Rindler Custody App: Privacy Policy

Your site passwords are stored only on your own device. When you save a login in the Custody app, it is written to your device's secure storage: the iOS Keychain or the Android Keystore. It is not uploaded to Rindler. Rindler keeps no copy of it. There is no server-side vault to breach, and no Rindler employee can look your password up.

When a sign-in runs, exactly one secret is released, encrypted end to end. To sign you in to a site, a Rindler browser session generates a fresh, single-use encryption key and asks your device for one specific secret, for one specific site. Your device prompts you to approve with biometrics. Only then does it encrypt that one secret directly to that one browser session and sign it with a key that never leaves your device. Rindler's servers pass that sealed message along and cannot read it, because they do not hold the key that opens it.

What this does not mean. We want to be straight with you: the secret is decrypted inside the browser session that performs the sign-in, and that browser runs on Rindler's infrastructure. So your password does briefly exist in memory there, for the seconds it takes to type it into the site's login form. It is discarded when the sign-in finishes and is never written to any Rindler database.

What device custody actually buys you is this: Rindler never stores your credentials and cannot obtain them on its own initiative. Every release is a one-time, single-site, single-request event that you approve with your fingerprint or face, and that you can decline. If your phone is off, or you say no, the sign-in simply does not happen.

Many sites text you a one-time code. If you turn this feature on, the app can supply that code so a sign-in you started does not stall waiting for you.

On Android, the code is extracted on your phone and only the code itself is sent. The rest of the message body never leaves your device.

On iOS, Apple does not permit an app to read your texts. Instead, you create a Shortcuts automation, using Apple's own Shortcuts app, that hands an incoming message to a Rindler action. The Custody app itself never reads your messages; it only receives what your own automation chooses to forward.

The message is not kept. Rindler's server extracts the code, uses it to finish the one sign-in that is waiting for it, and discards the rest. The message body is not stored in any database and is not written to our logs. If no sign-in is waiting, the code is thrown away and nothing happens.

You never have to turn this on. Typing a code into the app by hand always works and is the default. Automatic capture is a convenience layered on top of it, not a requirement.

Pairing this app to your Rindler account creates a device record. It contains your device's public key, a device token, and a device name (for example "iPhone"). That is what lets a sign-in request find your phone. It contains no credentials and no message content.

The app talks only to Rindler. It contains no analytics SDK, no advertising SDK, no crash-reporting SDK, and no third-party trackers of any kind. It makes no network calls to anyone but us.

Passwords and one-time codes: not retained. Codes and message content live only for the duration of the single request that carries them. Passwords are never on our servers to retain.

Device records were kept until you unpaired the device, reset it, or deleted your Rindler account. The service that held them stopped operating on August 20, 2026, so nothing is being added to these records and no unpairing reaches them any more. To ask about, or ask us to delete, anything we may still hold, email founders@rindler.ai.

On the device: Settings → "Reset device" → "Erase everything". The app first tries to tell our servers to unpair this phone. That call can no longer succeed, because those servers are gone, so you will see "Couldn't unpair this device" and have to confirm with "Erase anyway". The wipe then runs and clears all local state: every saved login, the device identity, and the sign-in-code configuration, and the app returns to its first-run state. It needs no network, and it is the one deletion step that still completes end to end. Ignore that dialog's suggestion to remove the device later at chat.rindler.ai — that site is shut down. Email founders@rindler.ai instead.

Your whole account: the Rindler web-automation product stopped operating on August 20, 2026. No running service now revokes tokens, unpairs devices on our servers, or purges saved site configuration when an account is deleted, and nothing in this app can start one. This app's sign-in-code token and its paired-device records cannot be used against those servers, because the servers no longer answer. To have whatever we still hold deleted, email founders@rindler.ai. We honor deletion requests within 30 days.

Account deletion happens by email, not in this app. The Custody app pairs with an account you already have; it does not create one.

The Custody app is not directed at children under 13 and we do not knowingly collect data from them.

We will update the "Last updated" date when this policy changes materially, and we will describe what changed rather than silently revising it.

September 11, 2026: account deletion requests now go by email to founders@rindler.ai, because chat.rindler.ai is no longer available.

September 11, 2026: corrected what deleting an account does. The service that revoked tokens, unpaired devices and purged saved site configuration automatically stopped operating on August 20, 2026, so deletion is now a manual request to founders@rindler.ai. The on-device reset description was corrected too: the unpair call it makes now always fails, so the app asks you to confirm "Erase anyway" before it wipes. The retention note about device records was corrected the same way.

Privacy questions, data requests, and corrections: founders@rindler.ai.