Privacy Policy

0. In short

The text of your messages is encrypted on your device and can only be read by the people you send it to. We cannot read it, and neither can Google, whose servers we rent.

What we can see is that a conversation happened: which accounts are in it, and when they were active. Removing that is harder than encrypting the contents, and we have not finished. This policy says exactly where the line currently is.

1. What is end-to-end encrypted

Encrypted on your device, unreadable to us and to Google:

• The text of your messages.
• The contents of files, photos, audio and video you attach.
• Link previews.
• Voice and video calls, which use WebRTC's mandatory DTLS-SRTP between the two devices.

Most one-to-one and group messages additionally use a ratchet, meaning each message has its own key, so compromising your device does not expose earlier ones. Conversations where someone's client has not published the newer key material fall back to a single long-lived key, which does not have that property. The label under a message tells you which one it actually got.

One thing crosses this line, and only when you ask it to: looking a name up on Wikipedia sends that one name, not the message it came from. Section 6 says who receives it, and the lookup runs on the tap and not otherwise, so there is nothing standing to turn off. Summarising, translating and transcribing would cross it too — they are switched off in this release, with no control anywhere in the app that turns them on.

2. What is not encrypted, and what we can see

Encryption protects contents, not the fact of a conversation. These sit in the clear on our servers:

• Who is in each conversation, and when it was created and last active.
• The timestamp of every message, and how many you have not read.
• An attachment's file name, type and size. The bytes are encrypted; the description of them is not, and the length of the ciphertext bounds the length of the original.
• Your friends and friend requests.
• Call signalling — that a call was placed, to whom, and when. Not its audio or video.

Typing indicators and read receipts are off unless you turn them on, and while off nothing is written.

What is no longer here: your email address and your name. Since September 2026 the account record holds only an account identifier — and since then there has been no address to hold anywhere. Signing up asks nothing about you: your account is a 24-word recovery phrase, and the credential Firebase Authentication checks is derived from it. What it stores is a random label under a domain that cannot receive mail.

Separately: because the app runs on Google Firebase, Google can see the IP address and timing of every connection your device makes to it. That is a property of the hosting, not of the app, and we cannot encrypt it away.

3. How people find you

They cannot search for you. There is no directory — no lookup by email, phone number or name — and the server refuses any query that tries.

You reach someone by sending them an invite link out of band, through whatever you already use. A link works once, expires after 24 hours, and can be withdrawn. Whatever you call someone is your own label for them, kept for you; if they introduced themselves, that name reached you encrypted.

4. What we collect

• Account data: an account identifier, and a credential derived from your recovery phrase, held in Firebase Authentication. No email address, no phone number, no name — sign-up asks for none of them.
• Message and attachment ciphertext, plus the metadata in section 2.

That is the whole list. There is no analytics and no crash reporting. The app used to send screen views to Firebase Analytics and crash reports to Firebase Crashlytics, both carrying your account identifier, so neither was anonymous; both are gone, along with the libraries that sent them. Errors are printed on a developer's own machine during development and go nowhere else.

5. Where it is stored

On Google Firebase — Firestore, Storage and Authentication — under security rules that decide who may read and write each document.

On your device, cached messages, settings and your app-lock PIN are encrypted with a per-device key held in the platform keystore (iOS Keychain, Android Keystore) rather than in ordinary app storage.

The private key that decrypts your messages never leaves your device, except as the recovery phrase you choose to write down. We do not hold it and cannot recover it for you. Lose it, and the messages sent to that device cannot be read again — by anyone, including us.

Versions 1.2.0 and earlier also saved a copy of the phrase to Google Block Store, Android's own backup, each time you signed in. If your phone had a screen lock, that copy was synced to your Google account, end-to-end encrypted. From version 1.2.1 the app no longer does this, and deletes that copy each time it starts.

