Privacy Policy

1. Operator and contact

Primavite is operated under the name Synthegrid. The person or organization that decides how Primavite processes personal data is the data controller. The service does not currently publish a separate legal-entity name, postal address, privacy email address, or data-protection officer.

Until an external privacy contact is added, you can send a private message in Primavite to @primavite_admin. Do not include passwords or unrelated sensitive information. This contact method requires access to a Primavite account.

2. Information Primavite processes

Account and profile information

• The email address, name, and authentication identity supplied through Sign in with ChatGPT. Primavite does not receive or store your ChatGPT password.
• An internal account ID derived from a one-way SHA-256 hash of the lowercase email address. The email itself is also stored. Hashing the email is not the same as anonymizing it.
• Username, display name, biography, avatar, banner, language, professional headline, organization, location, skills, open-to-work setting, comment-history visibility, role, restrictions, onboarding state, and join date.

Content, relationships, and communications

• Posts, comments, polls and votes, Stories, Reels, long-form videos, communities, public discussions and their messages, public and private blogs, drafts, uploaded images and video, music tracks, playlists, captions, descriptions, and related timestamps.
• Likes, follows and their notification choices, bookmarks, saved searches, community memberships, professional connections, blocks, mutes, reports, moderation events, notifications, and read state.
• Direct messages, private group-chat messages, reply references, group names, membership, invitations, managers, and message timestamps. Message text is stored in readable form in the application database and is checked by Primavite's moderation rules. Messages are not end-to-end encrypted.

Uploads, device data, and service requests

• Uploaded file bytes, content type, size, storage key, and media details entered by the uploader. A SHA-256 digest and file signature are calculated to verify an upload but the digest is not kept in the application database.
• Device-local values in browser storage, including the interface language and a cursor used to avoid duplicate message alerts. Browser notification permission is controlled by the browser rather than stored by Primavite.
• The Primavite database does not intentionally store IP addresses, user-agent strings, advertising identifiers, or analytics profiles. Hosting, authentication, network, and storage providers necessarily receive requests and may keep their own security or operational logs. Their exact log fields and retention are not defined by this codebase.

3. Information Primavite derives

Primavite derives interaction counts, unread counts, feed ordering, suggestions, trending hashtags, and recently active group members from stored activity. A group member may be shown as active for about five minutes after recent group-chat activity. Automated moderation may store the relevant surface, category, a short excerpt, and time of an event. Primavite does not currently build advertising profiles or run third-party analytics in the application.

4. Why information is used

• To create accounts and provide profiles, feeds, publishing, media, blogs, music, playlists, communities, public discussions, networking, search, messaging, notifications, and the controls you request.
• To remember preferences, synchronize activity, calculate counts, and recommend public accounts or content.
• To validate uploads, limit abusive requests, apply blocks and restrictions, enforce the Community Rules, investigate reports, and diagnose failures.
• To meet legal obligations when an applicable obligation actually requires processing.

5. What is public and what is restricted

Public profiles, profile media, posts, comments, communities, public discussions and their messages, professional updates, public music, and public playlists can be seen by signed-in users and visitors and may be indexed or copied outside Primavite. Public blogs can be read by signed-in users and visitors, but the current blog reader pages tell search engines not to index them because a URL can also represent private writing. Anyone can read a public discussion; sending a message requires a signed-in account to join it first. Stories are limited to signed-in followers who are not blocked or muted. Private blogs, drafts, and hidden profile comment history are limited to their owner.

Private music and private playlists are available to their owner and Primavite administrators. Administrators can also edit account profiles and settings, handle reports and bans, delete public content, and manage music and playlists. These powers are enforced through stored administrator roles; a username alone does not grant administrator access.

Direct conversations are limited to their two participants. Invite-only group chats are limited to current group members; the group creator can remove members, delete messages, or delete the group. Primavite administrators do not have a general endpoint for reading a direct or group conversation unless they are a participant or member. Message text is nevertheless stored unencrypted at the application level and could be available to infrastructure operators with database access.

Blocking and muting affect what signed-in accounts see and how they interact. Content deliberately published to the public service may still be visible while signed out or through copies made by other people.

6. Legal bases

Where the GDPR applies, Primavite relies on performance of the service requested by the user for core account, content, messaging, and settings functions. It relies on legitimate interests to operate, secure, moderate, and troubleshoot the service, balanced against users' rights. It relies on consent only for optional browser notifications when the user grants permission through the browser; that consent can be withdrawn in browser or operating-system settings. It relies on legal obligation only when a specific law requires processing. Publishing content is a user instruction, not blanket consent to unrelated uses.

