Privacy Policy

How Confy handles personal data in the app, on the relay server and on this website.

Version 1.0 · Last updated 20 October 2026

Contents

1. Who is responsible
2. The app on your phone
3. Contacts and messages
4. What the relay sees and keeps
5. Notifications
6. Nearby chat and the nearby room
7. Reports, blocking and the ban list
8. When you email us
9. This website
10. Private testing and earlier signups
11. Legal bases
12. How long data is kept
13. Service providers and transfers
14. Your rights
15. Minimum age
16. Security
17. Changes to this policy

1. Who is responsible

The controller of the personal data described here is QRITON TECHNOLOGIES S.R.L., Bulevardul Oituz, Bl. 13, Sc. A, parter, Ap. 11, Onești, Bacău, Romania (“we”, “us”). We develop the Confy app for iPhone and Android, operate the Confy relay server and publish this website.

Company registration identifier: CUI 53194382. For privacy questions or requests, write to hello@qriton.com, with “Confy privacy” in the subject.

2. The app on your phone

When you first open Confy, the app creates your identity keys on your phone and gives you a random nickname, which you can change. There is no sign-up and no account on our side.

• Keys. Your private keys are kept in the phone's secure storage (on iPhone the Keychain; on Android they are encrypted with a key held in the Android Keystore), set to stay on that device only. They are never sent to us.
• Contacts and history. Your contact list, private-group membership and message history are stored in the app on your phone. Contacts and groups remain across normal in-place updates; the 7-day limit applies to message history. The app keeps history for 7 days and excludes it from device backups. We cannot restore it on another phone. Your contacts keep their own copies of messages you exchange. Older prototype records that are still present are preserved for reconnection until you use Delete all data; this update cannot restore records an earlier build already erased.
• No tracking. The app contains no advertising, no analytics and no tracking code, and it doesn't access your address book, location or photos.
• Camera. The camera is used only to scan a contact's QR code, on your phone. Images are not stored or sent.
• Bluetooth and local network. On iPhone, these are used only for nearby chat and the nearby room (see section 6).
• Content filter. In the nearby room, a word filter runs on your phone. It doesn't send anything to us.

3. Contacts and messages

You add a contact by scanning their QR code, opening a shared contact link, pasting their contact code, or choosing them in the nearby room. You review and send the contact request, and the other person chooses whether to accept. You can decline, or block and report, requests you receive.

A contact code contains public keys, a random value that lets whoever holds the code send its owner a contact request, and the nickname the person chose. It doesn't contain a phone number, email address or name unless the person typed one as their nickname. Share your code only with people you want to hear from; if it was shared too widely, you can replace it in Settings with Rotate my code.

Messages between contacts are end-to-end encrypted on your phone before they are sent, whether they travel through our relay or directly between nearby phones. Only you and your contact have the keys to read them. Messages are padded to fixed size steps, so their exact length is hidden. You can compare a contact's safety number in the app to check that nobody is in between.

Private groups. In builds with private groups, a contact can invite you to a named group. Joining shares your Confy contact code, nickname and identity public key with the owner and other members, and connects you with those members. The owner authorizes membership and shares updated member lists. Group messages are sent separately over the existing encrypted connections between members; the relay cannot decrypt them. Members can read and keep the messages they receive. Leaving a group keeps your individual contacts; an owner leaving closes the group. Earlier messages cannot be recalled from other phones.

If you contact a member of our team through Confy, that person is a recipient of the messages you send them. Do not send private keys or sensitive information that is unnecessary for your support request.

4. What the relay sees and keeps

When you and a contact aren't near each other, messages go through the Confy relay, a server we operate on a dedicated machine hosted by Exoscale in Switzerland.

What it stores

• Encrypted messages and contact requests, padded so their exact size is hidden. A message is deleted when the recipient's app acknowledges receipt. Undelivered messages expire after about 7 days; expiry times are rounded and deletion runs periodically.
• Mailbox tags. Each conversation direction has its own mailbox, identified by a random-looking tag derived from keys that only the two contacts hold. Your contact-request inbox has a tag too, derived from your contact code. A tag doesn't contain your name, number or device identifier. For each tag the relay keeps when it was first used (rounded to 10 minutes) and, after a contact is blocked, a code is rotated or data is deleted, a mark that refuses new messages for 30 days.
• Sealed notification registrations (see Notifications).
• Reports that users send (see Reports).
• One-time request codes, stored with the mailbox key that signed the request, used to stop replayed requests and kept for up to 30 minutes.

