Privacy Notice

Effective November 14, 2026 · Version 2026-11-14.v11

1. Who operates Shattered Moments

Shattered Moments is operated by Pethtel Enterprises LLC. For privacy questions and requests, email charlie@shatteredmoments.com. This notice describes the Shattered Moments application, not your separate ChatGPT account or the independent practices of hosting providers and linked websites.

2. Information the application stores

• Sign-in and profile information: the verified identifier and email provided by your selected sign-in provider; your display name, handle, bio, profile photo, photo moderation status, membership status, profile headline, theme and optional cover photo. A pending cover is visible to its owner; other members see only an approved cover under existing profile visibility and block rules.
• Community place reviews: when you publish after a past confirmed circle meetup, the app stores your self-confirmed public venue name and address, a 1–5 glass rating, review text, optional tags, author account, timestamps, and a private meetup reference. Published reviews and your name/handle can be read across the app, beyond the original circle; block and moderation settings apply. The circle name, attendee list, and meetup time are not included in the public review response. Ratings are member opinions, not verified attendance or imported map-provider ratings. Review reports are private to the administrator. You may edit or delete your review; deleting an account removes its reviews and reports. A published review can remain after its circle/meetup is deleted, with the private meetup reference removed. Venue catalog entries may remain when other people still review that venue. Optional, tap-only browser GPS creates map links locally; coordinates are not sent to the app server or stored in reviews. Opening Apple/Google Maps shares the selected search or coordinates with that provider. No continuous location tracking or automatic venue-name lookup is enabled.
• Circle calling and meetup reminders: you may save a phone number separately for each circle and choose to share it with accepted, active members. Sharing is off by default. Removing it or leaving the circle clears that sharing, but cannot retract copies already made. Phone links open a regular call through your device; the app does not record calls or supply an in-app calling service. Meetup addresses are shown to eligible circle members. Map links send the selected address to Apple or Google only when you open them; those services have their own privacy practices. The app stores organizer reminder requests, recipient inbox records, and email acceptance status. Email follows activity-email preferences; this feature does not send SMS or mobile push notifications.
• Content and relationships: posts, uploaded images, comments, reactions, saved posts, follows, blocks, circle invitations and memberships, plans, availability votes, RSVPs, and reminder preferences.
• Messages: conversation names and participants, invitations and acceptance status, messages, timestamps, and a last-seen marker used for unread counts. The marker does not mean a person read every message.
• Account activity: while you use the app signed in and unlocked, the app records recent app sections, last activity time, and labels for successful actions such as posting or sending a message. These operational records are visible only to the administrator and included in your export. The activity log keeps at most 100 events per account; the dashboard shows the most recent 50. It does not collect message bodies, passwords, recovery codes, precise location, or screen recordings. Counts may summarize your existing content. Activity and feedback records are removed when your account is deleted.
• Testing feedback: feedback text you submit, the app section you report, feedback type, account identifier, submission time, and email delivery status. Submissions are private to you and the administrator. They may be emailed to the administrator through the configured email provider. Do not include passwords, recovery codes, or private conversations. Your feedback is included in account exports and removed with account deletion; independently held email copies may remain with the administrator or email providers.
• Safety and administration: reports, report reasons, reported-message context, upload review status, and administrator activity records.
• Security: salted password verifiers and password-history verifiers, recovery-code hashes, hashed unlock-session tokens, expiry times, and account-level attempt counters. The application does not store readable passwords or recovery codes.
• Agreement: the Terms and Privacy Notice version acknowledged at profile creation or a required later acceptance, and the date and time of acceptance.

Shattered Moments receives your verified sign-in identity and email. Google web sign-in uses Supabase Auth; existing ChatGPT accounts use Sites sign-in. Apple appears only if configured and enabled. Shattered Moments does not receive your provider password. It does not ask for payment-card details to create a profile. Do not put passwords, financial details, identity documents, or unnecessary sensitive information into profiles, posts, or messages.

