Legal
Data safety
The short version
- No data is shared with third parties for their own purposes. Nothing is sold.
- No data is collected for advertising, analytics, or profiling. There is no such code in the app.
- All data is encrypted in transit. Messages and media are additionally end-to-end encrypted, so we cannot read them at rest either.
- You can request deletion of all of it, from inside the app, immediately.
- Three things are stored in a form we can read that you might expect otherwise: reaction emoji, profile fields, and unsent drafts.
A Play Data Safety form has fixed categories and no room for nuance. This page is the same declaration with the nuance restored — particularly the parts that are limitations.
01Summary of practices
| Practice | Kalvien |
|---|---|
| Data shared with third parties | None |
| Data sold | None |
| Data used for advertising or marketing | None |
| Data used for analytics or profiling | None |
| Third-party analytics, ad, or crash SDKs in the app | None |
| Data encrypted in transit | Yes, all of it |
| Messages and media end-to-end encrypted | Yes |
| You can request data deletion | Yes, in-app and on the web |
| Account required | Yes — phone number and SMS code |
| Independent security audit | Not yet |
| Source code published | Not yet |
02Every data type we collect
"Collected" means it leaves your device and reaches our servers. "Readable by us" is the column that most disclosures omit, and it is the one worth reading.
| Data type | Purpose | Readable by us? | Optional? |
|---|---|---|---|
| Phone number | Account creation, verification, anti-abuse | Yes | Required |
| Username & display name | App functionality — how people find you | Yes | Required |
| Bio & avatar | App functionality — your profile | Yes | Optional |
| Messages | App functionality — delivery | No — end-to-end encrypted | Created by you |
| Photos & videos | App functionality — delivery | No — end-to-end encrypted | Created by you |
| Message metadata | App functionality — routing and ordering | Yes — sender, conversation, timestamp | Required |
| Reaction emoji | App functionality | Yes — stored in the clear | Created by you |
| Unsent drafts | App functionality — drafts survive closing the app | Yes — stored in the clear | Created by you |
| Public encryption key | App functionality — so others can encrypt to you | Yes — it is public by design | Required |
| Private encryption key | — | Never collected — never leaves your device | — |
| Conversation settings | App functionality — pins, mutes, timers, read markers | Yes | Required for the feature |
| In-app contacts & blocks | App functionality | Yes | Created by you |
| Session tokens | App functionality — keeping you signed in | Yes | Required |
| Push notification token | App functionality — new message alerts | Yes | Optional — decline the permission |
| App-lock passcode | App functionality — device-level lock | No — stored only as a hash | Optional |
| Abuse reports | Safety and moderation | Yes | Created by you |
Data types we do not collect at all
- Device address book / contacts. The app requests no contacts permission and has never uploaded or hashed your contacts.
- Location of any kind, precise or approximate.
- Audio recordings. There is no microphone permission and no recording capability in the app.
- Advertising ID, device fingerprint, or any tracking identifier.
- App usage events, screen views, or behavioural analytics.
- Crash logs or diagnostics sent to a third party.
- Payment or financial information. The app is free and takes no payments.
- Health, fitness, calendar, SMS message contents, call logs, or installed app lists.
03What end-to-end encryption covers
Encryption uses libsodium's crypto_box construction: X25519 for key agreement and XSalsa20-Poly1305 for authenticated encryption. Your private key is generated on your device, held in Android Keystore-backed encrypted storage, and never transmitted.
- One-to-one message text — encrypted to the recipient's public key.
- Group message text — encrypted under a group key that is sealed separately to each member's public key.
- Photos and videos — each file encrypted with its own key, which is then sealed to the recipients. Our storage holds an opaque blob.
For these, our servers hold ciphertext and no key that opens it. That is a property of key placement, not a policy we could reverse.
04What it does not cover
Stating this clearly is the whole point of publishing this page rather than only filing the form.
Metadata. Who messaged whom, in which conversation, and when.
Reaction emoji. Stored in a plain column. We can see that you reacted to a message with a particular emoji. Encrypting reactions is on the roadmap and is not done.
Unsent drafts. Saved to your account unencrypted so they survive closing the app. Clearing the message box clears the stored copy.
Profile fields. Username, display name, bio, and avatar are stored unencrypted because they are shown to other users and must be searchable.
Abuse reports. What you write in a report is visible to us — necessarily, since the report is the thing that makes conduct visible in an encrypted service.
No forward secrecy. One long-term key per pair of users. A compromised device key could expose past messages with that person.
Safety-number verification is unfinished. You cannot yet verify that the public key we handed you is really your contact's.
No screenshot blocking, no biometric unlock. A passcode lock exists; a person holding your unlocked phone reads everything.
No independent audit and no published source.
06Permissions the app requests
| Permission | Why | Required? |
|---|---|---|
| Internet / network state | Sending and receiving messages | Required |
| Post notifications | Alerting you to new messages | Optional — the app works without it |
| Photo / media selection | Choosing an image to send or set as an avatar, only when you tap to do so | Optional |
| Vibrate | Notification feedback | Optional |
Not requested, at all: contacts, location, microphone, SMS reading, call logs, or background location.
07Deletion
Settings → Delete account removes your account, messages, media, keys, contacts, conversation settings, and sessions. It is immediate and permanent, with no grace period.
If you no longer have the app, use the process at kalvien.com/delete. Full detail on what deletion does and does not reach — including routine infrastructure backups — is in the privacy policy.
08Security practices
- All traffic to our servers uses TLS.
- Message and media content is end-to-end encrypted with vetted primitives via libsodium, not hand-rolled cryptography.
- Private keys are stored in Android Keystore-backed encrypted storage and are not exportable.
- Passcodes are stored hashed.
- Verification codes expire in 10 minutes and are rate-limited to five per hour.
- Media uploads are capped and stored as opaque ciphertext.
- Disappearing messages are deleted server-side by a sweeper that runs every 60 seconds.
Report a security issue to security@kalvien.com. Good-faith research is welcome under the terms in our acceptable use section.
09Families and children
Kalvien is rated for users aged 13 and over (16 where local law requires) and is not designed for or directed at children. It is not part of Google Play's Designed for Families programme. Our child-safety standards and zero-tolerance CSAE policy are in the terms of service.