Fingerprint data flow
Listening for your position, volunteering public coverage, and asking SINK to process a private screening asset are not the same operation. This page keeps those boundaries explicit.
Fingerprints are compact features used for alignment rather than playable audio files, but they can still be sensitive. Public contributions are initially associated with an account for integrity controls. On withdrawal, SINK removes that association and assigns a different random identity per title/variant so consensus survives without creating a cross-title history. Private exact-cut fingerprints remain contract-scoped and revocable.
Future extension contributions can be disabled, and the account link on accepted public measurements can be permanently removed from extension settings. Accepted de-identified catalog measurements remain; debug captures and rejected or failed staging data are deleted. Account holders can start account deletion in app or on the web. Screening organizers can withdraw authorization and request private-version teardown under the hosted-screening workflow.
Start or request account deletionSeparate extension disclosure
Fingerprint contribution is not the extension's only page-processing feature. On unidentified or broadly supported playback pages, SINK may transmit page URL and player/title metadata to resolve what is playing. When structured signals are insufficient, the extension can also send a bounded, whitespace-collapsed excerpt of visible page text plus privacy-redacted URL and embed hints to SINK's content-identification endpoint. It does not send raw page HTML for this step.
Extension error reports may include the current page URL, extension version, browser user agent, error message, stack, and related diagnostic fields. A page URL can contain browsing or account-related information, so this diagnostic flow is disclosed separately from the local-audio claim.
Data-flow summary reviewed August 11, 2026. The Privacy Policy controls if this summary and the policy differ.