Kryfo has no accounts, so there is nothing to attach data to. It never asks for your phone number, your email address or your name. It does not read your contacts. It has no analytics, no advertising and no tracking of any kind. Your messages are encrypted on your phone and can only be read by the person you sent them to.
What stays on your phone
Everything that matters. Your identity, your messages, your contacts, your media and your settings live in an encrypted database on your device and are never uploaded anywhere.
Your identity is three words generated on the phone the first time you open the app. Nothing is registered with anyone. If you delete the app, that identity is gone.
What our servers can see
Kryfo runs two relays that carry messages, at two different hosting companies, so messages also reach a phone that was offline. What they see depends on which route you choose in the app, and the app tells you this before you choose.
- Private. The default. Messages travel through Tor to both of our relays, each through its own onion, and to a few public Nostr relays. No relay and nobody else learns your address.
- Fast. Skips Tor to be quicker. It connects straight to our two relays, which see the address you connect from while you are connected and do not write it down. Each message goes to both, so one can stop without messages stopping. While the first is down, Fast also uses a few public Nostr relays, only through Tor, so they never see your address.
On both routes, what the relays carry is encrypted, and no relay can read a message. Each conversation has its own mailbox address, which is not your identity or anyone else's. Messages are padded to one of five sizes, so a relay sees roughly how big a message is, not how long, though how many you send and when still shows. On Fast, each of our relays sees which mailboxes one IP address reads and writes, and when both people in a chat use Fast, that two IP addresses share a mailbox. Burner rooms, pair codes and the address in your invite go through Tor on both routes. With a handle on Fast, our relay could still tie the handle to your IP address by timing the first messages of a new chat. Our relays keep encrypted messages for 14 days so an offline phone can catch up, and then delete them.
Our relays do not write connection logs to disk.
Asking the Tor Project for bridges is optional, and Kryfo only does it once you say yes. The question goes outside Tor, since Tor may be blocked where you are. It travels through a content delivery network, so your internet provider sees a connection to that network, not to the Tor Project. That network and the Tor Project see the address you connect from, and that someone asked for bridges. Nothing about your chats. Separately, once Tor is connected, Kryfo checks about once a week for changes to the bridges that come with it. That check goes through Tor, so it shows nobody your address, and it needs no yes. There is more on When Tor is blocked.
Handles
If you claim a public handle, our handle service stores that name, the invite it points to, the short description you wrote and the key that claimed it. It does not store when the handle was claimed. If you turn on “Show me in search”, it also stores the name you chose for search and that your handle is listed. The time of your last change, and of when you last switched search on or off, is kept for about 20 minutes to refuse a replayed change, and then cleared. It keeps no record of who looked you up. What you type into search is sent to it to find handles, and is not kept.
Claiming a handle is optional and off unless you do it, and so is showing up in search. You can retire your handle at any time. That deletes its entry at once. The server keeps one backup copy a day and deletes each copy once it is a week old, so no copy of a retired handle is left after 8 days.
Only handles whose owner turned on “Show me in search” come up, next to a name if they picked one, and turning it off takes you out at once. Everything the app asks the handle service and the badge service goes over Tor on every route, also on Fast, so neither ever sees your IP address.
The developer chat
From Kryfo 0.5.0, the “Marios · built Kryfo” chat at the top of your chat list goes to the person who builds the app. Marios's key is built into Kryfo, so nobody else can answer in it. Nothing connects and nothing is sent until you write the first message: no hello, no app version, no logs.
Marios can read what you send there, and when, and write back like any contact. Your three words go with it; the face you picked, your onion address and any supporter badge do not. “Write anonymously” instead makes a new name and keys for that chat alone, which stay on your phone, are left out of backups and are used nowhere else. It hides your three words, not your writing style, what you write there, or the address you connect from on Fast.
Voice notes in an anonymous chat always go through the voice disguise. Deleting the chat deletes it on your phone, and takes back what you sent from Marios's phone, the same way taking back a single message does. If his phone cannot be reached within half a minute, the app tells you how many could not be taken back. A message he already read has been read.
Link previews
Off unless you turn them on. When they are on, your own phone fetches the title over Tor and sends it inside the encrypted message. The website you linked sees a request from the Tor network and nothing else. The person receiving the message never touches the link.
GIF search
Off unless you turn it on. When it is on, the words you search for go to our server, which asks GIPHY or Klipy for you. The GIFs come back through our server too. How they travel depends on your route:
- Private. Through Tor, on a circuit of its own. Our server sees a request from the Tor network, never your address.
- Fast. Straight to our server, without Tor, as your messages go on this route. Our server sees the address you connect from and the words you searched, and writes neither down. No public relay is involved.
Our server keeps no record of what was searched or by whom, and passes no address on. GIPHY and Klipy only see our server asking, with the search words and the app's language. They never see your address, your phone, or who you send a GIF to. The GIF you pick is sent inside the encrypted message, like a photo.
