Privacy

At a glance

/ summary

GChat is a messenger. We move end-to-end encrypted ciphertext between devices. Your messages and calls are not readable by us, by our hosting provider, or by anyone intercepting traffic to our servers.

This page describes, in plain language, what data touches our systems and for how long. If you only read one paragraph, read the previous one: everything else is a technical elaboration of the same claim.

Identity & handles

/ your account

GChat does not require a phone number. To create an account you pick a handle (for example @dragekorn) and your device generates a long-term cryptographic identity — one Ed25519 signing key and one X25519 key-exchange key. The private halves of these keys are stored only on your device. We never see them and cannot derive them.

You also receive a one-time recovery word. That word is the only way to restore your account on a new device. We do not store it either — if you lose it, your account is unrecoverable. This is the cost of not trusting us.

What we store on our server about your account

• A random user ID.
• Your chosen handle and display name.
• Your public identity keys.
• A rotating set of one-time public pre-keys used to start new sessions.
• An opaque device token used to route pushes (if you opt in).
• Your device sessions. A session that stays unused for 90 days expires automatically and the device has to sign in again.

Messages & calls

/ the hot path

Every message is encrypted on your device with a per-message symmetric key derived from a Double Ratchet session initialised with X3DH. Our server sees a recipient user-ID, a delivery timestamp, and an opaque ciphertext blob. It stores the blob only until your peer's device acknowledges it, then drops it.

Voice and video calls use the same ratcheted key material to negotiate the media session. Audio and video streams are end-to-end encrypted. Our relay only forwards already-encrypted RTP packets.

When two devices cannot connect directly, the call goes through a relay: our own TURN servers or, for some calls, our own LiveKit media server. The relay forwards encrypted media and cannot decode it; the keys are exchanged inside your end-to-end encrypted session. Like any relay, it sees the IP addresses of the participants and the timing and volume of the traffic. We do not fall back to third-party public TURN servers.

For every call the server keeps a call record — who called whom, audio or video, and when the call started, was answered and ended — so that ringing, missed-call notices and call history work.

Photos, voice and video

/ attachments

Attachments (photos, voice notes, video rounds) are encrypted on your device with a one-time AES-GCM-256 key. The ciphertext is uploaded to our server; the key itself is packaged inside the end-to-end-encrypted chat message and never touches the server in the clear.

Every uploaded blob has a time-to-live (default 7 days). A background janitor process deletes expired ciphertext automatically, and we publish deletion metrics on our status page.

Chat backups

/ opt-in, encrypted on your device

Chat backup is off by default. If you turn it on (Settings → Chat backup), your device packs your chats — and, if you choose, the media already on the phone — into an archive and encrypts it with AES-256-GCM using a random backup key that is generated on your device. Only the encrypted archive is uploaded to our server. We cannot read it.

• Key: the backup key is also stored on our server wrapped (encrypted) with your recovery word, so you can restore on a new phone. Without the recovery word it is useless to us.
• Optional cloud key storage: if you turn on "Keep keys in iCloud / Google account", your account keys and backup key are saved in your iCloud Keychain (iOS) or Google Block Store (Android). That storage belongs to your Apple or Google account and is governed by their privacy policies — we have no access to it. Anyone who controls that Apple / Google account and your phone passcode could restore your GChat account; leave the option off if that matters to you.
• What we store: only your latest backup (each new backup replaces the previous one), its size, creation time and whether it includes media. Each account has a storage quota (currently 2 GB); unfinished uploads are cleaned up within 24 hours.
• Deletion: you can delete the backup from the server at any time in the app (Delete backup from server) or by emailing us. It is deleted automatically with your account.

Search & discoverability

/ what others can find

• People: if "Allow search by this nickname" is on (it is on by default; switch it off in Settings → Privacy or when you pick your handle), other users can find you by handle or display name and see your public profile. Turning it off removes you from people search; people who already know your exact invite link or have you as a contact can still reach you.
• Public channels and groups: their name, description, avatar and member count can be found by any user. Posts in public channels can be found by any user through global search.
• Private channels and groups appear only in their own members' search results.
• Search queries are sent to our server to produce results. We do not keep a search history.

