Legal
Privacy policy
The short version
- We cannot read your messages, media, or group content. They are encrypted on your phone and we only ever hold ciphertext.
- We can see who you message and when. That metadata is the honest cost of running a service that delivers anything.
- We need a phone number to sign you up. No other user is ever shown it.
- Three things you might assume are encrypted are not: reaction emoji, your profile fields, and unsent drafts. Section 4 lists every one.
- No ads, no analytics, no tracking SDKs, no profiling, no selling. There is no advertising code in the app or the server.
- You can delete everything from inside the app, permanently, with no waiting period.
This summary is here so the policy actually gets read. It is not a substitute for the text below, and where the two seem to differ, the text below governs.
01Who we are
Kalvien Chat ("Kalvien", "we", "us") is an end-to-end encrypted messaging app for Android, currently in early access. This policy covers the app, the backend service that relays your messages, and the website at kalvien.com.
For the purposes of the UK GDPR, the EU GDPR, and comparable laws, Kalvien is the data controller for the personal data described here. We do not currently have an appointed Data Protection Officer; privacy requests are handled directly by the team at privacy@kalvien.com.
Kalvien has not been independently audited, its source is not published, and it is a small team. None of that changes your legal rights below, but it should inform how much you rely on us. Our public list of limitations is deliberately more detailed than this document needs to be.
02What we collect, and why
We collect only what the service needs to function. Each row below corresponds to something that genuinely exists in our database or storage — this is not a generic list.
| Data | Why | Required? |
|---|---|---|
| Phone number | Creating and recovering your account, and preventing one person from minting thousands of accounts. Stored in E.164 form. | Required |
| One-time SMS codes | Proving the number is yours. Stored briefly with a consumed/unconsumed flag. | Required |
| Username, display name | How other people find and recognise you. | Required |
| Bio, avatar (emoji, colour, or image) | Your profile, as shown to people you talk to. | Optional |
| Your X25519 public key | So other people can encrypt to you. Only the public half ever reaches us. | Required |
| Encrypted messages and media | Delivering them. We store and relay ciphertext. | Created when you send |
| Conversation records | Who is in which conversation, and message timestamps, so the app can show you a chat list. | Required |
| Per-chat settings | Pinned, muted, archived, read marker, disappearing-message timer, and any unsent draft. | Required for the feature |
| Reaction emoji | Showing reactions. Stored in the clear — see section 4. | Created when you react |
| Session tokens | Keeping you signed in, and letting you end a session. | Required |
| Push notification token | Waking your device when a message arrives. | Optional — decline the permission and we never receive one |
| Passcode hashes | App-lock passcode, hashed. We never hold the passcode itself. | Optional |
| Abuse reports | When you report a user or message: who reported, who was reported, a reason, and any note you write. | Created when you report |
| Contacts you add in-app | Your contact list inside Kalvien, including favourites and blocks. | Created when you add someone |
What we deliberately do not collect
- Your device address book. The app has no contacts permission. We have never uploaded, hashed, or matched your phone's contacts, because we cannot read them.
- Your location. No location permission, no IP-derived location stored against your account.
- Advertising or analytics identifiers. There is no advertising ID, no analytics SDK, no crash-reporting SDK, and no behavioural event log.
- Microphone or camera access beyond what you initiate. There is no audio recording capability in the app at all.
- An email address, unless you choose to give one for the website waitlist (section 13).
03What we cannot see
The following are encrypted on your device before they reach us, using libsodium's crypto_box — X25519 key agreement with the XSalsa20-Poly1305 authenticated cipher. Your private key is generated on your phone, stored in Android Keystore-backed storage, and never transmitted to us in any form.
- Message text in one-to-one and group conversations.
- Photos and videos. Each file is encrypted with its own key before upload; that key is then sealed to each recipient. Our storage holds an opaque blob.
- Group content. The group key is sealed separately to every member's public key, so we hold a set of envelopes and no key that opens any of them.
This is not a policy commitment we could quietly reverse — it is a property of where the keys live. We could not produce your message content in response to a legal order, a security breach, or our own change of heart, because we do not have the means to decrypt it.
