Privacy policy
How secure-chat handles your information: what we collect, why, who it's shared with, how long it's kept, and your rights.
The short version
Your messages are end-to-end encrypted: they are locked on your device and only the people in the conversation can read them. We can't read them, and neither can our hosting providers. To run the service we do keep some account and technical information, such as your email address, your profile, who you talk to and when, and the devices you're signed in on. This page explains all of it.
1. Who we are
secure-chat (secure-chat.uk) is run by an independent developer based in the United Kingdom, who is the “controller” of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). For any privacy question, email [email protected].
2. What we collect
Your account
- Sign-up details: username, email address and a password. Your password never leaves your device: the app turns it into a separate sign-in key, and we store only a salted hash (bcrypt) of that key.
- Profile: display name, avatar, banner, bio, status and social links, if you choose to add them. Other users can see your profile.
- Settings: your theme, language, privacy and notification choices, saved so they follow you between devices.
- Plan: whether your account is on the free or Pro plan.
- Encryption keys: your public keys, and your private keys in encrypted form. The private keys are locked with your password or PIN on your device before they are uploaded, so we can't use them. If you create a recovery key, a second copy is stored locked with that key.
- Verified contacts: the fingerprints of your contacts' keys and which ones you've verified, so every device you use can warn you if a key changes. This list is encrypted on your device with a key only your own devices can make, so we can't read it.
Using secure-chat
- Messages and files: stored in encrypted form so they can be delivered and synced across your devices. Chat attachments, including their names, are encrypted on your device before upload. We can see a file's size and whether it was sent as a photo, a voice message or a file.
- Conversation information (metadata): who is in a chat or group, who sent a message to whom and when, message type, reactions, read state, friend lists, and call history (who called whom, when, and for how long). We need this to deliver messages and show your chat list.
- Profile images: avatars and banners are public, so they are not end-to-end encrypted. Images are resized and re-encoded when uploaded, which also strips embedded data such as location (EXIF).
- Presence: online status and “last seen”, which you can limit in Settings.
- Sign-in sessions: for each device you sign in on, we store the IP address, browser/device type and when it was last active. You can see and sign out of these in Settings → Security. We also remember which browser/device types and countries (country only, from Cloudflare) your account has used, so we can alert you — in the app and by email — when it is signed in to from a new one.
- Push notifications: if you turn them on, your browser's push address. Notifications say “New encrypted message” and never include what the message says.
- Support and reports: tickets you open, your messages to support, and reports you make about other users, along with any action moderators take.
Theatre and watch parties
A watch party (the video, queue, playback position and party chat) is kept in server memory only while people are in it, and is deleted shortly after the last person leaves. Pro users can save playlists, which are stored until deleted. YouTube searches go through our server, which caches results (not linked to you) to reduce calls to YouTube.
Calls
Voice and video calls, including screen sharing, are peer-to-peer and encrypted in transit (WebRTC, DTLS-SRTP). If a direct connection isn't possible, the encrypted stream is relayed through Cloudflare's TURN service, which can't decrypt it. We do not record calls.
Link previews
Link previews are off unless you turn them on (Settings → Privacy). When they're on, the app asks our server to fetch a link's title, description and image so it can show a preview. Our server sees the link while it fetches the page, but doesn't store or log it.
Public and invite-link groups
Messages in every group are end-to-end encrypted. In a public or invite-link group, though, anyone with the link can join, and once they're in they can read the messages sent since the group became public — not only those sent after they joined. The app warns you before you join one, and a private group can only be made public when everyone in it is a leader or mod. Our server keeps each group's member list so messages can be delivered.
Technical and security data
Like every website, our servers and Cloudflare process your IP address and browser details to deliver pages, stop abuse (rate limiting, and a Cloudflare Turnstile check when you sign up or sign in) and fix errors. Server logs are kept for a short time.
If the app crashes in your browser, it sends us the error message, the technical stack trace, the page path (never the part after ? or #), the app version and your browser type, so we can fix it. It never includes your messages, and reports aren't linked to your account.
