Privacy Policy

Our principles

• No ads. We do not sell your personal data or use it for advertising.
• Data minimisation. We collect only what we need to run and secure the service.
• Encryption by default. Message content is designed to be unreadable to us.
• The service does not keep access or connection logs.

What we collect and store

Account data

Identifiers you choose or provide (for example your username and your Private.Ki email address) and the authentication data required to sign you in. Your password itself is never sent to us; sign‑in uses the OPAQUE protocol.

Encrypted content you store

Emails, messages, attachments and related data such as your display name, addresses you have written to and your signatures — stored in encrypted form on our systems, attachments at our storage provider (see "Mobile app" below), so the service can function. Your recovery address, if you set one, is kept only as a salted hash; we cannot read it back.

Routing and service metadata

Information needed to deliver messages and operate the service: sender and recipient addresses or identifiers, timestamps, message size, delivery status, group membership. For external messages, the headers as received.

Security and anti‑abuse data

In limited cases, data needed to prevent abuse: a keyed hash of your IP address in a rate‑limiting counter that expires within an hour (one daily counter for the no‑sign‑up entry keeps it up to 24 hours). The service does not keep access or connection logs.

Support data

Anything you send to support and, if you choose to report abuse, the information included in that report.

Cookies and local storage

Essential session and security storage for the web app, and limited diagnostics if enabled. The marketing site stores only your theme preference.

Mobile app

If you use the Private.Ki app for Android, the following also applies.

• Push notifications. Notifications reach your phone through Firebase Cloud Messaging (Google). The phone's FCM registration token is stored with your account so we can address them. A notification carries no message content — only the title "Private.Ki", a generic body ("New chat message" or "New email") and a message identifier, so the app knows what to open.
• Attachments. Encrypted attachments are stored as ciphertext at an object‑storage provider. They are reached only through our servers; the provider never sees a key or a file name.
• On your device. The app keeps your session, keys and settings in Android's Keystore‑backed secure storage, which is excluded from Android backups. Message content is held decrypted in memory only while the app runs.
• Calls. Calls connect directly between the two devices, with no relay through our servers, so each party's device learns the other's IP address. Call content is end‑to‑end encrypted.

Encryption and what we cannot see

• Message bodies and attachments are encrypted on your device so that we cannot read them.
• Some metadata remains visible because a communication service must route and deliver messages — addressing and delivery signals in particular. We publish the full list.

How we use data

• Provide, maintain and secure the service.
• Prevent spam, abuse, fraud and technical attacks.
• Troubleshoot, improve reliability and provide support.

Data retention and deletion

We keep your data only as long as needed to provide the service and keep it secure. You can delete messages using in‑app controls. You can delete the account itself in the app, under Settings → Security and privacy → Privacy and data; it takes two confirmations and removes everything stored under the account from our active systems. See Delete your account for what is deleted, what cannot be reached, and what is kept and for how long. After deletion the address stays reserved so that nobody can register it and receive mail meant for you.

Invitations

If you receive an invitation link or QR code, we process and may store the invitation token and the security and technical data needed to deliver the invitation and protect the service.

Your choices and rights

Depending on your location, you may have rights to access, correct, export, restrict, object to the processing of, or delete your personal data. Almost all of them are controls in the app, under Settings → Security and privacy → Privacy and data:

• What we hold about you — every category of data stored under your account, counted when you open it, each with how long it is kept (access, Article 15).
• Download my data — the account data as one file (portability, Article 20). Message content is not in it: it is encrypted with keys we do not hold, and each message can be saved from the app itself with Show original.
• Pause my account — nothing goes out and your public key stops being published, incoming mail still arrives, nothing is deleted, and it can be undone (restriction, Article 18).
• Delete my account — see above (erasure, Article 17).
• What you have agreed to — withdraw the consents we store: publishing your public key, and browser notifications (Article 7(3)).

Your display name, recovery email address and other account details can be corrected in Settings. For anything the app cannot settle, write to us at [email protected] from the account concerned — that is how we verify the request comes from its owner, since we hold no name or identity document. We answer within the one‑month period data‑protection law sets. GDPR data request in the help center maps every right to its control.

If you believe we have not handled your data lawfully, you may lodge a complaint with the supervisory authority of the country you live or work in — in the United Kingdom, the Information Commissioner's Office.

Representatives in the EU and the UK

Private.Ki is not established in the European Union or the United Kingdom and has appointed a representative in each.

• EU Representative (Article 27 GDPR): Europe Services, SE, Na Čečeličce 425/4, 150 00 Prague 5, Czech Republic — [email protected]
• UK Representative (Article 27 UK GDPR): REP27 LTD, a company registered in England and Wales, no. 17385889 — [email protected]

Data subjects and supervisory authorities may contact our representatives on any matter relating to the processing of personal data. Please write to them only about data protection, and only when the matter could not be settled with the controls in the app or by writing to our support team — GDPR data request explains every control, which right it answers and where to find it. They cannot help with support questions, abuse reports or account access.

Changes

We may update this policy. The updated version becomes effective when posted on this page.