Privacy Policy

Project Civilo is the controller of the limited personal data described here. Civilo is run by an individual as a non-commercial project, not by a company. For any privacy question, request, or complaint, write to support@civilo.co. We answer from the same address that receives it.

Account identifiers. When you create an account, your device generates a random identifier and a set of cryptographic keys. Private keys never leave your device. We receive the random identifier, your device records, and your public key material, which others need in order to open an encrypted session with you. You may also claim a short handle (a "CPIN") so people can find you by code; we store the mapping from that handle to your account identifier.

Profile. Your display name and avatar are stored on your device and transmitted only inside end-to-end encrypted messages to people you communicate with. We never receive them, and there is no profile record on our servers.

Correspondence. If you email support, we receive whatever you put in that email, including your email address. We keep it only as long as needed to deal with the matter.

Message routing data. While a message waits to be delivered, the encrypted queue entry carries the routing metadata the server needs: sender and recipient account identifiers, device identifiers, a timestamp, and the size of the ciphertext. It is deleted as soon as the recipient's device confirms receipt. We keep no record of delivered messages, and there is no database, table, or feature anywhere in the Service that stores a contact graph or a history of who has communicated with whom.

We want to be precise rather than flattering about the limits of that claim. Two traces of routing exist even though no such database does. A message that is never collected stays queued, with its sender and recipient identifiers, until it is; we delete unclaimed queues periodically rather than on a guaranteed schedule, so treat 30 days as our intent rather than an automated certainty. And the technical logs in the next paragraph record request paths, some of which contain an account identifier, alongside the IP address that made the request. Anyone with access to those logs could reconstruct some routing for as long as the logs are kept. They are short-lived and access to them is restricted, but a policy that claimed otherwise would be overstating what the software does.

Message content. Encrypted with the Signal protocol, including post-quantum prekeys. We hold no decryption keys and cannot read message content, at any point, by any means available to us. Group names and membership exist only on members' devices.

Attachments and stickers. Encrypted on your device with a fresh key before upload. Our storage holds an opaque blob; the key travels only inside the encrypted message. Blobs are deleted automatically 30 days after upload.

Calls. Call setup travels inside the encrypted messaging channel, and call media is encrypted in transit. During setup your device contacts a public STUN server operated by Google, which observes your IP address at that moment. Calls may also be routed through our relay — always for people you have not accepted as contacts, and for every call if you turn on "always relay," which additionally hides your IP address from the person you are calling. The relay sees your IP address and account identifier for the duration of a call, and never call content.

Push notifications. We store one push token per device. Notifications are sent as contentless wake signals through Apple and Google: the payload contains no message content and no sender identity. Your device fetches the encrypted message, decrypts it locally, and composes the notification text itself.

GIF search. Proxied through our server. The GIF provider receives your search text from our server's address, never your IP address, account, or device details. Our server can see which account searched for what; those queries are used to return results and enforce rate limits, and are not profiled or retained as a history.

Technical logs. Our servers keep standard request logs — IP address, request path, timestamp, response status — for security monitoring, abuse prevention, and debugging. They are rotated and deleted on a short cycle, and are never used for advertising, profiling, or analytics.

This list is a design commitment, not an oversight. The Service contains no code that would gather any of it:

• Your phone number, email address, or legal name.
• Your address book. With your permission the app reads contacts on your device to show familiar names; nothing from it is uploaded, in any form, hashed or otherwise, and there is no server-side contact discovery.
• The content of messages, calls, files, or group memberships.
• Your location. Location is captured only if you explicitly share it in a chat, and travels end-to-end encrypted. There is no background tracking.
• Analytics, usage statistics, crash telemetry, advertising identifiers, or any tracking SDK.
• Biometric data, precise background location, or contact lists from other apps.

Link previews are fetched by your device when you paste a link, not by our server and not by the recipient's device. The site you link to sees an ordinary request from you.

If you are in the European Economic Area or the United Kingdom, the UK GDPR and GDPR require us to name a legal basis for each purpose:

We do not use personal data for advertising, profiling, automated decision-making with legal or similarly significant effects, or any secondary purpose unrelated to running the Service.

We do not sell personal information, share it for cross-context behavioural advertising, or disclose it to data brokers. We have never done so. Data reaches the following providers only to the minimum extent the Service requires:

We may also disclose information in connection with a legal demand as described in section 11. There is no analytics provider, advertising network, or marketing platform in this list because the Service integrates none.

Our servers are in the United States. If you use Civilo from outside the United States, the limited data described above is transferred there. Where data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) as incorporated into our providers' terms, together with the fact that message content, attachments, and call media are encrypted end-to-end and unreadable by any provider handling them.

Everything else — your messages, media, contacts, groups, and settings — is stored on your device and kept until you delete it or reset the app.