Collaborative moments store the originating plan (if any), title, circle, date, creator, each person’s contributions, and version-specific community-sharing decisions. Contributions start with the circle. Every contributor must approve wider community sharing; adding, editing, or removing a contribution returns the moment to circle-only and cancels pending approvals. People can edit or remove only their own contributions. The creator can delete the moment. Sealing copies only the acting person’s approved contributions into a linked capsule; those copies are independently removable inside that capsule. Relationship timelines show plans, moments, and capsule milestones in circles shared by the viewer and selected person; they do not reveal sealed entry contents. Capsule openings record who joined and store reflections beside the original entries. Recorded visits are not live presence. Audience previews use current membership and block rules; community previews omit names of directory-private members while including them in the total. Future membership changes can change access.

Profile photos are usable after upload and your confirmation of the photo rules, without pre-approval. We do not claim to automatically verify that a photograph is real or that it identifies you. Administrators may review reports or photos afterward, remove rule-breaking photos and restrict accounts. Rejected photos must be replaced. Other photo moderation remains as described below.

3. How the information is used

The application uses this information to sign you in and unlock your account, display content to its permitted audience, personalize your profile, maintain circles and conversations, organize plans, count reactions and unread messages, apply your privacy choices, review photos and reports, prevent abuse, record agreement, and provide export and deletion features.

The current application has no advertising, targeted-advertising, or sale-of-personal-data feature. It does not use your posts or photos for an application-operated AI-training feature. Separate providers' practices are governed by their own policies.

Shared moments and circle time capsules

Shared moments store the selected contributors, requested audience, and approval decisions. The author can make a post Only me immediately. Sharing it to a circle or the community requires approval from every selected contributor; while a request is pending, the previous audience stays in place. Selected contributors can preview the request after any attached photo passes moderation. A declined or cancelled request does not expand access. These controls do not prevent screenshots or copying outside Shattered Moments, and circle membership can change.

Time capsules store their title, circle, creator, fixed opening time, and contributed notes and image references. Before opening, contributors can see only their own entries. After opening, current accepted circle members can see entries allowed by blocking rules, and only approved photos are shown. Administrators can review uploaded capsule photos before opening. A capsule’s seal is an access rule, not encryption; stored content is not end-to-end encrypted. Contributors can remove their own entries, and the creator can delete the capsule. Creating or opening a capsule does not send an external notification or email.

Circle links, prompts, albums, and reactions

Circle invite links expire after seven days or 25 joins and can be revoked by the owner. Anyone holding a valid link who already has app access and an active profile with a real photo can join; joining reveals content available to current circle members. The server stores a hash of the link token. Your browser may retain a pending invite token in session storage until you join or dismiss it. Shared prompts and answers stay in the circle. Albums use the shared moment approval controls, including photo moderation and renewed contributor approval after changes. Emoji reactions store the reacting member, selected emoji, content reference, and time. Other people with access to that content can see reaction counts. On-this-day memories retain their existing access controls.

The notification center displays current accessible invitations, replies, approval requests, prompts, messages, and opened capsules. It stores a last-read time; these are in-app notifications, not device push notifications. Export includes your prompts, answers, reactions, invite-link metadata, and notification read state. Deleting an account removes these owned records through the same deletion controls.

4. What other people can see

Your display name, handle, bio, profile photo, headline, profile theme, and visible content may be shown to other signed-in members who have unlocked Shattered Moments, confirmed they are at least 17, and have an active profile with a real photo. Your email is not included in ordinary member lists; it is available to the administrator and to you.

Community posts are visible to that eligible member audience. Circle posts depend on accepted membership and access controls. “Only me” posts are hidden from other ordinary members. Discoverability affects member lists and suggestions, but does not remove your name from content or relationships others are allowed to see. Changing the default post audience applies to new posts, not earlier posts.

Accepted conversation participants can access messages according to membership and blocking rules. When reporting an encrypted message, you choose whether to share a decrypted quote with the administrator. Without that choice, only the reason and message reference are sent. A reporter-provided quote is not independently verified by the server. Regular private messages and earlier unencrypted messages can be included as report context. Participants may still retain screenshots or copies after you leave or delete your account.

We store your date of birth and the time you confirmed it to enforce the minimum age of 17. Your birthday is not displayed on profiles or shared with ordinary members. Age eligibility is based on the date you provide, using the current UTC calendar date; it is not identity verification. Your age confirmation is included in your data export and removed when you delete your account.

