DRAFT: NOT LEGAL ADVICE. This document is a working draft prepared for Sine Cura Cyber LLC. It has not been reviewed by a lawyer and should be reviewed by a licensed attorney before publication. Bracketed items such as [MAILING ADDRESS] are placeholders that must be completed.

Sine Cura Cyber Privacy Policy

Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]

Sine Cura Cyber (“Sine Cura Cyber,” “we,” “us,” or “our”) is operated by Sine Cura Cyber LLC, a Georgia limited liability company. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have when you use:

• the Sine Cura Cyber iOS app (bundle ID com.sinecuracyber.app) (the “App”);
• the free Sine Cura Cyber Windows helper installed on your family’s PCs (the “Helper”); and
• our website at sinecuracyber.com and related support channels (together, the “Service”).

Our short version: we collect the minimum needed to show you whether your family’s PCs are protected. We do not collect your files, your browsing history, or the personal content on your computers. We do not sell your data, and we do not use it for advertising.

Important: Sine Cura Cyber is an independent product. It is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft, Windows, Windows Security, and Microsoft Defender are trademarks of the Microsoft group of companies. All other trademarks belong to their respective owners.

1. What Sine Cura Cyber does (and doesn’t do)

The Helper reads the status information that the built-in Windows Security / Microsoft Defender already reports on each PC, for example, whether real-time protection is turned on, when definitions were last updated, and whether any threats were detected. It sends that status to your account so the App can show it to you on your iPhone in plain English and send you notifications.

Sine Cura Cyber monitors and reports. It does not itself scan for, block, or remove threats, and it cannot guarantee that a PC is secure. Protection on the PC is provided by Windows Security / Microsoft Defender.

2. Information we collect

2.1 Account information (from you)

• Email address, if you sign up with email and password.
• Sign in with Apple information. If you use Sign in with Apple, Apple provides us with a user identifier and, if you choose to share them, your name and email address. You may choose Apple’s “Hide My Email” option, in which case we receive a private relay address instead of your real email.
• Password: passwords for email accounts are handled by Firebase Authentication and are stored in hashed form; we never see your password in plain text.
• Authentication tokens needed to keep you signed in and, for Sign in with Apple, to revoke access when you delete your account.

2.2 PC security status (from the Helper)

For each PC you connect, the Helper collects only: - Device name (the name of the PC as set in Windows, which you may rename) and an identifier used to link that PC to your account; - Protection status and settings reported by Windows Security / Microsoft Defender (for example: real-time protection on/off, tamper protection, firewall status, definition/engine version and update time, last scan time) [CONFIRM EXACT FIELDS]; - Threat detections: the threat name as reported by Microsoft Defender, its severity/category, the action taken (for example, quarantined), and the date and time of detection [CONFIRM WHETHER FILE PATHS OF DETECTED ITEMS ARE COLLECTED; RECOMMEND NOT]; and - Timestamps showing when the Helper last checked in.

What the Helper does NOT collect: the contents of your files, documents, photos, emails, or messages; your browsing history; keystrokes; screenshots; passwords; the names of Windows user accounts' personal files; or any other personal content on the PC.

2.3 Information collected automatically

• Push notification token. If you allow notifications, we store a device token from Firebase Cloud Messaging (FCM) / Apple Push Notification service so we can send alerts to your iPhone.
• Subscription status. If you buy a Family plan, Apple processes your payment. We receive information from Apple confirming your subscription status (such as product, purchase date, expiration, and transaction identifiers). We never receive your payment card details.
• Technical and log data. Like most online services, our infrastructure providers (Google Firebase) may automatically log technical information such as IP address, request times, and error information when the App or Helper connects to our servers. This is used for security, troubleshooting, and keeping the Service running.
• Analytics and crash reporting. [CHOOSE ONE: “We do not use third-party analytics or advertising SDKs.” OR “We use Firebase Crashlytics and/or Google Analytics for Firebase to understand crashes and how features are used. This data is not used for advertising or to track you across other companies’ apps and websites.”]

2.4 Information you send us

If you contact support, we receive your email address and whatever you choose to include in your message (for example, screenshots or descriptions of a problem).

3. How we use information

We use information only to: - provide the Service: show each PC’s protection status, explain it in plain English, and send alerts; - create and secure your account and connect your PCs to it; - manage your free or Family plan, including enforcing PC limits; - respond to support requests; - maintain, troubleshoot, secure, and improve the Service, and prevent fraud or abuse; and - comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, “share” it for cross-context behavioral advertising, use it for advertising, or use it to track you across other companies’ apps or websites.

