Law Enforcement Guidelines

Overview

These guidelines are for government and law enforcement officials seeking records about Sincerus users. Sincerus is a small social network for short posts operated from Türkiye and offered in Türkiye and the United States. We disclose user records only in response to valid legal process or in the emergencies described below. Users seeking their own data should use Download your data in the app or see our Privacy Policy.

Contact

• Email: legal@sincerus.app
• KEP (Turkish authorities): to be announced

Please send requests from an official government email address or KEP account, on official letterhead, and include the requesting officer's name, agency, badge or registry number, and a reply address. Identify the account by its Sincerus username (for example, @username) or profile link; we cannot reliably search by display name alone.

What data we have

We collect little, and the records below are the only ones we hold. Each one is kept only for the period in our Privacy Policy; once a record has been deleted or its retention period has ended, it no longer exists.

• Account record — username, display name, email address (often an Apple private-relay address rather than the user's real address), date of birth, country, and account creation date.
• Traffic data — IP address, source port, timestamp, user agent, and request ID for account and content events (sign-up, sign-in, session refresh, posts, replies, reposts, follows, blocks, reports, profile and photo updates, and the fact that a chat message was sent). Retained for 24 months under Türkiye Law No. 5651, including after the account is deleted.
• Public posts — posts, replies, and reposts the user has not deleted, with their timestamps, and the photos attached to them (up to 2 per post) with their alt text.
• Photo checks — for each photo upload, the result of the automatic nudity and violence check, kept 90 days. Rejected photos are not stored. Photos under a child-safety report are preserved for 1 year.
• Moderation reports — reports filed by or about the account and the content preserved with them.
• Signed-in sessions — device model, OS and app version, user agent, first and last IP address and sign-in method of each session, kept 90 days after the session ends; and the push-notification token of the device.
• Group chats — the name, description and photo of groups the account belongs to, their members and roles, and when each person was invited and joined. Never the messages, which are end-to-end encrypted.
• Place tags — the public venue a post was tagged with (never the user's own location, which Sincerus does not receive).
• Subscription and age records — Sincerus Premium status and renewal dates as reported by Apple, and for Turkish accounts the age group from the e-Devlet age token and the date it was verified.
• Other activity records — how each post was typed (aggregate typing timings, 90 days), app usage sessions (90 days, adults who did not turn them off), and which ads were shown and opened, hidden or reported.

Chats are end-to-end encrypted

Sincerus cannot produce the content of chat messages. Chats are end-to-end encrypted on users' devices. Our servers hold only the encrypted delivery envelope, briefly, until it is delivered, and we keep a traffic event recording that a message was sent (IP address, port, timestamp) — not the recipient or the content. Message history exists only on users' devices.

United States requests

We respond to US legal process consistent with the Stored Communications Act (18 U.S.C. § 2701 et seq.):

• Subpoena — basic subscriber information: the account record above, plus IP addresses and session (sign-in) logs.
• Court order under 18 U.S.C. § 2703(d) — other non-content records, such as the full traffic log for the account.
• Search warrant — stored content, such as posts and preserved report content. Chat content is not available under any process.

Preservation requests

We honor preservation requests under 18 U.S.C. § 2703(f). We preserve a snapshot of the identified account's records for 90 days, and will extend once for an additional 90 days on a renewed request. Preserved records are placed on a legal hold and are not deleted while the hold is active.

Emergency disclosure requests

If you believe there is an emergency involving danger of death or serious physical injury, email legal@sincerus.app with “EMERGENCY” in the subject line, describing the emergency, the account, and the specific records needed. We evaluate emergency requests under 18 U.S.C. § 2702(b)(8) and (c)(4). Before disclosing, we verify the request came from a genuine law enforcement agency, for example by calling back through the agency's published phone number.

Turkish requests

We accept requests and decisions from Turkish public prosecutors, courts, criminal judgeships of peace, and the Information and Communication Technologies Authority (BTK) by KEP or by email to legal@sincerus.app. Requests for traffic data are handled under Law No. 5651 and the applicable procedural law. Content removal and access-blocking decisions can also be sent via our content removal form.

Other countries

Requests from authorities outside Türkiye and the United States may need to go through a Mutual Legal Assistance Treaty (MLAT) or letters rogatory process. We review each request against the laws that apply to us.

User notice

Our policy is to notify users before disclosing their records, so they can seek legal advice. We do not give notice when we are legally prohibited from doing so (for example, by a non-disclosure order under 18 U.S.C. § 2705(b) or a confidentiality decision by a Turkish court or prosecutor), or in emergencies where notice could put someone at risk. Where notice was delayed, we notify the user once the restriction ends.

No backdoors

Sincerus does not provide backdoors, real-time access, or decryption keys to any government. We have no technical ability to read end-to-end encrypted chats and we will not build one. Every legal request and legal hold is logged, and staff access to legal records is audited.

Child safety

We report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) CyberTipline as required by 18 U.S.C. § 2258A, and preserve the associated content. Law enforcement following up on a CyberTipline report should reference the report number in their request.