5. Administration and service providers

The administrator can review profiles, emails, uploads, posts, reported messages, and safety records to operate and moderate the community. Administrator post and image access can include circle and “Only me” content. Message bodies in end-to-end encrypted conversations are stored as ciphertext; regular private message bodies are stored in readable form. Private keys are generated on devices and are not sent to the server. Administrators and infrastructure can still access message metadata, regular private messages and earlier unencrypted history, and decrypted quotes a reporter explicitly shares.

OpenAI supplies the ChatGPT sign-in and Sites hosting layer. Supabase Auth processes Google web authentication, including identity, email and session information. Cloudflare infrastructure supports the application's server, database, and image storage. These providers may process technical connection, security, and diagnostic information under their own policies. Hosting, administrator, and legal access is different from ordinary member visibility.

The administrator may disclose relevant information when required by applicable law or when reasonably necessary to address a security incident, investigate abuse, or protect people, subject to applicable law. No promise is made that stored information is inaccessible to providers or lawful requests.

When email sending is enabled, Resend processes the recipient email address and email content to deliver selected account and activity notifications, including an optional welcome message. You can change notification preferences in Privacy center. A recovery email you request is a security message and is sent regardless of optional notification preferences. Its code expires in 15 minutes and can be used once. Shattered Moments stores its hash, recipient address, account identifier, password version, and request and expiry times; the email provider processes the readable code to deliver it.

6. Cookies and device storage

Shattered Moments uses a secure, HttpOnly unlock cookie. The server stores a hash of its random session token rather than the cookie value. Unlocks last up to 24 hours and end sooner when a password expires or changes; the cookie is used for account access, not advertising.

Your selected color mode is stored in your browser's local storage on that device. Clearing browser data removes that preference and may end an unlock. A browser or password manager may save your password separately if you choose to use its save feature; Shattered Moments cannot retrieve that saved password.

Home-screen installation uses a web app manifest and service worker. Only the generic offline page and public app icons are cached. Private pages, API responses, messages, and photos are not cached by the service worker. Internet access is needed to use your account. Browser and operating-system caching may follow their own rules.

End-to-end encrypted messaging

Encryption is optional for new conversations. Both modes restrict access to accepted participants and respect blocks. The selected mode is shown before accepting an invitation and inside the conversation. Regular messages travel over HTTPS but are stored readable by the service; they do not require messaging keys. Existing encrypted conversations cannot be downgraded through the app. Messages in encrypted conversations use AES-GCM with 128-bit encryption keys and authentication tags. Each message has a fresh content key, wrapped separately for current approved conversation participants using P-256 key agreement and HKDF-SHA-256. Sender signatures detect changes. Compare participant safety codes through another trusted channel before sending or reading; blindly accepting a code does not establish the person’s identity. People joining later cannot decrypt earlier messages that were not encrypted for their keys.

Device keys are stored locally in a passphrase-encrypted backup in IndexedDB. The same encrypted file can be downloaded and restored on another device signed into the same account. Unlocked keys exist in browser memory and are cleared from application state on locking, including after five minutes without activity. Key setup stages an encrypted recovery copy before registering the public identity and preserves the previous saved vault if setup is interrupted. Sending requires a successful recovery test from a saved backup file; restoring a valid saved backup also satisfies that check. The tested-backup fingerprint and locally verified safety codes are stored with your encrypted device vault. The optional device check performs temporary local crypto and storage tests, cleans up its storage probe, and sends no messages or private keys to the service. The server stores only public messaging keys and fingerprints. The messaging backup passphrase is separate from your account password. Losing device keys and the backup or its passphrase makes encrypted history unrecoverable; password recovery does not recover messaging keys. Account deletion removes the public identity on the server; copies on your devices or downloaded backup files need to be removed separately.

This initial encryption format has no forward secrecy: someone who obtains your private keys can decrypt retained message envelopes addressed to you. It is not the Signal protocol and has not had an independent cryptographic audit. Encryption does not protect a compromised device or malicious client code served to the browser. Conversation names, participants, times, length estimates, read markers, and reaction choices remain visible to the service. Posts, albums, circle prompts, and capsules are outside messaging encryption.