What it can see

Like any server, the relay necessarily sees some information while it delivers messages:

• which mailbox tags receive messages, when (times are stored rounded to 10 minutes) and how large the padded messages are;
• the IP address your phone connects from, while the connection is open.

The relay does not log or store the IP addresses of app connections. To limit abuse, it counts requests using a keyed hash of your IP address (for IPv6, of its /64 network). That key is random, is kept only in memory, is replaced every day, when the counters are also cleared, and is never written to disk. The server's system logs don't record app connections; they record administrative access to the server, including blocked login attempts, and are kept for 7 days.

The relay can't read messages, doesn't know who you are, and doesn't receive your contact list. But because your phone fetches its mailboxes together, the relay can tell which mailboxes belong to the same phone, and like any messaging server it could in principle use connection addresses and timing to work out which phones exchange messages. Confy does not claim to hide this kind of traffic information.

5. Notifications

If you allow notifications on iPhone, Confy registers your phone's push token with the relay for each mailbox you receive messages in, and for your contact-request inbox. A push token is an address issued by Apple that lets a server send a notification to the app on your phone.

• The token is stored on the relay encrypted (sealed) separately for each mailbox. The key that opens it is known only to those who can send to that mailbox (your contact, or for your inbox, whoever has your contact code) and travels with each new message; the relay uses it in memory to send the notification, then discards it. A copy of the relay's database on its own can't link push tokens to mailboxes.
• The notification says only “New message”. It contains no sender, no text and no contact name. Apple Push Notification service receives the token and notification and learns that our server sent a notification to your device at a certain time.
• Registrations expire after about 30 days unless the app renews them. The app requests their deletion when you turn notifications off, block a contact (for that mailbox), or delete all data. Server-side changes require a working connection; expiry still applies if a request cannot reach the relay.

The Android test APK currently distributed through Qriton does not have push notifications configured. Keep it open to receive messages. If a later build enables an additional notification provider, this policy will be updated to explain its data handling.

6. Nearby chat and the nearby room

These features are available in the iPhone app only.

Nearby chat with contacts

When you and a contact are close to each other with Confy open on both phones, messages can go directly between the phones over Wi-Fi or Bluetooth, using Apple's peer-to-peer networking, without passing through the relay. Your phone announces itself under a random name that changes each time the app starts, and it proves who you are only to your contacts and to someone you are adding as a contact. Other phones nearby can see that someone near them has Confy open, but not who. These messages are end-to-end encrypted in the same way.

The nearby room

The nearby room is an open, local chat with people around you who also have Confy open and have joined the room. It is off by default, and you must accept the Terms of Use before you join.

• Room messages travel directly between nearby phones. They are not routinely sent to the relay, but a participant can include them in an abuse report.
• Room messages are not private: everyone in the room near you can read them, and they can see your nickname, the time you sent each message and your room key (a public key, created on your phone, that signs your room messages so they can't be forged). You can generate a new room key in Settings.
• Other people in the room can keep what you write, take screenshots or report it.

7. Reports, blocking and the ban list

You can block and report someone in the nearby room or a contact, for example for abuse, spam or illegal content.

• Blocking happens on your phone. For a contact, it also tells the relay to stop accepting messages and notifications for that contact's mailbox.
• A report contains the reason you give and, for the nearby room, the reported person's room key and signed room messages, including their nickname. For a contact, it includes the safety number of your conversation with them. It also contains the app version and time. Contact-chat message text is not automatically attached. Information you type in the reason may identify you. The app encrypts the report for our moderation key. Reports on the relay expire after about 30 days; any copy used to investigate an incident is kept for the investigation and any necessary legal follow-up.
• If you are reported, we receive this information from the person who reported you.
• Reports are for investigating abuse and deciding what action to take. Room restrictions use a signed ban list. The iPhone app checks for updates when joining and periodically while open, and hides messages from listed keys. A banned key is kept while its restriction applies. During private testing, also email hello@qriton.com about an urgent or unresolved report.
• If a report shows content that we are legally required to pass on, such as material related to child sexual abuse or a threat to someone's life, we may share it with the competent authorities.

