How Sincerus verifies that posts are written by people

No. Sincerus never asks for an ID document, a selfie or a phone number of its own. You sign up with Sign in with Apple and enter your date of birth: Sincerus is for people 18 and older. What Sincerus checks is every post, at the moment it is published.

In Türkiye the law requires an age check, so Sincerus will be for people 18 and older there and ask for an e-Devlet age token when you sign up. The token tells Sincerus only your age group, never who you are. See age verification in Türkiye.

Four things, in this order:

1. 1

   You type it

   The Sincerus editor blocks paste, cut, drag and drop, Apple’s Writing Tools, inline predictions and large inserts of text. Dictation works.

2. 2

   You confirm it

   Face ID, Touch ID or your passcode. After you confirm, posts in the next five minutes don’t ask again; leaving the app ends that window.

3. 3

   Your iPhone signs it

   The server sends a one-time challenge, and the iPhone signs it together with the exact text of the post, using an App Attest key kept in its Secure Enclave.

4. 4

   The server checks it

   The signature must match the key registered to your account, and a counter makes every proof single-use. Only then is the post published.

The app also sends how the post was typed: speed, corrections and pauses, never the text itself. These signals never block or delay a post. If they look off, the post is still published and goes to people for review.

App Attest is Apple’s way for an app to prove that a request comes from a genuine Apple device running the genuine, unmodified app. The key is created inside the iPhone and can’t be copied out. Simulators, emulators and scripts can’t produce a valid Sincerus proof, so a server farm can’t post on Sincerus.

Not easily. A bot on Sincerus would need a real iPhone, a real Apple Account, the official app, and someone to type and confirm its posts. No system makes abuse impossible, so Sincerus also limits how fast any account can act (30 posts an hour), can ban a device with Apple’s DeviceCheck, and has people review every report within 24 hours.

No. Face ID and Touch ID run in the iPhone’s Secure Enclave, and apps never receive face or fingerprint data. Sincerus receives a signature from your iPhone and nothing else; it can’t even tell whether you used Face ID, Touch ID or your passcode.

Verifying a person once at sign-up proves little: an account can be sold, shared or handed to a script the next day. Sincerus asks when you publish, and one confirmation covers only the next five minutes in the app, so every post is confirmed by whoever is holding the phone.

Not now. Sincerus needs App Attest and the Secure Enclave, so it runs on iPhone with iOS 26 or later. Links to posts and profiles open in the app.