Optional Shattered Moments email address

When forwarding setup is enabled, active members with a real profile photo can request an address that forwards incoming mail to their current verified sign-in email. We store the requested name, account identifier, destination, request time, provider rule reference, setup status, last check time and test-attempt counters. Only you and the administrator can read your request and setup records; your export includes the non-secret records. Cloudflare receives your destination to verify it and manages the forwarding rule. Resend sends the requested delivery test to your new forwarding address. The app stores only a hash of the test code and its 30-minute expiry, not the readable code or incoming email bodies. You must confirm receipt before the app calls the address active.

Withdraw the address to stop forwarding. Account suspension, rejection of the current profile photo and account deletion also initiate forwarding shutdown. Provider outages can delay cleanup; suspension still restricts app access immediately, and account deletion may ask you to retry until forwarding shutdown is confirmed. The app then removes the destination and account link from its route record and keeps a minimal address/rule reservation without the account identifier or forwarding destination so the old address cannot be reassigned. Shared destination records can remain at Cloudflare because other rules may depend on them; contact the administrator for provider-side removal. Provider retention and independently held email copies are separate.

This is not a separate mailbox or a change to your sign-in identity. Incoming mail is processed by Cloudflare and your destination inbox provider under their policies. Replying from a personal inbox can disclose its address; branded replies are not available. Do not share a pending address before its delivery test is confirmed.

7. Security and retention

Post text and profile name, handle and biography drafts may be saved in this browser tab’s session storage, separated by account, for up to 24 hours. They are not synchronized between devices. Photos, passwords, recovery codes, private messages and consent checkboxes are not included. Closing a tab normally clears its storage; browser session restoration may restore it. Browser storage is not encryption: use your own trusted device. Saving a post or profile clears its matching draft.

Service monitoring stores counts of server failures and browser error signals by allowed route category and minute, without account identifiers, raw URLs, stacks or content. Aggregates older than seven days are removed when new signals arrive. The owner can review these summaries and pause operational email alerts. Alerts contain counts, not member content, and are limited to one per hour after five server errors within fifteen minutes. This does not monitor outages outside the application or guarantee email delivery.

Password verification uses salted, slow hashing. Passwords expire after 21 days, previous passwords are blocked, and repeated verification attempts are limited. Recovery codes are shown once and stored only as hashes. Access controls restrict private audiences and conversations. These measures reduce risk but cannot guarantee absolute security.

Account content and relationship records generally remain while your account exists unless removed through available features or moderation. Security records support password-history checks and access protection. Information from unfinished setup, including uploads and security records, may remain until the administrator removes it; contact the administrator to request removal.

The application does not apply a universal time-based deletion schedule to every record. Hosting logs, provider backups, and records needed for security or legal obligations may follow separate retention rules. This notice does not promise an unverified backup-erasure deadline.

8. Your controls, export, and deletion

Use My profile and Edit profile to update account details, Customize my space for your headline and theme, Account security for password changes, and Privacy center for discoverability, new message requests, default post audience, blocking, data export, and account deletion.

The export includes profile and application records, messages you sent, image-storage references, your capsule entries, capsules you created, and sharing records involving you; it does not include readable passwords, recovery codes, or other participants' complete private-message histories.

Deleting an account removes the member profile, owned uploads, posts, comments, messages you sent, privacy settings, follows, blocks, circle memberships, and password records. Your account activity, feedback, capsule entries, and capsules you created are removed, and pending sharing requests involving you are closed. Circles you own and associated circle posts, plans, and capsules are also removed. Plans you organize are removed too. Messages sent by other people and remaining conversation records can remain. Administrator activity records may also remain. Uploaded image deletion is attempted after database deletion; contact the administrator if you believe a file remains.

Deleting Shattered Moments membership does not delete your Google, Apple, or ChatGPT account, information held independently by providers, or copies other members made. For access, correction, removal, or other rights available under applicable law, contact the administrator. Identity verification may be needed; do not send your password or recovery code.

9. External links and changes

Map links and other third-party links take you to another service when selected. That service receives information according to its own policies. Shattered Moments's privacy choices do not control those services.

Changes to this notice will appear with an updated version and effective date. Your recorded agreement identifies the version acknowledged. Where the profile form requires a new acknowledgment, its checkbox starts unchecked.