Privacy Policy

Last updated: September 10, 2026

This policy explains what Secure Chat ("we", "the service") stores when you use the app, and — just as important — what it can never see. The short version: your messages, photos, voice notes, and calls are end-to-end encrypted, and the server that carries them only ever handles ciphertext it cannot decrypt.

1. What we store

• Account basics: your email address (used as your login and unique ID), the display name you choose, an optional profile photo and "about" line, and your share code.
• Public encryption keys: your identity, signed, and one-time pre-keys. These are public by design (other users need them to encrypt messages to you). Your private keys are generated on your device and never leave it.
• Encrypted messages (ciphertext): the server temporarily relays and stores encrypted blobs until they are delivered. Delivered message data is purged within 30 days. The server has no ability to decrypt any of it.
• Encrypted media: photos, voice notes, and files are stored as encrypted blobs and automatically expire (about 30 days after upload).
• Push token: a Firebase Cloud Messaging token so we can wake your device when a message arrives. Notification previews are decrypted on your device.
• Bug reports: only what you choose to send us through the in-app "Report a problem" screen.

2. What we can never see

• The contents of any message, photo, voice note, or file.
• Your call audio or video — calls connect peer-to-peer (WebRTC); our TURN relay, when needed, forwards already-encrypted packets it cannot read.
• Your private encryption keys or your message history (history lives only on your own devices).
• Your contacts list — the app never reads your phone's address book.

3. Sign-in

You can sign in with a one-time code sent to your email, or with Google Sign-In. For email codes we use Resend to deliver the message (they process the email address for delivery only). For Google Sign-In we receive only your verified email address, name, and profile photo from Google's verification response. We do not request or receive your Google password, and we cannot post or read your Gmail.

4. Third parties we rely on

• Google — Sign-In verification and Firebase Cloud Messaging push notifications.
• Resend — delivery of sign-in code emails.
• Vultr — the virtual private server the service runs on (Singapore region).
• Cloudflare — DNS for the fcsecured.com domain.

We do not run advertising SDKs, analytics profiles, or crash-reporting SDKs, and we never sell or share your data with anyone.

5. Server logs

Standard web-server and error logs are kept briefly for troubleshooting and may include IP addresses and request timestamps. One-time codes are stored only as cryptographic hashes. We don't build behavioral profiles from logs.

6. Data retention and deletion

Undelivered encrypted messages are purged after delivery or expiry; delivered message data and media blobs are purged within 30 days. To delete your account (email, profile, public keys, and any stored blobs), use "Report a problem" in the app with the request, or contact us at the address below. Because message history and private keys exist only on your devices, deleting the app data on a device permanently removes that device's history.

7. Children

The service is not directed at children under 13.

8. Changes to this policy

If we change this policy we will update the date above and, for significant changes, notify you in the app.

9. Contact

Questions or deletion requests: use "Report a problem" inside the app, or email [email protected].