3. What we can't see
4. Why we use it (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Creating your account and delivering messages, calls, groups and watch parties | Contractwe need it to provide the service you signed up for |
| Sign-in security, rate limiting, bot checks, abuse reports and moderation | Legitimate interestskeeping users and the service safe |
| Account emails (verification codes, password resets) | Contract |
| Push notifications | Consentyou turn them on, and you can turn them off at any time |
| Support tickets | Contractand legitimate interests |
| Responding to lawful requests from authorities | Legal obligation |
We don't use your data for advertising or profiling, and we don't sell it.
5. Services we rely on
These providers process data for us, or are contacted by your browser when you use a feature:
| Provider | What for | What they receive |
|---|---|---|
| Cloudflare | Website hosting and CDN, bot checks (Turnstile), call relays (TURN), cookieless, aggregate page analytics (Web Analytics), and storage for our encrypted nightly backups (R2) | IP address, browser details, pages requested; encrypted call traffic when relayed |
| dogado / one.com (Germany, EU) | Hosting our servers, databases and sign-in service (a private server we run) | Everything we store, as described above (messages remain encrypted) |
| Resend | Sending account emails | Your email address and the email's content (e.g. a verification code) |
| Your browser's push service (Google, Apple, Mozilla or Microsoft) | Delivering push notifications | A push address and a notification that doesn't include message content |
| Klipy and GIPHY | GIF search and display | Your search terms and IP address, sent straight from your browser |
| YouTube (Google) | Playing videos in the Theatre, and thumbnails | Your IP address and viewing activity for the embedded player, under Google's privacy policy |
| DiceBear | Generated default avatars | The avatar's seed (your username, or a random value if you changed it). Our server fetches the image, so DiceBear never sees your IP address or who is viewing it |
| Stripe | Payments for Pro | Your email address, and the payment details you type into Stripe's own form (we never see your card number) |
| Flagpedia (flagcdn.com) | Flag icons in the language picker | Your IP address |
Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.
6. How long we keep it
- Account and profile: until you delete your account.
- Messages and files: until you or the other person delete them, the conversation is cleared, or a disappearing-message timer runs out.
- Watch parties: deleted shortly after the last person leaves.
- Sign-in sessions: until you sign out, the session expires (30 days without use), or you remove it in Settings.
- Sign-in alerts (device type, country, IP address): 30 days.
- Email verification codes: until used or expired.
- Support tickets and moderation records: as long as needed to handle them and keep the service safe.
- Error reports: until the problem is fixed and no longer happening.
- Backups: an encrypted copy of the database is made each night and kept for 30 days, then deleted. Messages in it are still end-to-end encrypted.
7. On your device
We don't use cookies. The app stores these in your browser's local storage:
- your sign-in tokens (a short-lived access token and a refresh token);
- your settings, such as theme and language;
- your encryption keys, held in the browser's key store (IndexedDB);
- the fingerprints of your contacts' keys, to warn you if one changes;
- a cache of recent chats for faster loading.
Signing out clears the sign-in tokens. Clearing your browser's site data removes everything.
8. Your rights
Under UK data protection law you can ask to:
Email [email protected]. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office: ico.org.uk.
9. Security
Messages are encrypted on your device using ECDH key agreement and AES-GCM (256-bit with P-384 keys, called Max Secure and free for everyone; older chats used 128-bit with P-256 until both people signed in again). Each message's sender, conversation and ID are sealed into its encryption, so they can't be altered without it failing to open. Group keys are replaced whenever someone leaves a group, so they can't read anything sent afterwards. You can compare safety numbers with a contact to check nobody is in the middle. Conversation keys don't change over time, so anyone who obtained your private key could read that conversation's history (there is no "forward secrecy"). All traffic uses HTTPS, sign-ins use short-lived tokens, and sign-in keys are hashed with bcrypt. No system is perfect: if a breach affects your data, we'll tell you and the ICO where the law requires it.
10. Children
secure-chat is not for children under 13. If you believe a child under 13 has an account, contact us and we'll delete it.
11. Changes
If we change this policy, we'll update the date at the top. If the change is significant, we'll also tell you in the app.
12. Contact
Questions about this policy or your data? We're happy to help.