Profile, stories & safety

/ not end-to-end encrypted

Some things are shared by design and are stored on our server without end-to-end encryption:

• Profile: handle, display name, bio, avatar (and earlier avatars you chose to keep).
• Stories: photos and videos you post as stories, visible to your contacts, plus who viewed or reacted.
• Channels: channel posts (text and media), their reactions and view counts are stored on our server and are not end-to-end encrypted. We can technically read them, like any public broadcast. Treat a channel as a publication, not a private chat.
• Groups and channels: names, descriptions, avatars, member lists and admin roles. Private group chats themselves stay end-to-end encrypted.
• Playlists: audio you upload to playlists.
• Contacts and safety: your contact list, message requests (who asked whom and whether it was accepted), the users you block, and reports you send. A report stores the reason, what was reported and any details you add. When you report a message, the text of that message is sent to our moderators from your device, because we cannot decrypt it ourselves. Reports are kept for moderation.
• Join requests: when you ask to join a group or channel, its admins see your profile and the optional message you attach (up to 200 characters).
• Call quality: technical statistics (bitrate, packet loss, round-trip time, codec, network type, platform, app version and device model) used to diagnose calls — never call audio or video.
• Notifications: a push token, delivered through Apple Push Notification service or Firebase Cloud Messaging. Pushes for chats contain no message text — only the sender's name and the kind of message (for example "Photo"), or a call notice. Pushes for channel posts may include a preview of the post, because channel posts are not end-to-end encrypted.
• Location: a pin on the map and live location sharing travel to the other person inside an end-to-end encrypted message — our server neither sees nor stores the coordinates. Live sharing runs only for the time you picked (15 minutes, 1 hour or 2 hours) and can be stopped at any moment. Map images are loaded through our server so that the map provider does not see your address; the server sees which map area was requested but does not keep it in the database.
• Silent mode: when Do Not Disturb or a Focus is on, the server keeps a single “notifications silenced” flag (for at most 24 hours) so that people you talk to see it in the chat. We do not learn which mode it is. You can turn this off in Settings → Privacy.
• Stickers: the list of sticker and emoji packs you added.

Metadata we touch

/ unavoidable

To route messages, our server unavoidably sees the following non-content metadata:

• Your user ID (random, not your phone number).
• Recipient user IDs.
• Timestamp of each delivery.
• Size of each ciphertext.
• Your device's current IP address at connection time.

We do not store IP addresses in our database. Connection-level IPs exist only in volatile memory during an active session. For rate limiting (sign-up, sign-in, recovery, invite links) we use a salted hash of the IP whose salt changes every day; these counters expire within 24 hours. Server logs of individual security-relevant events may contain an IP address and are used only to investigate abuse.

Retention & deletion

/ how long

• Messages: deleted from our server within seconds of delivery acknowledgement. Undelivered messages are held up to 30 days, then purged.
• Media: deleted within the TTL window (default 7 days).
• Call records and call-quality statistics: kept for call history, diagnostics and abuse handling. After you delete your account they are no longer linked to any name or handle.
• Chat backup: only the latest backup is kept; it is replaced by the next one and deleted when you delete it or your account.
• Channel posts: kept until the author or a channel admin deletes them or the channel is deleted.
• Reports: kept for moderation and legal obligations, including after either account is deleted.
• Device sessions: expire after 90 days without use.
• Server backups: our database is backed up daily for disaster recovery; we keep the last 7 daily and 4 weekly copies, so data deleted from the live system can remain in these copies for up to about five weeks before it rotates out. These copies are access-restricted and used only to restore service. Uploaded files (media, avatars, stories, audio, chat backups) are stored on our own servers' file storage, not in the database dumps.
• Stories: removed when they expire, unless you pin them to your profile; you can delete any of them at any time.
• Account: you can delete your account from the app at any time. Deletion erases your profile, keys, devices, stories, playlists, contacts, chat backup and any still-undelivered messages. See how to delete your account for the full list, including how to request deletion without the app.

Lawful requests

/ transparency

If we receive a lawful order compelling disclosure of data, we respond with exactly what we can produce — which, by design, is very little: your user ID, handle and profile, the timestamps of your most recent connections, call records, and content that is not end-to-end encrypted (such as channel posts). We cannot produce message contents, call contents, the contents of chat backups, or past message metadata, because we cannot decrypt the first three and do not retain the last.

We commit to publishing a transparency report twice a year covering any requests received.

Children

GChat is not directed at children under 13. We do not knowingly collect data from children. If you believe a minor has registered an account, contact us and we will delete it.

Changes to this policy

Any material change to this document will be announced inside the app and recorded in the project's public repository. The "Last updated" date at the top of the page is authoritative.

Contact

Questions, concerns, or security findings: privacy@gchat.tech. Security-specific disclosures should follow the process in our security.txt.