Message content, attachments, and call media are end-to-end encrypted using the Signal protocol with post-quantum prekeys, so their confidentiality does not depend on our servers being secure. Private keys are generated on your device and held in platform secure storage (the iOS Keychain and the Android Keystore); they are never transmitted. Connections use TLS. The server process runs unprivileged and confined, administrative access requires identity-based authentication and is logged, and no inbound remote-shell path is exposed.

No system is perfectly secure, and we make no guarantee that the Service will be free from vulnerability or interruption. You are responsible for the security of your devices, which is where your messages and keys actually live.

If you believe you have found a security vulnerability, please report it to support@civilo.co before disclosing it publicly.

If a breach of the data we hold occurs and it is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it, and notify affected users without undue delay, using the contact channel available for the account and a notice on this site. The scope of any such notice is bounded by what we actually hold: message content, media, and contact lists are not ours to lose.

We will disclose data only where we are legally required to, and only the data we actually hold. We will not voluntarily hand over user data to law enforcement absent valid legal process, and where we are lawfully permitted to notify a user of a demand, we will try to do so.

Because of the architecture described above, there are categories of data we cannot produce in response to any demand, however lawful, because they never exist on our systems: message and call content, your contact list, your group memberships, your message history, your display name, and the decryption keys for any of it.

Depending on where you live, you may have some or all of the following rights over personal data we hold: access, correction, deletion, restriction of processing, objection to processing based on legitimate interests, portability, and withdrawal of consent (which does not affect processing already carried out).

To exercise any of them, email support@civilo.co from any address, including your CPIN or account identifier so we can locate the records. We respond within 30 days, and within 45 days for requests under US state privacy laws, extendable once where the law allows. We do not charge a fee, and we will never discriminate against you for exercising a privacy right — there is no worse tier of service to relegate anyone to.

A caution specific to end-to-end encryption: we can verify only that a request comes from someone who controls the account identifier given. We cannot verify your legal identity, because we never learned it. Where a request would require us to disclose data to someone we cannot authenticate, we will decline rather than risk handing an account to the wrong person.

Deleting your account. Resetting the app (Settings → Reset This Device) destroys the keys on your device and makes the account permanently unusable; there is no recovery, by design. To have the server-side records deleted as well — account identifier, public keys, CPIN, device records, push tokens, and any stored encrypted blobs — email us and we will do it.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

Most US state privacy statutes apply only to businesses above revenue or data-volume thresholds that a free, non-commercial project run by one person does not meet. This section therefore describes how we handle these rights where such a law applies to us, and, where it does not, the practice we choose to follow anyway. It is not an admission that any particular statute governs the Service.

California (CCPA/CPRA). In the twelve months preceding this policy's date, we collected the following categories of personal information, for the purposes and from the sources described above: identifiers (a randomly generated account identifier, device identifiers, push tokens, and IP addresses in technical logs) and internet or network activity information (request logs). We collect this from you and from your device's interaction with the Service. We disclose it for business purposes only to the service providers listed in section 6.

We do not collect sensitive personal information as defined by the CPRA, we do not sell personal information, and we do not share it for cross-context behavioural advertising. Because we do neither, there is no "Do Not Sell or Share My Personal Information" mechanism to offer — the answer is already no for everyone. California residents may exercise rights to know, delete, correct, and limit through the contact address above, and may use an authorised agent.

Other states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comparable laws have analogous rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. We conduct none of those three activities. To appeal a decision we make on a request, reply to our response and say so; we will review it and explain the outcome in writing.

Global Privacy Control. We honour browser-based opt-out signals such as GPC. In practice they change nothing, because the site sets no advertising or analytics cookies and there is no sale or sharing to opt out of.

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 13, or under the minimum age at which your local law permits consent to data processing without parental authorisation. You must be at least 13 to use Civilo. If you believe a child has provided us with personal data, write to us and we will delete the account's server-side records.

This website sets no cookies. It runs no analytics, embeds no third-party scripts, fonts, or trackers, and loads nothing from any other domain. It is a handful of static files, and it stores nothing on your device — no cookies, no local storage, no session storage, no fingerprinting.

That is why you will not see a cookie consent banner here. Consent requirements apply to storing or reading information on your device, and there is nothing to consent to. A banner asking permission for cookies that do not exist would be theatre, and we would rather the absence of one told you something true.

The web server does keep ordinary access logs, as described in section 3. Those record your IP address and the page you requested, are kept briefly for security and debugging, and are not used to build any profile of you.

If we change this policy we will post the revised version here and update the date at the top. If a change materially reduces your privacy protections, we will give notice in the app or on this site before it takes effect, and where the law requires consent for the change, we will ask for it.

Project Civilo — support@civilo.co