Photos and files
Photos taken inside Kryfo have their location, device details and timestamps removed before anything else happens, and they never appear in your gallery unless you choose to save a copy. Photos, videos, voice notes and files bigger than one message go through our files service once everyone in the chat has a version that uses it. Your phone seals each file with a key of its own, and the key travels only inside the encrypted message, so the service holds bytes it cannot open. It is reached through Tor on both routes and never sees your address. It knows a file's random ID, its size rounded up, how many recipients it has, and when it went up and came down. A file is deleted once every recipient has it, and nothing stays longer than a week.
Notifications
By default Kryfo uses no push service. The app checks for messages itself, over the same route it sends on, and nobody outside the app is told that a message is waiting for you. In Notifications you can pick one of two other ways instead.
- Through a helper app. Off by default, and only on Private. A UnifiedPush helper app, such as ntfy, keeps one connection for all your apps, and our relay knocks on it when something arrives for you, with an empty request: no sender, no count, no content. Kryfo then fetches over Tor as always. Our relay keeps sixteen addresses on the helper's server for you, for at most 30 days. The helper's server sees your phone's IP address, that you use Kryfo, and when it is knocked, with fake knocks mixed in. It never learns what a message says, who sent it or how many came.
- Google push. Only in the Google Play version, on phones with Google Play services. Nothing of Google's runs until you pick it. Picking it asks Google for one token for this phone. Our relay holds it in sixteen separate seals it cannot open or tie together. The push service that opens them runs on our second server. The two servers together could tie the sixteen together and see the token, which Google can match to your phone and your Google account. Seizing one is not enough, but we run both, so we could. If that matters to you, pick another way. Google sees that this phone uses Kryfo, when it is woken, with fake wake-ups mixed in, and your phone's IP address, as it always does for Play services. It never sees who wrote, what was said or how many. The push service keeps nothing on disk and logs nothing per phone, and Firebase's analytics, advertising ID and delivery metrics are switched off in the app.
Backups
A backup is a file on your phone, encrypted with a passphrase only you know. It never goes to us. From Kryfo 0.5.1 it also carries your privacy settings: block screenshots, voice disguise, hidden previews, scam shield, introductions, how messages are delivered, the theme and the language you picked. It never carries a PIN.
Donations
If you donate, the payment happens on a public blockchain, which is outside our control and outside this policy. We do not ask for your name or address, and a donation is not connected to your Kryfo identity unless you choose to link them.
Tips in the Google Play version are paid through Google Play. Google handles the payment, and we never see your card details or your name. Google's sales reports show us each tip's order number, amount, date and country, and for some countries the region, city or postcode.
This website
No cookies, no analytics, no third-party scripts, and no fonts loaded from anywhere else. The server does not log visitors.
Children
Kryfo is not directed at children. There is more on how the design limits contact from strangers in our child safety note.
Delete your data
There is very little to delete, and most of it you can delete yourself, at once.
- On your phone. Deleting a chat deletes it. “Wipe Kryfo from this phone”, under Danger zone in Settings, deletes everything Kryfo holds on this phone. Uninstalling the app does the same.
- Your handle. Open your handle in the app and choose “Delete this handle”. The entry is deleted at once, and the server's daily copies are gone within 8 days.
- The developer chat. Deleting it takes back what you sent from Marios's phone. For anything that could not be taken back, or anything you sent by email, write to gnosiworks@proton.me. It is deleted, and you get a short confirmation.
- Messages to other people. They are on their phones, not ours. Take a message back in the chat, and it goes from their phone too.
- Relays and files. Our relays keep encrypted messages for 14 days, so a phone that was offline can still get them, and then delete them by themselves. A few public Nostr relays carry copies too, each marked to be deleted after 14 days. No relay can read them. Big files on our files service are deleted once every recipient has them, after a week at most.
- Donations. A payment on a public blockchain cannot be deleted by anyone.
Requests for data
If we are asked to hand over user data, there is almost nothing to hand over. We hold no contact lists, no phone numbers, no email addresses and no account records, because none of it is collected, and no message content apart from what people send to the developer chat. The one exception is Google push: what our two servers together could link, as described under Notifications.
Changes
If this policy changes, the date at the top changes with it, and the previous versions stay in the git history of this site.
Who is responsible
Marios Staikoglou, Ostender Straße 9, 13353 Berlin, Germany. Full details are in the legal notice.
Questions
Write to gnosiworks@proton.me, or open an issue at github.com/GnosiWorks/Kryfo.
In Settings, “Report an issue” lets you write to us from the app. “Write in Kryfo” sends it to the developer chat, described above. “Send an email” opens your own mail app, and the email then goes through your mail provider and ours (Proton), like any email.