The verify it yourself section of our homepage generates real ciphertext in your browser, shows you the exact request shape and database row it becomes, and then genuinely fails to decrypt it with the wrong key. Until our source is published, that is the strongest evidence we can offer, and we would rather hand you it than ask for your trust.
04What we can see — stated in full
Every messenger's operator can see something. Most policies bury this. Here is our complete list.
Metadata around your messages
We can see who sent a message, which conversation it went to, and when, along with its delivery status and whether it is a reply. We cannot see what it said. Over time this reveals the shape of your social graph and your activity patterns, which is meaningful information about you even without content. If that alone is unacceptable for your situation, you should be using a service with sealed sender — we say so on the homepage too.
Reaction emoji
When you react to a message, the emoji is stored on our server in the clear, alongside which message and which user. We can see that you reacted to a message with a skull. Encrypting reactions is on our roadmap and is not done. We list this rather than let "encrypted messaging" imply otherwise.
Unsent drafts
If you type into a conversation and do not send, the app saves that draft to your account so it survives closing the app. Drafts are stored unencrypted. Clearing the message box clears the stored copy. This is the least obvious item in this section, which is exactly why it is here.
Profile fields
Your username, display name, bio, and avatar are stored unencrypted, because they are shown to other users and must be searchable by username. Treat them as public within Kalvien.
Your phone number, and number lookup
We hold your phone number. No other user is ever shown it — it is not returned in any API response another user receives, it is not in your profile, and it is not in group member lists.
Someone who already knows your full phone number can search for it and reach your account. We deliberately do not allow partial or prefix number search, so this cannot be used to enumerate accounts — but "hidden" and "unfindable" are different claims, and only the first is true today. Making number lookup hashed and off by default is on our roadmap.
Operational data
Our servers process IP addresses in the ordinary course of serving requests, and our infrastructure provider keeps short-lived operational logs. We do not build profiles from them or retain them against your account.
05Legal bases for processing
Where the GDPR or equivalent law applies, we rely on the following bases:
| Purpose | Basis |
|---|---|
| Creating your account and delivering messages | Performance of a contract (Art. 6(1)(b)) — this is the service you asked for |
| Verifying your phone number by SMS | Performance of a contract, and our legitimate interest in preventing mass account creation (Art. 6(1)(b) and (f)) |
| Push notifications | Your consent, given through the Android notification permission, withdrawable at any time in system settings |
| Handling abuse reports and enforcing our terms | Legitimate interest in keeping the service safe, and legal obligation where reports concern illegal content (Art. 6(1)(f) and (c)) |
| Security, rate limiting, and preventing abuse of our infrastructure | Legitimate interest (Art. 6(1)(f)) |
| Waitlist emails on this website | Your consent, confirmed by double opt-in and withdrawable in one click |
We do not rely on legitimate interest for advertising, profiling, or analytics, because we do none of those things.
07How long we keep things
- Messages and media: until you or your recipient deletes them, or until you delete your account. If a disappearing-message timer is set, a sweeper deletes the row from our database within about sixty seconds of expiry — the data is removed, not hidden.
- Account data (number, username, profile, keys): until you delete your account.
- One-time SMS codes: they expire in 10 minutes and are marked consumed on use.
- Session tokens: until you sign out, end the session, or delete the account.
- Push tokens: until you disable notifications, sign out, or delete the account.
- Abuse reports: retained after review so that repeat behaviour is visible. A report about you can outlive your account, in a form limited to what safety requires.
- Waitlist email addresses: until you unsubscribe, or until we launch and send the single email we promised.
Deletion removes your data from our live systems immediately. Our infrastructure provider takes routine database backups for disaster recovery; deleted rows can persist in those backups until they age out on their normal cycle, which is a matter of days. We do not restore backups to recover deleted accounts, and encrypted content stays encrypted in them regardless.
08Deleting your account and data
You can delete everything at any time, and it is two taps rather than a support ticket.
- In the app: Settings → Delete account.
- Without the app: follow the process at kalvien.com/delete.
Deleting removes your account record, your phone number, your public key, your messages and media, your contacts, your conversation settings, and your sessions. There is no deactivated state, no grace period, and no email asking you to reconsider.
Two consequences worth understanding before you do it. First, deletion is irreversible and your message history is not recoverable by anyone, including us. Second, messages you sent to other people exist on their devices; deleting your account removes our copy and yours, but cannot reach into someone else's phone.
09Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, to withdraw consent, and to data portability. We honour these regardless of where you live rather than only where we must.
- Access and portability: email privacy@kalvien.com and we will provide what we hold. Note that message content will be provided as the ciphertext we store, because that is genuinely all we have.
- Correction: profile fields are editable in the app. For anything else, contact us.
- Deletion: use the in-app option in section 8, which is faster than we could act on an email.
- Withdrawing consent: turn off notifications in Android settings; unsubscribe from waitlist email in one click.
- Objection and restriction: contact us and we will explain what we can do without breaking message delivery.
We respond to requests within 30 days. We do not charge for this, and we will not ask you to justify a deletion request.
If you are in the EEA or UK and you think we have got something wrong, you may complain to your local supervisory authority. We would rather you told us first, but that is your right and not conditional on it.
If you are in California, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for purposes beyond providing the service.
10International transfers
Our infrastructure and service providers operate internationally, so your data may be processed outside your country, including in the United States. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum with our providers.
The practical mitigation is stronger than the legal one: the content of your messages is ciphertext in every jurisdiction it passes through, so a transfer moves data nobody at either end can read.
11How your data is protected — and its limits
- In transit: all communication with our servers uses TLS.
- End-to-end encryption: messages, group content, and media are encrypted with libsodium (X25519 + XSalsa20-Poly1305) so only you and your recipients hold the keys.
- On-device keys: your private key is stored in Android Keystore-backed encrypted storage and is never transmitted or exportable.
- Passcodes are stored as hashes, never in a recoverable form.
- Rate limiting on verification codes: five per hour, ten-minute expiry.
No independent audit. Nobody outside our team has reviewed our cryptography or our implementation. We use a vetted library rather than writing primitives ourselves, which is a floor and not a substitute.
No forward secrecy yet. Today each pair of users shares one long-term key. If a device key were compromised, past messages with that person could be read. Signal rotates keys per message; we do not, and it is the top item on our roadmap.
Safety-number verification is unfinished. Because we distribute public keys, we could in principle hand out the wrong one. The check that would catch this is not yet usable in the app, so key distribution currently requires trusting us.
No screenshot blocking or biometric unlock. Someone with your unlocked phone can read your messages.
If you believe you have found a security issue, please write to security@kalvien.com. We will not pursue legal action against anyone who researches in good faith, avoids accessing other people's data, and gives us a reasonable chance to fix the issue before publishing.
12Children
Kalvien is intended for people aged 13 and over, or 16 and over where local law sets a higher age for consent to data processing. It is not directed at children under 13 and we do not knowingly collect their data.
If you believe a child under 13 has an account, contact privacy@kalvien.com and we will delete it. Our approach to child safety, including our zero-tolerance policy on child sexual abuse material, is set out in the terms of service.
13This website and the waitlist
This website sets no cookies, runs no analytics, and loads no third-party resources — no fonts, no CDN scripts, no tracking pixels, no embedded video. You can confirm all of that in your browser's network panel, and the homepage invites you to.
If you submit your email address to the early-access waitlist, we store:
- Your email address, so we can tell you when we launch.
- A timestamp, and a confirmation token for the double opt-in link.
- A truncated hash of your IP address, salted with a value that rotates daily. This lets us rate-limit signups from one source within a day without keeping an identifier that links you across days. We do not store your IP address itself.
- Your country, as reported by our CDN, and the referring page if your browser sent one.
We use this to send exactly one email when we open access, plus the confirmation email. There is no drip sequence and no newsletter. Unsubscribing removes your address. The waitlist counter shown on the homepage is a real count of stored signups — we do not inflate it, and we would rather show nothing than a number we made up.
14Changes to this policy
We may update this policy as the product changes — and given how much of it is a list of current limitations, we expect to. When we make a material change we will update the effective date and version at the top, and notify you in the app before it takes effect.
We will not quietly weaken a commitment. If something in the "what we cannot see" list ever moves to the "what we can see" list, that is a material change and it will be announced as one.
15Contacting us
- Privacy questions and rights requests: privacy@kalvien.com
- Security disclosures: security@kalvien.com
- Everything else: support@kalvien.com