Last updated: 24 August 2026
PrivChat has no servers. There is no account to create, no phone number or email address to give, and no system under our control that your messages pass through. Neither we nor anyone else receives your conversations, your contacts, or any data about how you use the app, because there is nowhere to send it to. Everything the app stores stays encrypted on your device.
This is not a promise of good behaviour: it is a consequence of how the app is built. There is no server we could be asked for your data from, even if we wanted to hand it over.
PrivChat — privchat.wiki
Contact email: privchat.wiki@proton.me
The General Data Protection Regulation defines the controller as whoever decides how personal data is processed. Here there is no processing: the app sends nothing to any server of ours, because no such server exists. We do not receive your messages, your contacts, usage statistics or crash reports, so there is no data of yours for us to decide anything about. Section 2 sets this out in detail.
We publish the project name and a contact address anyway, so that there is a way to ask us something or complain. If the app ever did process personal data, this section would change before the code did.
None.
The app sends no personal data, identifiers, usage statistics or crash reports to its developers or to any third party. Specifically, PrivChat does not include:
The app does include software from the Tor Project in order to work: the Tor client, and — if you use bridges that disguise traffic — the program that does it. Both come from the same project, are open source, and neither reports what you do to anyone. See «Bridges and pluggable transports» below.
The libraries the app uses (Android's interface and camera components, the SQLCipher database encryption library, the Bouncy Castle cryptographic library, the ZXing QR code reader and the "arti" implementation of Tor) run entirely on the device and send no information to their authors or to us.
All of the following stays on your phone and never leaves it except in the case described in section 4:
| What | How it is protected |
|---|---|
| Your cryptographic identity (the keys that identify you to your contacts) | Encrypted with a key from the Android keystore, bound to the device hardware |
| Your contacts and the names you give them | In a database encrypted with SQLCipher |
| Your messages | In that same encrypted database |
| The files you send or receive | Encrypted in the app's private storage |
| Tor network operational data | In the app's private storage |
The name you give a contact is yours and yours alone: it does not travel in any invitation code and never reaches the other end.
If you set a PIN, the database key is additionally derived from that PIN, so that not even the device itself can open it without you. The same applies to attachments: they are encrypted either way, but with a PIN both halves are needed — your PIN and a device secret — while without one the device secret is enough.
Backups: the app is configured to exclude itself from Android's automatic backups. Your conversations are not uploaded to any cloud, not even your own.
Only your messages and the files you send, and only towards the person you are sending them to.
They travel end-to-end encrypted: they are encrypted on your device and only the recipient can decrypt them. They are carried over the Tor network, a public network operated by volunteers around the world.
It matters that you understand what that implies:
If you live where Tor is blocked, the app lets you come in through bridges: entry relays that are not on the public list, and therefore cannot be filtered by address. Under «My identity → Tor bridges» you choose between a direct connection, bridges that ship with the app and need nothing from you, or your own if you have them.
The bundled ones are public: anyone using Tor Browser has them too, so using them does not single you out. They are inside the package you installed, so using them, the app contacts no server. If you type in your own, they are stored encrypted in the local database like the rest of your data; we do not see them, and they never leave your phone beyond connecting to them.
There is also an optional «Fetch more bridges» button that pulls recent bridges from the Tor Project (its moat service, the same one Tor Browser's connection assistant uses) and adds them to the ones you already have. It only runs when you tap it; the app never does so on its own:
Some bridges also disguise the traffic, so that a censor inspecting packets does not recognise the Tor protocol. That is done by a helper program from the Tor Project itself, called lyrebird, which ships inside the app:
When you change your bridge settings, the app erases Tor's internal record of which entry it was using, so a bridge you removed leaves no trace on the phone.
There is no intermediate server storing your messages. If the person you write to is not connected, the message stays on your device waiting, and is retried later.
| Permission | What it is used for |
|---|---|
| Internet and network state | Connecting to the Tor network to send and receive messages |
| Camera | Only to read the QR code of an invitation. No image is recorded, stored or sent anywhere: frames are analysed in memory and discarded |
| Foreground service | Keeping the connection alive while the app is not on screen, so that you can receive messages. It comes with a permanent notification, as Android requires. You can turn it off in "My identity" |
| Notifications | Showing that permanent notification and alerting you to new messages |
Keep the device awake (WAKE_LOCK) | So the system does not interrupt a send or a receive halfway through while the screen is off |
Run at startup (RECEIVE_BOOT_COMPLETED) | Restoring the queue of pending messages after the phone restarts, so that anything undelivered keeps being retried |
The last two are not declared by the app directly: they are added by the Android library that manages its background task queue (WorkManager). They are listed anyway because they appear in the permission list Android shows you, and a list that leaves out two real permissions is worth nothing.
To attach a file the app uses the Android system picker, which gives us access only to the specific file you choose. The app does not request access to your photos or your storage.
You decide, because it is on your device:
We keep nothing because we have never had anything.
PrivChat is not directed at children under 13, and collects data from nobody, regardless of age.
The General Data Protection Regulation grants rights of access, rectification, erasure, objection, restriction and portability against whoever processes your data.
In this case there is nothing to direct those requests at: we do not process any personal data of yours, we hold no database with information about you, and we could not identify you even if you asked us to. You exercise control over your data directly from the app, by deleting it.
If you would still like to raise a question with us, you can write to privchat.wiki@proton.me.
We would rather say it here than have you find out later:
If this policy changes, the date in the header will be updated and the new version published at the same address. Changes affecting how data is handled will additionally be announced inside the app.