Legal
Data safety
The short version
- No data is shared with third parties for their own purposes. Nothing is sold.
- No data is collected for advertising, analytics, or profiling. There is no such code in the app.
- All data is encrypted in transit. Messages and media are additionally end-to-end encrypted, so we cannot read them at rest either.
- You can delete your account and live service data from inside the app. Safety reports and disaster-recovery backups follow the limited retention described in the privacy policy.
- Private reactions, rich actions, stories, messages, and media are end-to-end encrypted. Channels, profile fields, reports, and routing metadata are readable by Kalvien.
A Play Data Safety form has fixed categories and no room for nuance. This page is the same declaration with the nuance restored — particularly the parts that are limitations.
01Summary of practices
| Practice | Kalvien |
|---|---|
| Data shared with third parties | None |
| Data sold | None |
| Data used for advertising or marketing | None |
| Data used for analytics or profiling | None |
| Third-party analytics, ad, or crash SDKs in the app | None |
| Data encrypted in transit | Yes, all of it |
| Messages and media end-to-end encrypted | Yes |
| You can request account-data deletion | Yes, in-app and on the web; documented safety/backup retention exceptions apply |
| Account required | Yes — phone number and SMS code |
| Independent security audit | Not yet |
| Source code published | Not yet |
02Every data type we collect
"Collected" means it leaves your device and reaches our servers. "Readable by us" is the column that most disclosures omit, and it is the one worth reading.
| Data type | Purpose | Readable by us? | Optional? |
|---|---|---|---|
| Phone number | Account creation, verification, anti-abuse | Yes | Required |
| Username & display name | App functionality — how people find you | Yes | Required |
| Bio & avatar | App functionality — your profile | Yes | Optional |
| Messages | App functionality — delivery | No — end-to-end encrypted | Created by you |
| Photos, videos, voice notes & files | App functionality — delivery | No — end-to-end encrypted | Created by you |
| Stories & private story interactions | App functionality — sharing with authorised viewers | No — end-to-end encrypted | Created by you |
| Channel content | App functionality — public broadcasting and moderation | Yes — channels are not end-to-end encrypted | Created by you |
| Message metadata | App functionality — routing and ordering | Yes — sender, conversation, timestamp | Required |
| Private reactions & rich actions | App functionality | No — encrypted conversation events | Created by you |
| Unsent private-message drafts | Local composing | Never collected — remains on your device | Created by you |
| Public encryption key | App functionality — so others can encrypt to you | Yes — it is public by design | Required |
| Private encryption key | — | Never collected — never leaves your device | — |
| Conversation settings | App functionality — pins, mutes, timers, read markers | Yes | Required for the feature |
| In-app contacts & blocks | App functionality | Yes | Created by you |
| Session tokens | App functionality — keeping you signed in | Yes | Required |
| Push notification token | App functionality — new message alerts | Yes | Optional — decline the permission |
| App-lock, biometric & decoy secrets | App functionality — device-level privacy | Never collected — protected locally | Optional |
| Call metadata | App functionality — call setup, status, history and abuse prevention | Yes — participants, identifiers, timestamps and status; not live media | Created when you call |
| Abuse reports | Safety and moderation | Yes | Created by you |
Data types we do not collect at all
- Device address book / contacts. The app requests no contacts permission and has never uploaded or hashed your contacts.
- Location of any kind, precise or approximate.
- Live call recordings. Microphone/camera access occurs only when you start a voice note or call; live call media is not recorded or persisted by Kalvien.
- Advertising ID, device fingerprint, or any tracking identifier.
- App usage events, screen views, or behavioural analytics.
- Crash logs or diagnostics sent to a third party.
- Payment credentials. The app takes no payments. Amounts/names entered in encrypted bill-split messages are private conversation content.
- Health, fitness, calendar, SMS message contents, call logs, or installed app lists.
03What end-to-end encryption covers
Private content uses authenticated X25519/XSalsa20-Poly1305 encryption. One-time prekeys provide forward secrecy for one-to-one messages and upgraded conversations refuse a legacy downgrade. Your private key is generated on your device, held in Android Keystore-backed storage, and never transmitted.
