Built so we can’t read your chats.
Privacy isn’t a setting you have to find. It’s how the app is built. Here is exactly what we can see, and what we can’t.
What we cannot see
- What your messages say
- Your photos and files
- What you say on calls
- What you quoted when you replied
- How you reacted, or what your avatar looks like
- When you read a message
- Your address book (we never ask for it)
- Your location (we never ask for it)
What our server still sees
Encryption hides content, not the envelope. To deliver messages the server must know:
- Who talks to whom, and when
- How large a message or file is
- Group names and who is in each group
- That a call is being set up
- Your tasks, agreements and report drafts. These are not end-to-end encrypted, so keep secrets out of them
Promises we keep by design
Each of these is enforced by how the software works, and most are checked by automated tests before every release.
Keys stay on your phone
Encryption keys are created on your device and never sent to us. If you lose the device, nobody can recover your old messages, including us.
Scam checks run on your phone
We do not need to read your messages to protect you. The check happens before encryption and after decryption, on the device.
No face data
Your avatar is a drawing made of a dozen small numbers. No selfie, no face scan, nothing biometric. Under India's DPDP Act 2023 we simply do not collect it.
No religion field
Wearing a dastaar or a bindi on your avatar does not tag you with a faith in any database. We never store, guess or export religion.
No trackers, no ads
No analytics, advertising or tracking scripts in the app or on this website. Every font and file loads from our own server.
No harvesting numbers
You can only find someone by their full mobile number. Partial searches return nothing, so nobody can scrape a list of users.
Deleted means deleted
When a disappearing message expires, the encrypted message and every key copy are removed from the server, not hidden.
Identity numbers never stored
If you choose to verify your identity, the check happens with the licensed partner. We keep only a salted fingerprint that prevents duplicate accounts.
One cookie, strictly necessary
The app uses a single sign-in cookie that lasts up to 24 hours. This website uses none.
Things we have not built yet
In-app account deletion, data export and password recovery are not available in the pilot. Until they are, write to us through Contact and we will delete your account by hand. The full legal text is in our Privacy policy.
