Hitodor Chat Privacy Policy
Effective 26 October 2026 ยท applies to the Hitodor Chat apps for Android and iOS
Hitodor Chat is a private messenger. It is built so that we do not need to know who you are, who you talk to, or what you say. This policy explains what little data exists, where it lives, and how long it is kept.
Who is responsible
Hitodor, Munich, Germany ("we"). Contact, including for data-subject requests: hitodorprivacy@outlook.com.
No account, no phone number needed, no email
You do not register with us. Your identity is a cryptographic key created and kept on your device. We never ask for your name, phone number, email address or contact list to sign you up or to identify you, and Hitodor Chat never uploads your contacts. If you choose to, you can type your own phone number into your Card settings: we do not check it, and it is published as part of your Card, readable by anyone who can open your Card and by our Card service, only while "Share my phone number" is on.
Your messages and media
- Messages, photos, videos, voice notes and Circle (group) conversations are end-to-end encrypted on your device. Only the people you are talking to can read them. We cannot.
- Our relay servers delete each encrypted envelope within a day of its expiry, and none is kept for more than 31 days. Messages in your conversations are deleted within an hour of your phone confirming it has them. Some deliveries, such as those that bring you an introduction or the Card of someone you have been introduced to, are kept until they expire even after your phone has collected them. Encrypted attachments expire after at most 30 days.
- Backups of the relay servers that hold your encrypted envelopes are not yet in place. When they are, each backup will be deleted within 35 days, and this page will say so before they start.
- Photo and video location metadata is removed on your device before anything is encrypted and sent.
Contacts and invitations
- A contact is added only when an invitation is accepted, or when you approve a request made from your card. No server receives your contact list or your social graph, and we do not store one. Like any messaging service, our servers see, and for a limited time keep, when encrypted messages and deliveries come and go, and that timing can show who is in touch with whom. When a contact introduces you to someone, it can link you, that person and the contact who introduced you. Our rules forbid us from analysing it to work out who knows whom. That is a rule we keep, not something the technology prevents.
- Our invitation service stores an encrypted invitation, its signed offer, a use count and its expiry. It is deleted when the invitation expires (at most 7 days) or is revoked. It never stores who received or accepted it.
- If you publish a card or handle, the card you choose to publish is public so that people can send you a request. Our card service holds exactly what your card shows: your handle, and anything you add to it, such as a name, photo, short bio, links, and your phone number if you turn on sharing it. We do not check that number. If you hold a current 18+ check or a Verified name, your card shows that it is current, and our card service therefore knows it. This includes when you keep your name hidden: it knows the status, not the name. If you choose to show your verified name on your card, the service holds that name as part of your card, and while your card is findable it can be found by people who search for that exact name and hold a Verified name themselves. The service also keeps daily totals of how often your card was viewed or sent a request, for 30 days, with no record of who.
- To keep those marks current, your phone asks our verification service for a fresh statement every few days, at a randomised time, but only while the app is open and unlocked. That service sees when your identity asks, and does not store it. Because these requests leave while you are using the app, anyone who runs both parts of our network path could link one in time to other things you do in the same few minutes, such as sending a request. During this alpha we run both parts. Our card service also sees when your card is republished with a renewed mark.
- If you change your handle and choose to keep old links working, your old handle permanently and publicly points to your new one. If you erase everything, your phone first asks our card service to close your handles, so no old link leads to you any more, and to remove your cards; if that request cannot reach us, your card is removed when it expires. A handle you have used is not given to anyone else. That depends on our servers' record of which handles have been used, and we do not yet back those servers up: if that record were lost in a server failure, an old link could stop pointing to you, and a handle you used before could become available again.
- If you show your verified name to one contact, that contact receives a proof of it that they could show to others.
Network privacy
The app reaches our services through Oblivious HTTP (OHTTP), which encrypts each request so that the relay forwarding it cannot read it. During this alpha, that relay and our services are operated by the same organisation, so we do not claim that no single operator could see both your network address and your requests. Mailboxes on our relay are not linked to any account, name or phone number.
Notifications
To wake the app when something arrives, we use Apple Push Notification service on iOS, and on Android a UnifiedPush distributor app that you choose and install (Hitodor Chat contains no Google Firebase code). The push service gives the app a push address or token, which we store so a wake-up can be delivered. A push contains only an app identifier, an opaque wake token and a collapse identifier. It never contains message content, sender names or who is writing to you.
What we do not do
- No analytics, advertising, advertising identifiers, trackers or crash-reporting services in the app.
- No selling or sharing of personal data.
- No reading, scanning or profiling of your conversations. We have no ability to do so.
Operational data on our servers
To keep the service running and protect it from abuse, our servers count events in aggregate (for example, how many messages were relayed in an hour). These counters never contain mailbox identifiers, invitation identifiers, key fingerprints, message content or per-conversation data.
Adults only
Hitodor Chat is for people aged 18 and over. When you first open the app you confirm that you are an adult; that confirmation is stored on your device only and is not sent to us.
Data on your device, and deletion
Your keys, conversations and media are stored on your device, protected by your device's security. Deleting the app deletes them. Anything left on our servers expires automatically as described above. Backups of keys are made only if you explicitly create one yourself.
Legal basis and your rights (EU/EEA)
We process the limited data above to provide the service you ask for (Article 6(1)(b) GDPR) and to keep it secure (Article 6(1)(f) GDPR). You have the right to access, rectify, erase, restrict or object to processing, and to data portability. Because we hold no account and cannot link server data to you, we may be unable to identify data relating to you; contact us and we will help where we can. You may also complain to your data protection supervisory authority.
Changes
If this policy changes, the new version will be published here with a new effective date.