Privacy Policy

Last updated 3 September 2026 · questions to support@sigmint.space

Who this covers

Two groups, and they are handled differently: builders (people with an account here) and their app's users (people who install an app built on this platform). We are the data controller for builders. For an app's end users, you are the controller - we are your processor, and only touch their data because you asked us to send them a notification.

What we store about you

Account: name, email, a bcrypt hash of your password (cost 12 - never the password itself), optional avatar, and whether you verified your email.
Plan and usage: your plan, build count, and a daily counter for builds/notifications so limits can be enforced.
Apps: name, package id, target URL, icon, chosen colours/theme ids, and an optional Firebase google-services.json plus service-account JSON.
Builds: version, status, artifact paths, the GitHub workflow run id, and the IP address that started the build (abuse control).
Notifications you send: title, body, target type, and a send count.
Payments: plan, amount, currency, method, transaction id and payer email.
Sign-in: if you use Google, we keep the Google id and email it returns. A single-use OTP hash lives for 10 minutes while you verify an email.

We do not run third-party analytics or advertising trackers on this site.

Your app's users

An app built here registers a Firebase Cloud Messaging device token, which we store with your app id so pushes can reach that device. We keep the token, the app it belongs to, and whether it is active - not a name, not a location, not a profile. Sending a notification is done on your instruction, through your Firebase project, straight to that token. Delete a device row (or an app, which cascades) and the token is gone.

The app loads your website, so cookies, local storage and any analytics you have installed on that site are yours to disclose in your own privacy policy.

Who else sees it

GitHub - the build runs in your own Actions workflow; your repository sees the app name and the payload the build needs.
Google Firebase - notification delivery and your project config.
Google sign-in - only if you use it, for the OAuth handshake.
Our email host (SMTP) - OTP and notification emails, containing the address you gave and the OTP itself.
Nobody else, and we do not sell or rent personal data.

How it is protected

Passwords: bcrypt. Session id regenerated at login; session cookies HttpOnly.
Firebase service accounts and your GitHub token: AES-256-GCM at rest, keyed by an encryption key held in config, never in the database dump.
Build payload URLs are single-use HMAC tokens that die once the build finishes.
SQL goes through prepared statements; uploaded icons are re-encoded with GD, so a PHP file named .png does not survive the upload.
config.local.php, the SQL dumps and vendor/ PHP files are denied over HTTP.

No storage is unbreakable. If we are ever breached in a way that exposes your credentials we will tell you what we know and rotate what we can.

How long

Account data while your account exists. Deleted account: apps, builds, notifications and device tokens go immediately; payment rows are kept without your email attached because receipts are a legal requirement (3 September 2026 basis: Indian IT Rules and tax record-keeping - adjust for your own books). OTP rows expire in the table within a day of use.

Your choices

Export or correct anything in Settings, or ask us for a copy of your rows by email.
Delete your account from Settings - password plus a typed confirmation, no support ticket needed.
Revoke our GitHub token any time in your GitHub settings; it stops builds, nothing else.
App users: ask you (the builder) to remove their token; we act on your request.

Children, transfers, changes

This platform is for businesses, not children under 16. Servers may be located outside your country (our host, GitHub and Google all are) - by using the service you accept that processing happens there. If this policy changes materially we email you before it applies; the date at the top always shows the current version.

Controller

[your name or "the account holder"] - support@sigmint.space. If something here is not settled the way your jurisdiction requires (DPDPA in India, GDPR in the EU), fix the bracketed lines before you launch.