- One-to-one message text — encrypted to the recipient's public key.
- Group message text — encrypted under a group key that is sealed separately to each member's public key.
- Private reactions and rich-message actions — hidden encrypted conversation events, not readable reaction rows.
- Photos, videos, voice notes, files, captions, and albums — each file encrypted with its own key, which is then sealed to the recipients. Our storage holds an opaque blob.
- Stories and their private interactions — story keys are wrapped only to authorised viewers.
For these, our servers hold ciphertext and no key that opens it. That is a property of key placement, not a policy we could reverse.
04What it does not cover
Stating this clearly is the whole point of publishing this page rather than only filing the form.
Metadata. Who messaged whom, in which conversation, and when.
Channels. Channel posts, media, comments, reactions, and moderation data are broadcast content readable by Kalvien.
Call and message metadata. Participants, conversation/call identifiers, timestamps, routing and status must be processed to deliver the service. Live call media remains DTLS-SRTP encrypted and is not recorded.
Profile fields. Username, display name, bio, and avatar are stored unencrypted because they are shown to other users and must be searchable.
Abuse reports. What you write in a report is visible to us — necessarily, since the report is the thing that makes conduct visible in an encrypted service.
Forward secrecy and downgrade refusal. One-time prekeys protect one-to-one messages, and upgraded conversations do not silently fall back.
Safety-number verification. QR comparison lets users compare the identity keys shown by their devices.
Device privacy controls. Screenshot/screen-recording protection and optional passcode/strong-biometric/decoy locks are implemented, subject to Android platform and compromised-device limits.
No independent audit and no published source.
06Permissions the app requests
| Permission | Why | Required? |
|---|---|---|
| Internet / network state | Account, messaging, media, channels, calls, and sync | Required |
| Post notifications / vibrate | Message, call, and timed-event alerts | Optional — the app works without it |
| Photo / media selection | Choosing an image to send or set as an avatar, only when you tap to do so | Optional |
| Microphone | Recording a voice note or participating in a call you start/join | Optional |
| Camera | Video calls, QR scanning, and camera flows you start | Optional |
| Bluetooth / audio settings | Call audio routing and headsets | Optional |
| Foreground service / full-screen call intent | Maintaining active calls and presenting incoming calls on supported Android versions | Used for calls |
| Biometric | Optional app unlock after explicit enrolment | Optional |
Not requested, at all: device contacts, location, SMS reading, call logs, broad photo-library access, or background location. System pickers expose only the item you choose.
07Deletion
Settings → Delete account removes your live account, messages, media, keys, contacts, conversation settings, and sessions immediately, with no deactivated-account grace period. Safety reports and provider disaster-recovery backups follow the limited retention described in the privacy policy.
If you no longer have the app, use the process at kalvien.com/delete. Full detail on what deletion does and does not reach — including routine infrastructure backups — is in the privacy policy.
08Security practices
- All traffic to our servers uses TLS.
- Message and media content is end-to-end encrypted with vetted primitives via libsodium, not hand-rolled cryptography.
- Private keys are stored in Android Keystore-backed encrypted storage and are not exportable.
- App-lock, biometric, decoy, imported-archive, local-assistant, and backup secrets stay on the device unless you explicitly export a backup.
- One-time prekeys provide forward secrecy and upgraded conversations reject downgrade.
- Safety-number QR comparison verifies identity keys shown on each device.
- WebRTC calls use authenticated signalling and DTLS-SRTP; Kalvien does not record live call media.
- Media uploads are capped and stored as opaque ciphertext.
- Disappearing messages are deleted server-side by a sweeper that runs every 60 seconds.
Report a security issue to security@kalvien.com. Good-faith research is welcome under the terms in our acceptable use section.
09Families and children
Kalvien is rated for users aged 13 and over (16 where local law requires) and is not designed for or directed at children. It is not part of Google Play's Designed for Families programme. Our child-safety standards and zero-tolerance CSAE policy are in the terms of service.