, Apple and RevenueCat — operate global infrastructure, so your data may also be processed in countries outside Türkiye and Europe.

Those transfers take place under the standard contractual clauses and data processing terms of the providers concerned. If you would rather your data did not travel abroad: used without signing in, nothing you save leaves your device, and analytics can be switched off in Profile → Privacy.

Security

Your data travels between your device and our servers over an encrypted connection (HTTPS/TLS) and is stored on your device under iOS's own protections. On the server, security rules ensure that only your account can reach its own data.

No system is entirely without risk. If a breach affects the security of your data, we will notify the competent authority within the period the law requires, and tell you as well where it affects you.

AI processing

Summarizing and categorizing content happens one of two ways, and your device decides which. If your device supports Apple's own AI model (iPhone 15 Pro and later), the work is done on the device and the content never leaves it. If your device does not support that model, or the model is temporarily unavailable, the work is done by Google's cloud model (Gemini via Firebase AI Logic) — this is the route on older devices. You are told about this when you first open the app. What is sent for cloud processing is limited to the item's caption text and the name of the account that posted it — not your personal note, your account details, or the rest of your archive — and it is not used to train models.

All the AI does is categorize and summarize content. No automated decision is made about you that produces legal effects or similarly significantly affects you, and you can correct the category and tags it produces at any time.

Search

In-app search runs entirely on your device. A numerical search index is built from the text of what you save and stored on the device; your search queries are never sent to any server.

What you save is also added to your device's system index so it can be found in iOS Spotlight. That index stays on your device, and anything you archive or delete is removed from it too.

Notifications

Sift uses local notifications only: they are scheduled on your device and fire there. We have no notification server, send no remote notifications, and collect no device push token. If you never grant notification permission, the rest of the app works exactly the same.

Storage and sharing

Your data is stored on your device and — if you have signed in — in an area reserved for your account on Google Firebase (Firestore). Security rules ensure that only your account can read its own data.

Your data is processed via the following providers:

• Google Firebase — authentication, storage, analytics and (when needed) cloud AI.
• Apple — Sign in with Apple.
• RevenueCat — managing purchase state for paid features we intend to offer later. It never sees anything you save.

We share your data with no one else. Where a legal obligation arises, we may disclose data to the extent applicable law requires.

Retention

Saved content is kept until you delete it or close your account. Content you delete in the app is archived first; deleting your account removes everything permanently.

Your rights and how to delete your data

You can access, correct and delete your data from within the app at any time. Under applicable law (GDPR / Turkey's KVKK Art. 11) you also have the right to:

• learn whether your personal data is processed and access it;
• have it corrected if it is incomplete or inaccurate;
• request its erasure or destruction;
• request restriction of processing and object to processing based on legitimate interests;
• receive your data in a structured, commonly used format (data portability);
• withdraw consent where processing relies on it;
• ask that corrections or erasures be communicated to third parties the data was transferred to;
• and lodge a complaint with a supervisory authority — in Türkiye the Personal Data Protection Authority (KVKK), and in the European Economic Area the data protection authority of your country.

Send requests to the contact address above; we respond within 30 days at the latest. Where a request could expose someone else's data, we may need to verify your identity first.

To delete all of your data:

• In the app, go to Profile → Account & sync → Delete account. This permanently removes all of your data both on the device and on the server, and cannot be undone.
• If you no longer have access to the app, write to us at the address below to request deletion.

Children's privacy

Sift is not directed to children under 13 and does not knowingly collect data from them. In some countries the age at which you can consent to digital services on your own is higher (up to 16); below that age you should use the app only with a parent's or guardian's permission. If we learn that we have collected such data, we delete it — and if you believe we are processing a child's data, please write to us.

Changes

We may update this policy from time to time. When a significant change happens we will say so in the app; the date at the top of this page always reflects the version in force. If we ever need to widen processing that relies on consent, we will ask for your consent separately.

Contact

For privacy questions or requests, write to hellosiftapp@gmail.com or reach us at @siftsave. We respond to requests within 30 days at the latest.