We collect as little as the product allows. There is no bio, no photo, no address book upload, and no advertising network. We do not sell your data.
Salish Studios is the data controller for FOUR.
Account: your email address (if you sign up with email or Google), a username you choose, the city you choose from a list of real places, and your language. If you sign in anonymously we hold only an anonymous identifier until you upgrade.
Content: your four words each day, your replies, the four-word openers you send, and who you follow, connect with or block.
Assigned to you: a four-word signature and the visual seal generated from it.
Technical: your time zone (so "today" is your today), and standard server logs from our hosting providers, which include IP address and browser type and are retained for a limited period for security and debugging.
Notifications, only if you turn them on: an address your browser gives us for delivering push messages to that one device, and the hour you asked to be reminded at. Turning the reminder off deletes both. We send one notification a day at most, and only on days you have not posted.
Product analytics: counts of actions in the app — posts made, words used, features opened — used to understand whether the product works. These are recorded WITHOUT an account id: the event rows have no user attached to them, so they cannot be traced back to you.
We do NOT collect: contacts, precise location, photos, biometric data, or advertising identifiers.
To provide the service you asked for (contract). To keep it safe and prevent abuse (legitimate interests). To meet legal obligations. Where we rely on consent — for example optional emails — you can withdraw it at any time.
Other users see: your username, city, language, your four-word days, your signature, your seal, and your streak. They do not see your email, your time zone, your analytics, or how many people follow you — FOUR has no follower counts.
Processors we use: Supabase (database, authentication, hosting of your content), Vercel (application hosting and logs), and Google (only if you choose to sign in with Google). We do not currently send transactional email; if that changes, this list will name the provider before it does.
We disclose data to authorities only where legally required, or to prevent imminent harm to a person.
Your days stay until you delete them or your account — the archive is the point of the product.
Deleting your account removes your profile, days, replies and connections from the live service. Backups are held by our database provider on their own rolling schedule and are overwritten in the ordinary course; we keep no separate copies of our own.
Your four-word signature is retired permanently rather than reissued, so that a link someone saved never resolves to a different person. After account deletion it is retained only as a retired identifier with no personal data attached.
Reports and safety records may be kept longer where needed to enforce our terms.
Depending on where you live you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to complain to a supervisory authority.
If you are in the EEA or UK: we rely on the GDPR bases above. Our processors are US-based, and transfers rely on the Standard Contractual Clauses in their data processing agreements.
If you are in California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.
To exercise any of this, write to hello@sayfour.com.
FOUR is not for people under 13. We do not knowingly collect personal data from children under that age. If we learn we have, we delete it. If you believe a child has an account, contact hello@sayfour.com.
We store your session and a few preferences (such as which words you follow and whether the explicit-language filter is on) in your browser's local storage. These are required for the app to work and are not advertising cookies.
Access to your data is enforced at the database level, per row, per user. We use reputable providers and encryption in transit. No service is perfectly secure; if a breach affects you we will notify you as required by law.
We will post material changes in the app before they take effect. Last updated July 2026.
Salish Studios — hello@sayfour.com.