Access and correction
You can ask what personal data we hold about you and have it corrected. Because your messages are encrypted, an export contains metadata — we cannot produce content we cannot read.
Privacy
What we can see, written down.
Every app says it is private. The useful question is narrower: which parts are encrypted so that we could not read them if we wanted to, which parts are not, and what is left over either way. Here is our answer to all three.
- From
- Account 7f3a
- To
- Account c91e
- When
- 9:41 AM
- Device
- iPhone, app version
- Message
- 82ZD93+q1A=Bd/d+dqA3f31DA/89 98/AD13f3Aqd+d/dB=A1q+39DZ28
We can read the first four lines. We hold no key to the last one.
Encrypted, and not
If this table and the code ever disagree, the code is right and this page is a bug.
| Surface | State | What that means |
|---|---|---|
| Messages, one-to-one and group | End-to-end encrypted | Encrypted per recipient device. We relay ciphertext and hold no key. |
| Voice and video calls | End-to-end encrypted | Media and keys are derived on the devices. We keep the call log, never the call. |
| Location shares and the map | End-to-end encrypted | Positions are encrypted on your phone and never written to our database. |
| Moments | End-to-end encrypted | Encrypted to a known audience, one key envelope per recipient device. |
| Clips, captions and thumbnails | Public — not encrypted | Stored as plaintext. We can read them. A broadcast has no recipient list to encrypt to. |
| Creator profiles, follows, likes, comments | Public — not encrypted | Server-readable. They are public identity and public counts by design. |
| Game moves, scores and results | Server-refereed | Our server is the referee, so it reads the moves. The invite is an encrypted message. |
The part nobody likes to talk about
Encryption protects content. It does not hide that a conversation happened. To deliver a message at all, we necessarily hold some of this:
- Which accounts exchange messages, and when — not what they said.
- Your phone number, because it is how an account is verified.
- Device type and app version, so we can ship updates that work.
- IP addresses on connection, which is unavoidable for anything on the internet.
- Call records: who, when, how long.
Location data: what we access, collect and use
What we access. If you choose to share your location, Voiid accesses your device’s precise and approximate location (GPS, network and Wi-Fi position). It asks permission at the moment you first share, not at install. Live sharing and the friends map can keep updating while the app is in the background; a persistent notification shows when that is happening.
Why we use it. Only to provide the features you turn on: sending a one-time location in a chat, sharing live location with people you choose for a time you choose, and showing you and your chosen friends on the map. We do not use location for advertising, profiling or analytics, and we do not sell it.
What we collect and store. Positions are encrypted on your device before they leave it, and only the people you name can decrypt them. Our servers relay the encrypted data and briefly hold the latest encrypted update (minutes) so a friend’s phone that is offline can catch up. We cannot read it and we never write coordinates to our database. We do keep the fact that a share session existed: who it was with, and when it started and ended.
Your control. You appear to nobody until you choose an audience. Ghost Mode stops all location requests on your device, and turning sharing off ends it for everyone immediately. Shares end on their timer, and visibility expires automatically after 24 hours without opening the app. You can also revoke location permission at any time in your phone’s settings; chat and calls keep working.
Third parties. The map is drawn by Google Maps, and place search sends what you type in the search box to Google Places while you are typing. Google processes those requests under its own privacy policy. Your shared positions are not sent to Google by Voiid.
Under India’s DPDP Act
Erasure
Deleting your account starts a real erasure, not a hidden flag: an automated job removes your rows and your uploaded media, and your sessions stop working immediately rather than when a token happens to expire.
Consent you can withdraw
Withdrawing consent is built to be as easy as giving it, and we record which version of which notice you agreed to, so “what did I actually agree to” has an answer.
No promises we cannot keep
We have not been independently audited. Our encryption is built on well-reviewed public building blocks — the Double Ratchet for one-to-one, MLS for groups — but using good primitives is not the same as having someone check that we used them correctly, and we are not going to blur that line.
When something is not finished, the rest of this site says so rather than listing it. That is the standard we would want to read.