Privacy Policy

Messages, files and calls

Meldiq stores messages to deliver conversation history. Files are encrypted before upload. Current messages can include attachment keys that the Meldiq server can read. Call media is end-to-end encrypted when call encryption is on. Check the call indicator in the app.

What we collect

• Account: your email address, name, a hash of your password, passkey public keys, two-step sign-in settings, and your signed-in sessions.
• Profile: username, display name and the profile details and photo you choose to add.
• Communities: the communities, channels and roles you're in, invitations, bans and reports. The server needs these to decide who may do what.
• Routing metadata: who sends to which conversation, when, and how large each message is; delivery receipts; IP addresses; online status.
• Devices: device public keys and, if you allow notifications, a push address for each device.
• Billing: if you buy a plan, references to your payment-provider account, subscription and transactions, the plan, its status and dates, and amounts. Never card numbers: the payment provider handles payment details on its own pages.
• Operations: counts and sizes for usage limits, security and audit logs without message content.

Why we use it

To provide Meldiq (your account, delivering messages and calls, enforcing community permissions), to keep it secure and stop abuse, to bill paid plans and meet accounting duties, and to answer you when you contact us. We don't sell your data or use it for advertising. The legal bases for each use, where the law requires them, are [To be confirmed: legal bases per processing purpose and applicable jurisdictions].

Who processes it for us

• Hostinger: the server that runs Meldiq's API.
• Supabase: the PostgreSQL database used by Meldiq. MongoDB Atlas holds the prior database during recovery retention.
• Amazon Web Services: encrypted file storage. Frankfurt, Germany, is the primary region for file storage. We retain historical copies in Singapore for recovery. New uploads, including from older Windows apps, are stored in Frankfurt.
• Cloudflare: DNS, website delivery and authorized file delivery through its global network.
• PayPal: payment authorization, subscriptions, receipts and payment verification for new website purchases.
• Stripe: billing records and the customer portal for earlier Stripe subscriptions, where applicable.
• Notification wake-ups run through Meldiq's own push server, which learns only a random device address and when it was woken, never content. If Google Firebase Cloud Messaging is switched on later, this list will say so first.

How long we keep it

• Encrypted messages waiting for a device: until delivered, at most 7 days.
• Completed file uploads are kept until you request deletion. When a disappearing-message timer ends, the message disappears but its file stays stored. Files you have not sent are accessible only to you.
• Encrypted history you keep: until you delete it or your account.
• The current retention settings for call records and audit logs are 36,500 days.
• Billing records: as long as tax and accounting law requires: [To be confirmed: billing record retention period].
• Your account: until you delete it.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your data, object to or restrict some uses, and complain to a data protection authority. You can delete your account yourself (how). For anything else, write to [To be confirmed: privacy contact email address]. We'll check it's you before acting on a request.

This website

The website uses no advertising or tracking cookies and loads no third-party scripts. When you sign in here, your session is kept in this browser tab only and ends when you close it or sign out. PayPal hosts new subscription payment pages under its own privacy policy. Earlier Stripe payment pages follow Stripe's privacy policy.

International transfers and changes

Your data may be processed in countries other than yours by the providers above. [To be confirmed: transfer safeguards for the intended markets] We'll tell you about material changes to this policy before they apply.