Privacy in Sada
Map detail
When you zoom into the map, visible-area detail loads from OpenStreetMap. The service receives your IP address, browser information and requested map tiles. Sada does not send your name, account identifier or messages to it.
Sada is a beta service for sharing written notes, voice notes and music links. Contact Sada support inside the app for privacy questions or data requests.
Voice notes and phone sign-in
Recording starts only when you choose to record and allow microphone access. Sent voice recordings are stored with the bottle and can be played by people allowed to open it. Deleting the bottle removes its recording from active storage. A shared story video contains a copy of the recording; Sada cannot remove copies saved elsewhere. Written notes may include a song link; voice notes may include a short caption. Replies can contain text, one song link, or both; song replies are comments, not Echoes. For phone sign-in, Google processes and stores your phone number for authentication and abuse prevention. Your number is not shown on your public profile.
Your account
Google/Firebase manages sign-in and, for email accounts, your password. Sada uses an account identifier, your chosen display name and preferences. Your optional profile photo is visible to signed-in users if you choose a public username, and is removed when replaced, removed, or your account is deleted. Read history is stored per account; senders see only the unique-reader count, not reader identities. Water sound preferences are saved with your account. Verified email is used privately for authentication and administrator access; it is not included in public song or comment responses.
Public and anonymous posts
Songs, notes, signed display names, comments and reaction counts can be seen by other users. Anonymous posts hide your display name in the sea and journey; mutual followers can see new anonymous posts with your name in your personal lake. Sada still links them to your account for deletion, safety and moderation. Moderators can review reported content. Do not post private information about yourself or others. Screenshots and shared images saved by others cannot be recalled.
Services and device storage
Sada uses Firebase for authentication and Sites/Cloudflare for hosting and storage. YouTube search queries are sent to Google; thumbnails load from YouTube. Music players connect to their platform when you open them, and their privacy policies apply. Session cookies keep you signed in. Language, appearance and motion preferences are stored on your device. We do not use advertising trackers. Optional Google Analytics for Firebase is disabled unless analytics is enabled for the service and you actively consent on this device. Declining does not restrict access to Sada. You can withdraw consent using Product analytics at the top of this page or in account settings.
Safety and diagnostics
Reports, blocks and support messages are stored to handle safety and support. Limited error codes, account identifiers and timestamps help diagnose failures; the client error reporter does not send note text, passwords or email addresses. App error records are retained for up to 7 days and removed on subsequent logging requests. Hosting providers may maintain separate operational logs.
Deletion and your choices
You can remove your own posts, unblock senders and delete your Sada account in account settings. Account deletion removes your profile, posts, comments, saves, reactions, support requests and authentication record; it does not delete your Google account. A hashed deletion marker prevents old sessions from restoring the account. Contact support to request access, correction or help deleting data. Operational backups may contain earlier copies; backup retention and operator contact details must be finalized before public launch.
Beta notice
This describes the current beta implementation. The operator’s full legal contact details, applicable legal bases, international-transfer arrangements and backup retention still require confirmation before a general public launch.
Public profiles & following
Choosing a username makes your chosen name and photo discoverable to signed-in users. Signed songs and echoes appear on your public profile and journey. Anonymous authorship in personal lakes follows the friends-only rules described below. Your optional bio and profile appearance are also visible on your public profile. We store follow relationships and show follower counts. Blocking removes follows in both directions and hides profiles and blocked branches. Account deletion removes your username and follow relationships.
New posts, echoes and replies show your profile name. Anonymous public posts and unattributable interactions are removed. Complete your name and username before posting or interacting. Private bottles and their replies are visible only to the sender and recipient; reported content may be reviewed by Sada moderation. Mentioning someone does not give them access to a private conversation. In-app notifications can be paused in settings.
Your archive folder names and organization are private to your account. Organizing a post does not change its public visibility. Folders are included in your data export and removed when you delete your account.
Optional product analytics
With consent, Google receives successful product events such as opening a bottle, saving a song or submitting a report, plus allowed categories such as music provider, source screen, anonymous posting choice and sharing method. We do not send email addresses, names, account IDs, note/comment text, full music links, location or authentication tokens as event parameters. Google also processes a pseudonymous analytics identifier and browser/device information; this is not fully anonymous data. Advertising personalization and Google signals must remain disabled. Analytics cookies (_ga and _ga_*) are configured to expire after 60 days without automatic renewal. Withdrawal stops future collection on this device and clears these cookies; it does not erase events already received by Google. The owner must confirm Google data-processing/transfer arrangements and the Analytics property retention setting before enabling collection.
Approximate location and Echo journeys
You can explore the Global Sea without sharing your location. Location is enabled by default after browser permission. You can turn it off at any time. When enabled, Sada refreshes location while you use the app and adds the nearest city or town to new bottles and echoes. Exact device coordinates stay in the browser: coordinates rounded to 0.01 degrees (about 1 km) are used by Sada for distance filtering. Approximate area bounds are sent to OpenStreetMap’s Overpass service to retrieve neighbourhood names and map features. Exact device coordinates are not sent. GeoNames supplies a city fallback. Translation is requested only when you choose it: Google receives the selected note text and target language, without account identity from Sada. Translations appear inside Sada when the translation service is enabled. Unsent drafts are stored in this tab’s session storage for recovery and cleared on successful sending or sign-out. Journeys display the approximate city centre, not your device position. Search distances are approximate and refer to the selected discovery centre, which can differ from your current location. Historical locations retain their original lower accuracy. Turning location off stops future sharing; removing stored location data also clears it from existing bottles and echoes. Echoes store the original bottle, parent echo, account link, optional note and timestamp. Journeys show names only for explicitly signed new posts and echoes, never private account identifiers. Anonymous authors and blocked branches stay hidden. Account deletion clears your echo authorship and note; an unavailable structural node can remain in another person’s journey until its original bottle is deleted. Moderators can resolve reported accounts privately.