Access and correction
You can ask what personal data we hold about you and have it corrected. Because your messages are encrypted, an export contains metadata — we cannot produce content we cannot read.
Privacy
What we can see, written down.
Every app says it is private. The useful question is narrower: which parts are encrypted so that we could not read them if we wanted to, which parts are not, and what is left over either way. Here is our answer to all three.
Encrypted, and not
If this table and the code ever disagree, the code is right and this page is a bug.
| Surface | State | What that means |
|---|---|---|
| Messages, one-to-one and group | End-to-end encrypted | Encrypted per recipient device. We relay ciphertext and hold no key. |
| Voice and video calls | End-to-end encrypted | Media and keys are derived on the devices. We keep the call log, never the call. |
| Location shares and the map | End-to-end encrypted | Positions are encrypted on your phone and never written to our database. |
| Moments | End-to-end encrypted | Encrypted to a known audience, one key envelope per recipient device. |
| Clips, captions and thumbnails | Public — not encrypted | Stored as plaintext. We can read them. A broadcast has no recipient list to encrypt to. |
| Creator profiles, follows, likes, comments | Public — not encrypted | Server-readable. They are public identity and public counts by design. |
| Game moves, scores and results | Server-refereed | Our server is the referee, so it reads the moves. The invite is an encrypted message. |
The part nobody likes to talk about
Encryption protects content. It does not hide that a conversation happened. To deliver a message at all, we necessarily hold some of this:
- Which accounts exchange messages, and when — not what they said.
- Your phone number, because it is how an account is verified.
- Device type and app version, so we can ship updates that work.
- IP addresses on connection, which is unavoidable for anything on the internet.
- Call records: who, when, how long.
Under India’s DPDP Act
Erasure
Deleting your account starts a real erasure, not a hidden flag: an automated job removes your rows and your uploaded media, and your sessions stop working immediately rather than when a token happens to expire.
Consent you can withdraw
Withdrawing consent is built to be as easy as giving it, and we record which version of which notice you agreed to, so “what did I actually agree to” has an answer.
No promises we cannot keep
We have not been independently audited. Our encryption is built on well-reviewed public building blocks — the Double Ratchet for one-to-one, MLS for groups — but using good primitives is not the same as having someone check that we used them correctly, and we are not going to blur that line.
When something is not finished, the rest of this site says so rather than listing it. That is the standard we would want to read.