Privacy policy
Last updated: August 28, 2026 · version 3
This is a translation. If it differs in meaning from the Portuguese version, the Portuguese version prevails (section 14 of the Terms of use).
Ephemera is a social network with no memory. Most of this policy is about what does not exist here — and that is the main point: the safest way to protect data is not to have it.
Who is responsible for the data
Controller: Márcio Oliveira de Souza Mello.
Data protection officer (art. 41 of the LGPD, Brazil's General Data Protection Law): Márcio Oliveira de Souza Mello — privacidade@ephemera.app.br.
It is the same address for exercising any of your rights, and we reply within 15 days.
What exists in Ephemera — and for how long
| What | For how long | Why (LGPD, art. 7) |
|---|---|---|
| Email and password | until you delete the account | performance of the contract (V) |
| Your preferences: languages, region, theme | until you delete the account | performance of the contract (V) |
| For the swarm: your two choices (hatch in swarms, receive a notification), the time you last opened the app and the time your last life ended — only the most recent of each, overwritten — and the public keys of upcoming lives | until you delete the account; the keys, until you sign out or turn the swarm off | performance of the contract (V) |
| The life in progress: drawn name, position on the map, public key | 24 hours, and deleted within 1 hour after | performance of the contract (V) |
| Messages, end-to-end encrypted | deleted with the life | performance of the contract (V) |
| Who talked to whom and when | deleted with the life | performance of the contract (V) |
| Your device's notification address | until you sign out or delete the account | performance of the contract (V) |
| Access records: IP and time | 6 months | legal obligation (II) — Marco Civil da Internet, art. 15 |
| A report and the conversation that comes with it | 180 days; 5 years if it involves a child or teenager and is referred to the authorities; or longer under an authority's order | legitimate interest (IX) and, where there is a legal duty, obligation (II) |
| Record of a sanction | up to 24 months after it stops being in force | legitimate interest (IX) |
| Mark of a sanctioned device | while the sanction lasts | legitimate interest (IX) |
| Record of who, in moderation, read a report | while the report exists | accountability (art. 37) |
| Purchase receipts | tax-retention period | legal obligation (II) |
Deletion is automatic: a routine runs every minute and removes whatever has expired. There is no backup of what is deleted.
What does not exist in Ephemera
- We don't ask for your name, phone number, ID or photo.
- We don't use GPS and we don't ask for location permission. The region is declared by you, and the position on the map is drawn within it.
- We don't read your conversations. They are end-to-end encrypted and the key dies with the life, inside your device.
- There is no profile, history, contact list or photo.
- There is no advertising, no third-party trackers and no sale of data.
- We don't keep what you have read, or when. The "seen" mark stays on your device.
- We don't back up the app on your phone — Android's automatic backup is turned off, so that your saved password never goes to the cloud.
The exception: reports
There is a single exception to the rule of not keeping conversations. When someone reports, the reporter's device sends the conversation in readable text — it is the only way to investigate in a service with end-to-end encryption.
About this, to leave no doubt:
- A person reads that conversation. Moderation is human, and access to the material requires two-factor authentication.
- Who read it and when is recorded.
- The person reporting sees exactly what will be sent, before sending it.
- The reported conversation may contain sensitive data (art. 5, II). We process this material on the basis of art. 11, II, "d" and "f" of the LGPD — regular exercise of rights and protection of life and physical safety — for the strictly necessary period.
- A report involving a child or adolescent is forwarded to the competent authorities.
Who the data passes through
We use the following providers, as processors (art. 39):
| Provider | What for | Where |
|---|---|---|
| Supabase | database, accounts, authentication | São Paulo, Brazil |
| Resend | confirmation and password-recovery emails | São Paulo, Brazil |
| Cloudflare | this website and email forwarding | global network |
| Google (Firebase) | delivery of notifications | outside Brazil |
| Google (ML Kit) | download of translation packs | outside Brazil |
| Apple and Google | in-app purchases, when there are any | outside Brazil |
International transfer
The app's database and email sending are in Brazil. Three things leave the country, and you should know exactly which (art. 33):
- Notifications. To tell you that someone spoke to you, the name drawn for that life and your device's notification address pass through Google's service. The text of the message never goes with it. Denying the notification permission avoids this entirely.
- Downloading translation packs. Downloading them tells Google which languages your device wants. The text of your conversations is never sent — translation happens inside the device, without a network.
- Emails you write to us. Messages sent to contato@, seguranca@ or privacidade@ pass through Cloudflare's global network before reaching the mailbox that reads them. If you prefer not to expose personal data this way, leave it out of the message: we will say what we need when we reply.
When in-app purchases exist, payment will be processed by Apple or Google, also outside Brazil; Ephemera receives only the receipt.
Translation and languages
Translation is done on your device, by a component that works without internet once installed. Each language takes about 30 MB and can be deleted at any time in You → Translation packs.
Your rights
The LGPD (art. 18) guarantees you confirmation, access, correction, deletion, portability, information about sharing and withdrawal of consent. In practice, here:
- Access and correction — your preferences and your password are in the app itself, and you can change them whenever you want.
- Deletion — You → Delete my account. It is immediate, and what survives is in the table of retention periods above.
- Portability — there is nothing to port, and that is the design of the service: conversations don't last beyond 24 hours, there is no profile, there is no history. It is not a refusal, it is an absence.
- Any other request — privacidade@ephemera.app.br, reply within 15 days.
You may also complain to Brazil's National Data Protection Authority (ANPD).
Security
The measures in force (art. 46): end-to-end encryption of messages; row-level and column-level isolation in the database, so that one user cannot reach another's data; two factors for moderation; passwords with a minimum of 8 characters; and the device's automatic backup turned off.
If there is an incident
If a security incident occurs that carries a relevant risk to your rights, we will notify you and the ANPD within 3 business days — the deadline set by ANPD Resolution CD/ANPD No. 15/2024, counted from when we learn that personal data was affected.
The notice says what happened, which of your data was affected, what we have already done and what you can do. It arrives at your account's email, which is the only way we have of reaching you — we don't ask for a phone number and we don't keep a name.
We keep a record of every incident for at least 5 years, including those that did not require notification. Channel: privacidade@ephemera.app.br.
Minimum age
Ephemera is for people over 18 and is not intended for children or adolescents. We do not knowingly collect data from minors; when we find out, the account is closed and the data is deleted.
Changes to this policy
If something changes in a material way, we will tell you in the app before the change takes effect. Every version carries its date at the top.