Privacy
Last updated 9 October 2026.
within is built to be quiet and to forget. We keep as little as the product needs to work, and the heart of it — your voice lines — is deleted the moment it’s heard. Here’s exactly what that means. within is run by Sandbox Incubator LLC.
What we keep
- Your email — to sign you in (there’s no password; we email a 6-digit code) and to send those codes.
- Your display name — shown to the people in your circle.
- A photo, if you add one — optional, and shown only to your circle.
- Your voice lines — the recordings you send, stored only long enough to be heard.
- Your circle — who you’re connected to (mutual, and never more than three).
- Notification tokens — if you turn on notifications, the token your browser or phone gives us so we can ping you when a line arrives. Turn them off and it’s removed.
- Minimal technical logs — the ordinary server records needed to keep within secure and working.
What we don’t
No passwords. No advertising, no tracking pixels, no third-party analytics following you around. We don’t sell your data, and we don’t listen to your voice lines. There is no feed, no history, no archive of what you’ve said.
How long we keep it
- A voice line is deleted the moment it’s heard — both the recording and its record.
- A line that’s never heard is deleted after 30 days.
- Your profile and circle stay until you change them. Delete your account and we remove your profile, your connections, and any lines still in flight.
Who else touches it
A few services help within run, and each sees only what it needs:
- Email delivery (Resend) — to send your sign-in codes.
- Push delivery — your browser’s push service (Apple, Google or Mozilla), or Apple’s for the iPhone app, carries the “a line arrived” ping.
- Hosting, storage and network — our servers, object storage and Cloudflare hold and carry the data above.
- Error reports (Sentry) — when something breaks, a technical report of what went wrong, without your recordings.
Your choices
From Settings you can change your email or name, add or remove your photo, turn notifications off, remove people from your circle, or delete your account entirely. If you’re in the EU or UK, your rights are set out on the GDPR page.
Children
within isn’t intended for anyone under 13, or under the age of digital consent where you live.
Changes & contact
If this policy changes we’ll update the date at the top. Questions about your data? Email [email protected] — we read every one.