Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how emptyflash, LLC (doing business as “Sloppy”, “we”, “us”, or “our”) collects, uses, and discloses information when you use the Sloppy messaging application (the “Service”).

Information We Collect

• Account information. Your phone number, which you provide to sign in, along with your username, display name, and optional profile photo.
• Content you create. Messages, group chats, reactions, mentions, and media attachments you send through the Service.
• Your own AI provider key (BYOK). If you connect a third-party AI provider key (for the “@sloppy” agent), we store that key encrypted at rest and never display it back to you in plaintext.
• Technical and usage information. IP address, device type, browser or app version, and usage logs collected by our hosting and database provider (Supabase) to operate and secure the Service.

How We Use Your Information

• To provide, operate, and maintain the Service.
• To authenticate you by sending one-time verification codes to your phone number.
• To deliver messages, notifications, and the features you request.
• To protect the security and integrity of the Service and our users.
• To respond to your support requests.

SMS Text Messaging

When you sign in, we send one-time login verification codes by SMS to the phone number you provide. These messages are sent only when you request a code, at a frequency of a small number of messages per login attempt. Message and data rates may apply.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

How We Share Information

We do not sell your personal information. We may share information with service providers who help us operate the Service, including:

• Supabase — database, authentication, and file storage.
• Twilio — SMS delivery of login verification codes.
• Anthropic — only if you supply your own API key for the “@sloppy” agent.
• Expo — mobile push notification delivery.

We may also disclose information where required by law or to protect the rights, property, or safety of our users or others.

Data Retention and Security

We retain account and content information for as long as your account is active and for a reasonable period thereafter as needed to operate the Service and comply with legal obligations. Third-party AI provider keys you supply are encrypted at rest using AES-256-GCM. We take reasonable measures to protect your information, but no method of transmission or storage is completely secure.

Your Choices

• SMS: Reply STOP to any Sloppy text message to opt out of receiving further messages, or reply HELP for help. (Note: verification codes are required to sign in.)
• Account data: You can update or delete your account information by contacting us at the address below.

Children’s Privacy

The Service is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the “Last updated” date above.

Contact Us

If you have questions about this Privacy Policy, contact us at emptyflash+sloppy@gmail.com.