Privacy policy

1. Who is responsible for your data

2. How it works

Your identity is a key pair generated on your device or in a HEM device. Messages are encrypted end-to-end on your device and decrypted only by the recipient. We do not know what you say, we do not have your contact list and we do not store messages. A conversation exists only on its participants' screens.

3. What we do not collect

We do not ask for a phone number, an e-mail address or a name. We use no analytics, no advertising, no tracking and no push notifications through Google's or Apple's servers. We do not sell data or share it for marketing.

4. What our servers see

• Relay nodes pass encrypted packets between participants. They see your device's IP address, when it connects and how much data it sends, but not the content, and not who talks to whom. Conversation rooms have names that only the two sides know.
• Web server logs record, for each request, the IP address, the time, the page requested and the browser type. They serve security and abuse protection and are deleted automatically after 14 days.
• Country of origin. Each server looks up which country an IP address belongs to, in a database kept on the server itself, to refuse connections from countries where the service is not provided (see the terms, section 10). The address is not sent anywhere for this and the country is not stored. IP Geolocation by DB-IP.
• Blocked for abuse. Addresses and networks that abused the service (terms, section 4) - floods, scanning, attacks on the servers - are kept on a block list for as long as the block lasts, with the date and the reason, and refused by our servers. The list is not published.
• Traffic statistics are aggregate counters only (messages, bytes and connections per node per time interval), with no IP addresses and no identifiers. We keep them for up to 30 days.
• The STUN server (only if you turn on direct connections) tells your device which public IP address it sees it from. It does not record addresses.

5. Files

Files, photos and voice messages are encrypted on your device before they are sent. Our file server holds only the encrypted data, for about 5 minutes, after which it is deleted. Only the recipient has the key.

6. Direct connection (optional)

By default messages travel through the relay nodes. If you turn on direct connections in Settings, your device and your contact's device learn each other's IP addresses.

7. The Feedback form

If you send a report, we receive what you write and, if you leave the box ticked, technical data: the app version and the kind of browser or system. You see the exact content before sending. You give a contact address only if you want a reply. A report contains none of your keys, contacts or conversations and no IP address; sending it, like any request to the server, is recorded in the log described in section 4 (14 days). We keep reports until they are handled, for no longer than 6 months.

8. Data on your device

Contacts, settings, pinned messages and your password-sealed profile are stored locally on your device (pinned messages and the profile encrypted). We have no access to them. You remove them by deleting the profile in the app or uninstalling it. If you use a HEM device, your keys and contacts are stored in it.

9. App permissions

The camera is used only to scan QR codes. The microphone is used only to record voice messages, and only while you press the button. Notifications tell you a message arrived without showing its content. On Android the app keeps a background service so conversations work with the screen locked, because we do not use push notifications.

10. Who processes data for us

• Hosting: LumaDock (servers in London and Frankfurt) and DigitalOcean (Amsterdam).
• GitHub (USA): app downloads and update checks. GitHub sees your IP address then. The transfer relies on the EU–US Data Privacy Framework.

11. Legal bases (GDPR)

• Server logs and statistics: legitimate interest, the security and operation of the service (Art. 6(1)(f)).
• The country lookup: legitimate interest in complying with international sanctions (Art. 6(1)(f)).
• The abuse block list: legitimate interest in the security of the service (Art. 6(1)(f)).
• Relaying messages and files: providing the service you ask for (Art. 6(1)(b)).
• The Feedback form: your consent (Art. 6(1)(a)).

12. Your rights

You have the right of access, rectification, erasure, restriction of processing and objection, and the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO) in Poland or the supervisory authority where you live. Apart from server logs and Feedback reports, we hold no data that could be linked to you.

13. Children

The app is not intended for anyone under 16.

14. Changes

Changes to this policy will be announced on this page with a new effective date.