What we store, and why we cannot read your conversations

Most privacy pages describe intentions. This one describes arithmetic.

The inventory

Conversations are held encrypted with a key derived from your password. We can see that a row exists and roughly how large it is. We cannot see what is in it, and neither can anybody who compels us to produce it.

An account is a username, a password hash and a plan. No email address and no phone number are requested, so neither can be disclosed, sold or leaked. If you subscribed, we hold the plan, the period, the status and an opaque customer reference; card details are entered on the payment provider's own page and never reach us.

Why this shape

The strongest privacy guarantee is not a policy, it is an inability. A promise not to read your conversations can be revoked by a change of management. A key that only exists on your side cannot be.

The cost is real and worth stating: lose the password and the conversations encrypted under it are gone. We cannot recover them, because recovery would require exactly the capability we removed.

What we will not start doing quietly

Conversations are not used to train models. There is no advertising, so there is no profile worth building. Every third party that can touch data on our behalf is listed publicly, and if that list changes the page changes with it.

The full detail is on the transparency page, the privacy policy and the subprocessor list. If those three ever disagree with each other, treat it as a bug and tell us.