Rindler Custody App — Privacy Policy

Your site passwords are stored only on your own device. When you save a login in the Custody app, it is written to your device's secure storage — the iOS Keychain or the Android Keystore. It is not uploaded to Rindler. Rindler keeps no copy of it. There is no server-side vault to breach, and no Rindler employee can look your password up.

When a sign-in runs, exactly one secret is released, encrypted end to end. To sign you in to a site, a Rindler browser session generates a fresh, single-use encryption key and asks your device for one specific secret, for one specific site. Your device prompts you to approve with biometrics. Only then does it encrypt that one secret directly to that one browser session and sign it with a key that never leaves your device. Rindler's servers pass that sealed message along and cannot read it — they do not hold the key that opens it.

What this does not mean. We want to be straight with you: the secret is decrypted inside the browser session that performs the sign-in, and that browser runs on Rindler's infrastructure. So your password does briefly exist in memory there, for the seconds it takes to type it into the site's login form. It is discarded when the sign-in finishes and is never written to any Rindler database.

What device custody actually buys you is this: Rindler never stores your credentials and cannot obtain them on its own initiative. Every release is a one-time, single-site, single-request event that you approve with your fingerprint or face, and that you can decline. If your phone is off, or you say no, the sign-in simply does not happen.

Many sites text you a one-time code. If you turn this feature on, the app can supply that code so a sign-in you started does not stall waiting for you.

On Android, the code is extracted on your phone and only the code itself is sent. The rest of the message body never leaves your device.

On iOS, Apple does not permit an app to read your texts. Instead, you create a Shortcuts automation, using Apple's own Shortcuts app, that hands an incoming message to a Rindler action. The Custody app itself never reads your messages; it only receives what your own automation chooses to forward.

The message is not kept. Rindler's server extracts the code, uses it to finish the one sign-in that is waiting for it, and discards the rest. The message body is not stored in any database and is not written to our logs. If no sign-in is waiting, the code is thrown away and nothing happens.

You never have to turn this on. Typing a code into the app by hand always works and is the default. Automatic capture is a convenience layered on top of it, not a requirement.

Pairing this app to your Rindler account creates a device record. It contains your device's public key, a device token, and a device name (for example "iPhone"). That is what lets a sign-in request find your phone. It contains no credentials and no message content.

The app talks only to Rindler. It contains no analytics SDK, no advertising SDK, no crash-reporting SDK, and no third-party trackers of any kind. It makes no network calls to anyone but us.

Passwords and one-time codes: not retained. Codes and message content live only for the duration of the single request that carries them. Passwords are never on our servers to retain.

Device records are kept until you unpair the device, reset it, or delete your Rindler account.

On the device: Settings → "Reset device" → "Erase everything" wipes all local state — every saved login, the device identity, and the sign-in-code configuration. The device unpairs itself and the app returns to its first-run state.

Your whole account: deleting your Rindler account at chat.rindler.ai automatically revokes this app's sign-in-code token, revokes all of your paired devices, and purges your saved site configuration from our servers.

Account creation and deletion both happen on chat.rindler.ai, not in this app. The Custody app pairs with an account you already have; it does not create one.

The Custody app is not directed at children under 13 and we do not knowingly collect data from them.

We will update the "Last updated" date when this policy changes materially, and we will describe what changed rather than silently revising it.

Privacy questions, data requests, and corrections: founders@rindler.ai.