Secure Messenger
In short
- We don’t ask for your name, phone number or email address, and we don’t read your address book.
- Messages, photos and files are end-to-end encrypted on your phone. We can’t read them.
- Our server stores a random ID for you, public keys, which IDs connected, and sealed messages until they’re delivered.
- This website uses no cookies, no analytics and no third-party content.
Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
Aralel GmbH[Street and number]
[Postcode] Aachen
Germany
Email: [privacy email]
Data protection officer: [name and contact, if appointed]
This website
When you open a page, your browser sends your IP address, the time, the page requested, the referring page and your browser’s user agent to our server. We need these to deliver the page and to protect the server from attacks. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in running a secure website.
Our application doesn’t write these requests to a log. Our hosting provider keeps connection logs for [number] days for security purposes, then deletes them.
- No cookies and no similar storage on your device.
- No analytics, tracking pixels or advertising.
- No third-party content. Fonts, images and scripts are served from our own server, so no other company learns that you visited.
- The encryption demo on the home page runs entirely in your browser. What you type there is never sent to us.
The app: what our server processes
To deliver messages, our server processes the data below. Legal basis: Art. 6(1)(b) GDPR, providing the service you requested by using the app.
| Data | Purpose | Kept until |
|---|---|---|
| Random ID (UUID) and the time it was created | Addressing messages to your phone | You ask us to delete it |
| Invites: the inviting ID, the accepting ID, both per-contact public keys, status and times | Exchanging public keys when two people connect | You ask us to delete it |
| Messages: sender ID, recipient ID, encrypted content, nonce, time | Delivering messages | The recipient’s phone confirms receipt (undelivered messages: until collected or deleted on request) |
| Attachments: uploading ID, encrypted bytes, size, time | Delivering photos and files | [retention period], or earlier on request |
| IP address and connection data | Transmitting data; defending against abuse (Art. 6(1)(f) GDPR) | Not stored by our application; hosting connection logs as described above |
Message text, file names, file types, photos and documents are encrypted on your phone with keys we never receive. We can’t decrypt them, and we don’t try.
The table shows what we can see: which IDs exchange messages, when, and how large they are. We don’t use this information to build profiles, and we don’t sell or share it for advertising.
The app: what stays on your phone
Your private keys, your contacts and the names you give them, your message history and received files are stored only on your phone, in encrypted app storage (Android Keystore-backed storage or the iOS Keychain). We have no access to them. Uninstalling the app deletes them.
The camera is used only to read QR codes while you’re scanning. Camera images aren’t stored or sent anywhere.
App stores and updates
You download the app from Google Play or the Apple App Store. Google and Apple process data about your download under their own privacy policies; we don’t control that processing.
On Android, each time it opens, the app asks Google Play whether a newer version exists and, if so, installs it. This request goes to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under Google’s privacy policy. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in getting security fixes to you quickly.
Service providers
Our server runs at [hosting provider, location], which processes data on our behalf under a data processing agreement (Art. 28 GDPR). We don’t pass personal data to anyone else unless the law requires it.
Data is processed in the European Union. [Confirm, or describe any transfer outside the EEA and its safeguards.]
Identifying you
We deliberately don’t know who is behind an ID. To exercise your rights, include the ID shown under My UUID in the app. Without it, we may be unable to find your data (Art. 11 GDPR). Encrypted content can’t be read, corrected or handed over in readable form, because we don’t have the keys.
Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR)
- have incorrect data corrected (Art. 16)
- have your data deleted (Art. 17)
- restrict processing (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on our legitimate interests, for reasons arising from your situation (Art. 21)
To use any of these, write to [privacy email] and include your ID.
You can also complain to a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
Other information
Providing data is not required by law or contract, but the app can’t deliver messages without an ID and public keys. We don’t use automated decision-making or profiling (Art. 22 GDPR).
The app is not intended for children under 16.
If we change how we process data, we’ll update this page and the date above.