Privacy

Messages are encrypted end to end. Every device holds its own key, generated on that device and never sent anywhere, and each message is encrypted separately for each device in the conversation. The server stores ciphertext it has no key for. Voice notes, photos and video are encrypted the same way before they are uploaded.

This is not a promise about intentions. It is a description of what is technically possible: if we were compelled to hand over your conversations, we could hand over ciphertext and nothing else.

A voice or video call goes directly between the two phones and is encrypted between them. Siren passes the handshake and never carries the audio.

Your phone number and first name. Your city, region and country, and your timezone, which decide which groups you see and which admission panels reach you.

Who is in which conversation, and when messages were sent. This is not a metadata-hiding design: Siren can see that you and another woman exchanged messages this evening, and cannot see a word of them.

Reactions, because a toggle has to be recognised to work. The kind and length of a message, so a list can be drawn. Your settings, so they follow you between devices.

Location, only while you are sharing a trip or a silent SOS is open, and only so the women you chose can see where you are. It stops the moment the trip or the alert ends.

Messages expire on a timer you set, up to 72 hours. Expiry is a scheduled deletion of the row and of any recording attached to it, not a filter in the app. Deleting a message for everyone does the same thing immediately.

When you report a phone number, Siren stores a one-way HMAC of that number rather than the number. A stolen copy of the database cannot be turned back into a list of named men. It also means Siren cannot tell you who has been reported unless you ask about a specific number, which is deliberate.

Your words in a report are readable by the moderators who have to assess it. Your identity is never shown to the person reported.

Most women get in because a member vouched for them, and nothing identifying is asked for. If you arrive without an invite, three members decide instead, and you are asked for a photograph of an identity document, because otherwise nobody is accountable for you at all.

The three women deciding never see it. They hear the recording you made and nothing else, and they never learn who you are. Only staff can open the document, every time one does it is recorded, and it is deleted as soon as your application is decided, whichever way it goes. If nobody decides, it is deleted when the application lapses.

You can refuse and still apply. The three women will decide on your recording alone.

Contributing your own alerts to the map is off unless you turn it on. You shared your location with your circle during an emergency, and a map everyone can read is a different purpose.

Even switched on, an area only appears once three different women have raised an alert in it, areas are about a kilometre across, and counts are shown in bands rather than as numbers. No single alert is ever visible as a point on a map.

If you turn on alerts, your browser gives Siren an address to deliver them to. The notification is encrypted so the push service relaying it cannot read it, and for an encrypted message the server sends no preview at all: your own device decrypts the message to fill the notification in. With the cover switched on, a notification says nothing about who wrote or what they said.

Nothing is sold, and nothing is shared with advertisers or data brokers. There is no analytics service watching you use the app. Errors are recorded so faults can be fixed, and message content is never included in them.

Siren runs on Cloudflare, which stores the data and serves the app. Giphy is used to search GIFs, through Siren's own server, so Giphy does not see who searched.

In the app, under You, you can download everything Siren holds about you, and you can delete your account. Deleting means deleting: your account, your messages, your recordings and your reports are removed, not flagged. Groups you were in carry on without you.

Under the GDPR you also have the right to correct what is held, to object to processing, and to complain to your data protection authority. In Portugal that is the CNPD.

To be completed before launch. The controller of this data in law, and the address you write to about it, have to be named here. This cannot be filled in by guesswork, and the page should not go live to real users without it.