There is nowhere to send it.

PrivChat has no servers. There is no account to create, no phone number or email address to give, and no system under our control that your messages pass through. Neither we nor anyone else receives your conversations, your contacts, or any data about how you use the app, because there is nowhere to send it to. Everything the app stores stays encrypted on your device.

This is not a promise of good behaviour: it is a consequence of how the app is built. There is no server we could be asked for your data from, even if we wanted to hand it over.

PrivChat — privchat.wiki
Contact email: privchat.wiki@proton.me

The General Data Protection Regulation defines the controller as whoever decides how personal data is processed. Here there is no processing: the app sends nothing to any server of ours, because no such server exists. We do not receive your messages, your contacts, usage statistics or crash reports, so there is no data of yours for us to decide anything about. Section 2 sets this out in detail.

We publish the project name and a contact address anyway, so that there is a way to ask us something or complain. If the app ever did process personal data, this section would change before the code did.

None.

The app sends no personal data, identifiers, usage statistics or crash reports to its developers or to any third party. Specifically, PrivChat does not include:

• any analytics or usage measurement system;
• any crash reporting or telemetry system;
• any advertising network or advertising identifier;
• any user account, registration or sign-in;
• any third-party library that transmits data on its own.

The app does include software from the Tor Project in order to work: the Tor client, and — if you use bridges that disguise traffic — the program that does it. Both come from the same project, are open source, and neither reports what you do to anyone. See «Bridges and pluggable transports» below.

The libraries the app uses (Android's interface and camera components, the SQLCipher database encryption library, the Bouncy Castle cryptographic library, the ZXing QR code reader and the "arti" implementation of Tor) run entirely on the device and send no information to their authors or to us.

All of the following stays on your phone and never leaves it except in the case described in section 4:

The name you give a contact is yours and yours alone: it does not travel in any invitation code and never reaches the other end.

If you set a PIN, the database key is additionally derived from that PIN, so that not even the device itself can open it without you. The same applies to attachments: they are encrypted either way, but with a PIN both halves are needed — your PIN and a device secret — while without one the device secret is enough.

Backups: the app is configured to exclude itself from Android's automatic backups. Your conversations are not uploaded to any cloud, not even your own.

Only what you write, and only towards the people it is meant for. A message to a contact goes to that contact. A message to a group goes to each member, once per member, over the same encrypted one-to-one sessions. A post you publish in a channel is fetched, encrypted, by the people who hold that channel's invitation. Reading a channel sends no personal data at all: the request goes over an anonymous Tor circuit, with no account and no identifier, so not even the publisher can tell who is reading.

They travel end-to-end encrypted: they are encrypted on your device and only the recipient can decrypt them. They are carried over the Tor network, a public network operated by volunteers around the world.

It matters that you understand what that implies:

• The Tor relays your traffic passes through cannot read the content of your messages, nor know who they are for.
• Your internet provider can see that you connect to the Tor network, but not who you talk to or what you say. It cannot read your conversations, and that is not a matter of goodwill: what leaves your phone is already encrypted, so nothing readable ever crosses their network.
• The operators of those relays are independent third parties. We have no relationship with them, we do not pay them and we send them nothing about you: the app simply uses a public network, the same way it would use the internet.

Bridges and pluggable transports

If you live where Tor is blocked, the app lets you come in through bridges: entry relays that are not on the public list, and therefore cannot be filtered by address. Under «My identity → Tor bridges» you choose between a direct connection, bridges that ship with the app and need nothing from you, or your own if you have them.

The bundled ones are public: anyone using Tor Browser has them too, so using them does not single you out. They are inside the package you installed, so using them, the app contacts no server. If you type in your own, they are stored encrypted in the local database like the rest of your data; we do not see them, and they never leave your phone beyond connecting to them.

There is also an optional «Fetch more bridges» button that pulls recent bridges from the Tor Project (its moat service, the same one Tor Browser's connection assistant uses) and adds them to the ones you already have. It only runs when you tap it; the app never does so on its own:

• Over Tor first, and against the Tor Project's .onion service: so anyone watching your network does not see you asking for bridges, and no exit from the Tor network is needed.
• Only if Tor cannot connect at all —when fresh bridges are needed most— is it fetched directly. Then someone watching your network can tell you connect to the Tor Project (not what you ask for); the app warns you before you apply anything.
• What comes back only gets added for you to review: it never replaces what you had, and nothing is applied until you tap «Apply».

Some bridges also disguise the traffic, so that a censor inspecting packets does not recognise the Tor protocol. That is done by a helper program from the Tor Project itself, called lyrebird, which ships inside the app:

• It only runs if you use a bridge that needs it. On a direct connection it never starts.
• It runs inside the app, with the same permissions, and stops when you remove the bridge or close the app.
• It sends nothing to anyone on its own: no telemetry, no contact with us or with the Tor Project.
• It comes from the Tor Project, the same project behind the Tor client the app already uses. It is built from a pinned version of the official source, and that build is reproducible.

When you change your bridge settings, the app erases Tor's internal record of which entry it was using, so a bridge you removed leaves no trace on the phone.

There is no intermediate server storing your messages. If the person you write to is not connected, the message stays on your device waiting, and is retried later.

The last two are not declared by the app directly: they are added by the Android library that manages its background task queue (WorkManager). They are listed anyway because they appear in the permission list Android shows you, and a list that leaves out two real permissions is worth nothing.

To attach a file or a photo from your gallery the app uses the Android system pickers, which give access only to the specific file you choose. The app does not request access to your photos or your storage.

In addition, every image you send is re-compressed before it leaves, and that process removes the photo's hidden metadata: the GPS coordinates of where it was taken, your phone's model and the real capture date. Without this, attaching a gallery photo would reveal to your contact where you were when you took it, even if you did not know it. The file name is also replaced with a generated one. Video messages and voice notes recorded by the app itself are clean for the same reason: nothing ever adds location data to them.

You decide, because it is on your device:

• Messages marked as ephemeral are deleted automatically after the time you choose (1 hour, 24 hours or 7 days).
• You can delete conversations and contacts whenever you want.
• The "Erase identity and start over" option destroys the Android keystore keys and overwrites the files: afterwards, the previous data is unrecoverable even with the device in hand.
• Uninstalling the app removes all of its data.

We keep nothing because we have never had anything.

PrivChat is not directed at children under 13, and collects data from nobody, regardless of age.

The General Data Protection Regulation grants rights of access, rectification, erasure, objection, restriction and portability against whoever processes your data.

In this case there is nothing to direct those requests at: we do not process any personal data of yours, we hold no database with information about you, and we could not identify you even if you asked us to. You exercise control over your data directly from the app, by deleting it.

If you would still like to raise a question with us, you can write to privchat.wiki@proton.me.

We would rather say it here than have you find out later:

• If somebody has your unlocked phone, they can read your conversations. The app's PIN exists precisely for that case.
• Screenshots are allowed unless you enable the block in "My identity". And no app can stop somebody photographing your screen with another phone.
• The person you are talking to can save, copy or forward what you write to them. No technology can prevent that.
• An adversary able to watch both ends of the Tor network at the same time could, in theory, correlate the timing of the traffic and infer that two people are writing to each other. Even then they could not read anything: the content leaves your phone already encrypted and is only decrypted on the recipient's, so what such an adversary would learn is the fact of the conversation, never its contents. It is a known limitation of Tor, not of this app.

If this policy changes, the date in the header will be updated and the new version published at the same address. Changes affecting how data is handled will additionally be announced inside the app.