6. Who else receives data

We do not sell, trade or rent your personal information. Data reaches:

• Google Firebase — our hosting provider, as described above.
• Cloudflare Realtime — the audio and video of a call, when your device and the other person's cannot reach each other directly.
• The Wikimedia Foundation — one name, when you tap it to look it up on Wikipedia.
• Google Cloud Speech-to-Text — the audio of one voice message, when you ask for a transcript.
• Google Cloud Translation — the text of one message, when you ask for a translation.
• Cloudflare Workers AI — up to the last 50 messages of one conversation, when you ask for a summary or ask a question about it.

The last three are switched off in this release. There is no control anywhere in the app that turns transcription, translation or summaries on, so nothing reaches those three services. They are listed rather than deleted because the code is still here and the features are meant to return — and when they do, they return with this disclosure and with a prompt before the first use. What would be sent then is sent to produce your result, not to train anything; neither a transcript nor a translation is stored on our servers.

The Wikipedia lookup has no switch because there is nothing standing to switch off: it runs on the tap and not otherwise. Wikipedia receives that one name and your IP address, the same as if you had typed it into their search box — no account, no message, no conversation. What comes back is shown and not saved, and nothing about it is written to the conversation.

Cloudflare Realtime has no switch either. Most calls do not need it: two devices that can reach each other directly — most calls on the same network — connect without it, and nothing is relayed. When they cannot, commonly because the two of you are on different mobile networks, the already-encrypted call is relayed rather than left unable to connect. What Cloudflare sees is both IP addresses, the call's timing, and roughly how much data moved; the audio and video stay under the same DTLS-SRTP encryption described in section 2, so relaying does not decrypt them.

We may disclose what we hold if the law requires it. What we hold is the list in section 2. We cannot produce message contents, because we cannot read them.

7. Push notifications

Firebase Cloud Messaging delivers notifications. Your device token is stored in a private part of your account that only you can read.

Notifications carry no message text. Your device decrypts the message locally and composes what you see; Google delivers the envelope, not the contents.

8. What you can do

• Delete your account from the Profile screen. Content that is jointly part of a conversation — a call record, for instance — stays with the other participant, because it is their record too.
• Export your data from the Profile screen.
• Set messages to expire per chat: 1 hour, 24 hours, 7 days or 30 days.
• Turn typing indicators and read receipts on or off. Both are off by default.
• Lock the app with a PIN or biometrics.
• Withdraw an invite link you have handed out.

If you would rather we deleted something by hand, write to us.

9. Retention

We keep your data while your account exists. Deleting the account deletes it, except for the jointly-held content noted above. Per-chat expiry removes messages on the schedule you set.

10. Limits you should know about

We would rather tell you these than have you find them.

• Keys are trusted the first time they are seen. If someone substituted a key before you ever exchanged a message, the conversation would be encrypted to the wrong person and would look entirely normal. The app warns you when a key changes afterwards, and shows a safety number you can compare out of band — but nothing forces you to compare it.
• One device at a time. Your recovery phrase restores the key that opens your history, so signing in on a new device does not lose what you already received. Forward-secret conversations use a second key that never leaves the device that created it: whichever device signed in last is the one they reach, and anything sealed to the other one in the meantime cannot be moved across.
• Messages sent before encryption existed stay as they were. Nothing was converted retroactively.
• This app has not been independently security-audited.

11. Children

Chatterbox is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes

We may update this policy. Significant changes will be announced in the app, and the date at the top is when it last changed.

13. Contact

Questions about this policy: [email protected]

14. Checking for a newer app version

Google Play is not the way this app reaches your Android phone. It is downloaded from chatterbox.fans instead, and a store that isn't in the loop cannot check for updates on your behalf — so this app can, if you ask it to.

Tapping "Check now" sends one request to chatterbox.fans asking which version is current. That request carries your IP address and nothing else — no account, no device identifier, no message. What comes back is a version number, compared on your phone against the version you're running; nothing is downloaded automatically, and nothing about the check is written to the conversation.

This has no switch because there is nothing standing to switch off: it runs on the tap and not otherwise.

If you install the update, it replaces the app in place using the same signing key, the same way an update from Google Play would.