Kryfo has no accounts, so there is nothing to attach data to. It never asks for your phone number, your email address or your name. It does not read your contacts. It has no analytics, no advertising and no tracking of any kind. Your messages are encrypted on your phone and can only be read by the person you sent them to.
What stays on your phone
Everything that matters. Your identity, your messages, your contacts, your media and your settings live in an encrypted database on your device and are never uploaded anywhere.
Your identity is three words generated on the phone the first time you open the app. Nothing is registered with anyone. If you delete the app, that identity is gone.
What our servers can see
Kryfo runs one relay so that messages can reach a phone that was offline. What it handles depends on which route you choose in the app, and the app tells you this before you choose.
- Onion. Messages travel through Tor. Our relay never learns your address. Neither does anyone else.
- Relay. Our relay sees the internet address you connect from, the same way any website does. Nobody else does.
- Fast. Our relay and a few public Nostr relays see the address you connect from.
On every route, what the relay carries is encrypted. It cannot read a message, and it cannot tell who is talking to whom. It holds encrypted data for a bounded window so an offline phone can catch up, and then discards it.
Our relay does not write connection logs to disk.
Handles
If you claim a public handle, our handle service stores that name, the invite it points to, the short description you wrote, and the key that claimed it. That is all. It keeps no record of who looked you up.
Claiming a handle is optional and off unless you do it. You can retire yours at any time.
Link previews
Off unless you turn them on. When they are on, your own phone fetches the title over Tor and sends it inside the encrypted message. The website you linked sees a request from the Tor network and nothing else. The person receiving the message never touches the link.
Photos and files
Photos taken inside Kryfo have their location, device details and timestamps removed before anything else happens, and they never appear in your gallery unless you choose to save a copy. Files you send are encrypted in pieces and travel the same way messages do.
Notifications
Kryfo does not use Google's push service, or anyone else's. The app keeps a connection of its own, which is slower on some phones and means no third party learns when you receive a message.
Donations
If you donate, the payment happens on a public blockchain, which is outside our control and outside this policy. We do not ask for your name or address, and a donation is not connected to your Kryfo identity unless you choose to link them.
This website
No cookies, no analytics, no third-party scripts, and no fonts loaded from anywhere else. The server does not log visitors.
Children
Kryfo is not directed at children. There is more on how the design limits contact from strangers in our child safety note.
Requests for data
If we are asked to hand over user data, there is almost nothing to hand over. We hold no message content, no contact lists, no phone numbers, no email addresses and no account records, because none of it is collected.
Changes
If this policy changes, the date at the top changes with it, and the previous versions stay in the git history of this site.
Who is responsible
Marios Staikoglou, Ostender Straße 9, 13353 Berlin, Germany. Full details are in the legal notice.
Questions
Write to gnosiworks@proton.me, or open an issue at github.com/GnosiWorks/Kryfo.