Privacy and data

Sifa ID is a professional network, and the design assumes that people look at your work. Your profile is public by default. The full picture holds more detail: where the data lives, and who can see it. This page is that reference.

For the short version, the Trust page on sifa.id lists the sub-processors, the security measures and the retention periods. The privacy policy holds the formal legal detail.

What is public

Your profile, by default, is fully public. That means:

• Anybody with the URL can view it. It needs no login.
• Search engines index it, because it sits in the sitemap.
• AI agents and crawlers can read it. The page returns 200 to anyone.
• A logged-out human sees what a logged-in human sees. There is no mode that hides fields from non-members.

We chose this on purpose. A portable professional profile works only as a public reference. You link to it from your CV, your email signature, and your conference bio. LinkedIn already offers the half-public version.

Do you want to keep something private? Leave it off your profile. Sifa can render no record that you never create.

What is not public

Some things you do on Sifa are not surfaced on your public profile:

• Likes / reposts / follows. These get written to your provider but Sifa does not render them on your profile. See Activity feed for which record types Sifa treats as "Did" rather than "Made".
• Drafts in the profile editor before you save.
• Blocks and mutes. They live on your account. Sifa uses them to filter what you see, and it shows none of them on your profile.

One warning: a record that Sifa never renders is not a secret. Your apps write many of these records, such as likes, follows and blocks, to your provider as standard AT Protocol records. Any other Atmosphere app can see them. The privacy comes from the protocol, not from Sifa.

Where data lives

The AppView is a cache, not the source of truth. Delete a record from your provider. The firehose carries the deletion, and the AppView drops it from the index within seconds. Sifa keeps no copy after a deletion.

What Sifa stores beyond your records

Sifa's own database holds things that are not AT Protocol records:

• Session tokens (hashed) so you stay logged in.
• OAuth grant metadata so Sifa knows what you authorised.
• Anti-abuse signals: rate-limit counters, sybil-detection scores, moderation labels. Private to Sifa.
• Analytics: page-view counts, search-query frequencies. Aggregated only. No per-user logs of "Alice viewed Bob's profile."
• Error monitoring: when a request fails, Sifa sends a Sentry-compatible error report to its GlitchTip instance. A report can hold the page URL and an error stack trace. Sifa strips personal data before it sends the report.

The public profile shows none of this. None of it leaves the AppView database. There are no third-party trackers, no advertising pixels, and no Google Analytics.

Deleting things

Three levels of "delete":

Delete one record. Open the item in your profile editor. Remove it. Your provider then deletes the id.sifa.profile.* record. The AppView sees the deletion on the firehose and drops it from your profile within seconds.

Delete everything Sifa-specific. Account settings holds a delete-Sifa-data button. It walks every id.sifa.* collection on your account and removes each record. It leaves your Atmosphere account alone, on Bluesky, Eurosky or anywhere else. Only the records in the Sifa namespace go.

Delete your Atmosphere account. This is a provider-level action. You do it on your provider's settings page, not on Sifa. Your provider deactivates your DID and releases every record, across every app. The Sifa AppView sees the deactivation and stops rendering your profile.

The first two are reversible: re-add the data and it is back. The third is irreversible after a grace period that varies by provider.

What survives if you leave Sifa

If you delete your Sifa-specific records but keep your Atmosphere account:

• Your Sifa profile (https://sifa.id/p/<username>) returns 404 after the id.sifa.profile.self record disappears.
• Your AT Protocol identity survives: the DID, the username, and every other record.
• Every endorsement that other people gave you lives on their provider. Those records stay on those accounts after you leave Sifa.

What survives if Sifa shuts down

If Sifa as a company / project goes away:

• Your id.sifa.* records stay on your provider, fully readable, indefinitely.
• The sifa.id website goes dark, so the profile URLs stop loading.
• The AT Protocol lexicons that we published (id.sifa.*) stay valid open schemas. Any other app can adopt them and render the same records. A successor profile site can read your Sifa data, and you do nothing.
• The lexicon repo (singi-labs/sifa-lexicons) carries the MIT licence, and it lives as long as GitHub does.

That is the "your data is not held hostage" promise, made concrete.

Requesting your data

You need no request. The data already sits on your provider, and you reach it directly. Your data on a provider shows how to inspect it or export it with pdsls.dev or the AT Protocol API.

Do you need a copy of Sifa-side metadata, such as session logs or analytics, for compliance? Open an issue or email the team. EU users have GDPR rights of access and erasure. We honour both.

Want to go deeper

• Your data on a provider: the concrete shape of records and how to inspect them.
• Move your account to another provider: taking your data elsewhere.
• Lexicons and integrations: the open schemas that make data portable.
• Trust and data at a glance: sub-processors, security, and retention on one scannable page.