4. Legal bases (for users in the EEA, UK, and similar jurisdictions)

Where laws such as the GDPR apply, we rely on: performance of a contract (to provide the Service you signed up for); legitimate interests (to keep the Service secure, prevent abuse, and improve it, balanced against your rights); consent (for push notifications and any optional features, which you can withdraw at any time); and legal obligation (where we must keep or disclose information by law).

5. How information is shared

We share information only as follows: - Service providers (processors). We use Google Firebase (a service of Google LLC), including Firebase Authentication, Cloud Firestore, Cloud Functions, and Firebase Cloud Messaging, to store data and run the Service. Google processes this data on our behalf under its data processing terms and is not permitted to use it for its own purposes. Data is stored in [FIRESTORE REGION, e.g., the United States]. Learn more at https://firebase.google.com/support/privacy. - Apple. Apple processes Sign in with Apple, in-app purchases, and push notifications under Apple’s own privacy policy. - Legal and safety. If required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is needed to protect the rights, property, or safety of our users, the public, or us. - Business transfers. If Sine Cura Cyber LLC is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy. - With your direction. With anyone else when you ask us to.

6. Data retention

• Account and PC data are kept while your account is active.
• Threat history and status history are kept for [RETENTION PERIOD, e.g., 90 days / 12 months] and then automatically deleted [CONFIRM IMPLEMENTATION].
• Removed PCs: when you remove a PC from your account, its data is deleted within [X] days.
• Deleted accounts: when you delete your account, we delete your account and all associated data from our active systems promptly (normally immediately, and within [30] days at most). Residual copies in Google’s backups or logs are deleted on their normal schedule [CONFIRM, e.g., within 30 to 90 days].
• Support emails are kept for [RETENTION PERIOD] to help with follow-up questions.
• We may keep limited information longer if required by law (for example, records we must keep for tax or legal purposes).

7. Deleting your account

You can delete your account at any time in the App: Settings → Account → Delete Account [CONFIRM PATH]. Deleting your account: - permanently deletes your account, your connected PCs, status history, threat history, and notification tokens; - revokes Sign in with Apple tokens associated with the App (if you used Sign in with Apple); and - cannot be undone.

Deleting your account does not cancel an Apple subscription. Please cancel your Family plan in your Apple ID settings (Settings → [your name] → Subscriptions) to stop future charges. You should also uninstall the Helper from each PC; once your account is deleted, the Helper can no longer send data to us.

8. Your rights and choices

Depending on where you live, you may have the right to: - access the personal information we hold about you and get a copy (portability); - correct inaccurate information; - delete your information (you can do this yourself in the App); - restrict or object to certain processing; - withdraw consent (for example, turn off notifications in iOS Settings); - opt out of sale or sharing: we do not sell or share personal information as defined by California law, so there is nothing to opt out of; and - not be discriminated against for exercising your rights.

To exercise these rights, email support@sinecuracyber.com or privacy@sinecuracyber.com. We may need to verify your identity (for example, by asking you to email us from the address on your account). You may use an authorized agent where the law allows. We will respond within the time required by applicable law (for example, 30 days under GDPR or 45 days under the CCPA). If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

California residents: In the last 12 months we have collected the following categories of personal information as described in Section 2: identifiers (email, account ID, device identifiers); commercial information (subscription status); internet or other electronic network activity information (technical logs); and device security status information. We use and disclose these only for the business purposes described in Sections 3 and 5. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes other than those allowed by law.

9. Children’s privacy

The App is designed for and intended to be used by adults: parents and guardians who manage their family’s computers. We do not knowingly allow children under 13 (or the minimum age in your country) to create accounts, and we do not knowingly collect personal information from children.

We understand that the PCs you connect may be used by your children. The Helper is designed so that it does not collect personal content from anyone who uses the PC. No files, browsing history, messages, keystrokes, or screenshots. It collects only the device name and the Windows Security / Microsoft Defender status and threat information described above. We suggest choosing PC names that do not include a child’s full name.

If you believe a child has created an account or given us personal information, contact us at support@sinecuracyber.com and we will delete it.

10. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS/TLS), Google Cloud’s encryption at rest, Firebase Authentication, and database security rules that restrict each account’s data to that account [CONFIRM]. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you as required by law.

11. International transfers

We are based in the United States, and our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses offered by Google) for transfers of personal data from the EEA, UK, or Switzerland.

12. Third-party links and services

The App may link to third-party websites or services (for example, Microsoft’s support pages explaining a Windows Security setting). We are not responsible for their privacy practices; please review their policies.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you in the App or by email before the changes take effect, and we will update the “Last updated” date above. Continued use of the Service after changes take effect means you accept the updated Policy.

14. Contact us

Sine Cura Cyber LLC [MAILING ADDRESS] Email: support@sinecuracyber.com / privacy@sinecuracyber.com Website: https://sinecuracyber.com

Sine Cura Cyber. Protected. Without worry.