7. Providers and disclosures

Primavite uses Sign in with ChatGPT and OpenAI Sites for authentication and application hosting, and Cloudflare D1 and R2 components for application data and uploaded media. These providers process requests and data needed to deliver their services under their own terms and configurations. The application does not currently include third-party analytics, advertising, email delivery, or a server-side push-notification provider. Browser notifications are created on the user's device while Primavite is open and notification permission has already been granted.

Information may also be disclosed when required by applicable law or when necessary to investigate a concrete security incident or protect users and the service. Primavite does not sell personal data.

8. Retention and deletion

Account data and content remain in the active application database until the user or an authorized administrator removes them, unless a feature behaves differently below. Primavite does not currently apply a general automatic retention limit to notifications, reports, moderation events, direct messages, or most other account activity.

• Stories stop being available after 24 hours. Expired Story records and their unreferenced media are removed when the Stories service next performs its cleanup; this is not guaranteed to happen exactly at the expiry time.
• Deleting a post, blog, draft, track, playlist, Story, avatar, or banner removes its active database reference. Its media object is then deleted if no other active feature references the same object.
• A completed upload that is never attached to content has no automatic expiry. It remains under the uploader's private media prefix until it is removed by a later replacement or account deletion. Retention of unfinished multipart-upload parts is controlled by the storage provider and is not specified in this repository.
• Direct messages do not currently have a per-message deletion control. A group-message sender can delete their own message, and the group creator can delete any message or the whole group. A discussion-message sender can delete their own message; the discussion creator or an administrator can delete any message or the entire public discussion.
• Deleting an account removes its active profile, content, relationships, direct conversations, memberships, owned private groups, public discussions it created, public discussion messages it authored, notifications, reports, moderation events linked to it, and other records connected through the database. A community may be reassigned to another administrator when one is available; otherwise it and its community content may be removed. Primavite also attempts to delete all uploaded objects stored under the account's media prefix.

The deletion control acts on Primavite's active database and media bucket. The repository does not define provider backup, cache, request-log, or disaster-recovery retention, so Primavite cannot promise an exact time for deletion from those provider-controlled systems. Failed storage deletions may also require administrator follow-up. Copies made by other users are outside Primavite's control.

9. Security

The current application uses server-side participant, membership, ownership, and administrator checks; same-origin checks for state-changing requests; request-size limits and rate limits on sensitive actions; upload signature and size validation; restricted media retrieval; security response headers; and account bans. Administrator status is read from the stored account role and is not assigned from a matching username. These controls reduce risk but do not guarantee absolute security.

Messages and database fields are not end-to-end encrypted by Primavite. The internal ID's email hash is an identifier, not encryption. Users should protect their sign-in account and avoid placing highly sensitive information in Primavite.

10. Your controls and GDPR rights

• Edit available profile fields, professional information, language, blog visibility, visibility settings, and content through Primavite.
• Use public/private playlist and music controls, block or mute accounts, manage group membership if you created the group, and disable browser notifications in browser or device settings.
• Download a JSON copy of active account data from Settings, including blogs, discussion memberships, discussions you created, messages you authored, and reply references. The export does not contain media file bytes, provider logs, caches, or backups.
• Delete the account from Settings after confirming the exact username. The deletion behavior and limitations are described in section 8.
• Where applicable, request access, correction, erasure, restriction, portability, or objection, and withdraw consent where processing is based on consent. Primavite may need to verify control of the account.

The application currently automates profile correction, JSON export, and account deletion. Other requests, including restriction or objection, must be handled manually; the repository does not contain a dedicated request-management workflow or deadline tracker. Send those requests privately to @primavite_admin. Privacy controls remain available on the account-restriction screen if an account is banned.

You may also complain to the data-protection authority that applies to you. In Poland, this is the President of the Personal Data Protection Office (UODO).

11. Young users

Primavite does not currently ask for a date of birth, verify age, or provide a parental-consent workflow. Users should use Primavite only when permitted by the law that applies to them. Because age thresholds and parental-consent requirements differ by country, the operator must establish and publish an appropriate minimum-age and consent process before intentionally offering the service to children who cannot consent for themselves.

12. International processing

The hosting, authentication, database, and storage providers may process information outside the user's country. The repository does not specify the selected processing regions, provider contracts, or an international-transfer mechanism. Primavite therefore does not claim that a particular transfer safeguard or location applies. The operator must confirm the actual provider arrangements and update this section when that information is available.

13. Changes to this policy

This policy may be updated when Primavite's features, providers, or practices change. Material changes should be shown on the service and the effective date above should be updated. The policy will not be treated as permission to use information in a new way when applicable law requires another legal basis or notice.