8. When you email us

If you write to us, we receive your email address and whatever you include in the message. We use it to answer you and handle your request. Correspondence is kept while needed to resolve the matter and related follow-up, or longer where a legal obligation or claim requires it. The mailbox does not currently apply an automatic deletion deadline to Confy support correspondence; you can ask us to delete messages that are no longer needed.

9. This website

confychat.com is a static website. It sets no cookies, uses no analytics, runs no scripts and loads nothing from other companies’ servers.

The web server and Qriton Shield security software record requests, including IP address, time, requested page and browser user agent, to investigate traffic, detect attacks and maintain security protections. Website logs and security archives currently have no fixed automatic deletion deadline. Older records may remain in security archives. Their continued retention must be assessed against the security investigation or legal need; you can request access or deletion using the contact above. This is separate from the relay's handling of app connections.

If you open a Confy contact link (confychat.com/p#…), browsers don't send the part after # to the server, and the page runs no scripts that could read it, so it doesn't reach our website or its logs.

10. Private testing and earlier signups

The invite-protected Qriton testing page is a separate service. It collects your email address, selected platform, invitation identifier, signup time and consent record. We use these to arrange testing access, prevent duplicate signups and send signup confirmations. For iPhone testing, your email is sent to Apple for TestFlight enrollment and invitations. Google provides delivery of our confirmation emails. These are service messages, not newsletter enrollment.

The portal uses secure access cookies lasting up to 24 hours. Our local registration records are removed after 90 days. This does not automatically erase Apple's tester records or emails already delivered. To leave the test or request removal from the TestFlight group, email us. Apple's TestFlight privacy information describes the testing information Apple handles. The Qriton privacy policy also applies when you browse qriton.com.

Some launch-interest records from the earlier Confy website remain, including submitted email addresses and request information. They are separate from current test registrations and have no automatic expiry configured. If you previously signed up and want that record removed, contact us with the email address you used.

11. Legal bases

Under Article 6(1) of the EU General Data Protection Regulation (GDPR), we rely on:

• Performance of a contract (Art. 6(1)(b)): delivering your messages and contact requests, sending notifications you've turned on, and answering your support requests. This is the service you ask for when you use Confy.
• Legitimate interests (Art. 6(1)(f)): keeping the service and website secure and free from abuse, which covers the rate limits, the website access logs, handling reports and maintaining the ban list. Our interest, and that of other users, is a safe service that can't easily be misused. We keep this processing to the minimum needed, and you can object to it (see Your rights).
• Legal obligation (Art. 6(1)(c)): when the law requires us to keep or disclose information, for example in response to a valid order from a competent authority.

Private-test registration is voluntary and includes your agreement to receive testing invitations and service emails. We use the registration to provide the access you request (Art. 6(1)(b)); earlier voluntary launch-interest signups relied on consent (Art. 6(1)(a)), which you may withdraw. Technical filters and rate limits run automatically. You can contact us to challenge an access restriction or moderation decision.

You are not required by law or by contract to give us any personal data. Some data, such as mailbox tags and encrypted messages on the relay, is technically necessary to deliver messages; without it, Confy can't deliver messages through the relay. Notifications are optional.

12. How long data is kept

13. Service providers and transfers

• Exoscale (Akenes SA, Switzerland) hosts the relay in Switzerland and the server for this website in one of its European data centres, all of which are in Switzerland or the European Union. It processes data on our behalf and can't read messages.
• Apple provides iPhone notifications, TestFlight and our Qriton email hosting. It receives the data needed for those services, including push tokens, tester information and email correspondence.
• Google delivers the testing-confirmation emails sent from our Gmail account, receiving the destination email address and the message content.

These providers may process service data outside the European Economic Area, including in Switzerland and the United States. Their services have their own privacy terms: Apple, Google and Exoscale. Contact us for information about the locations and transfer arrangements relevant to your request.

We don't sell personal data and we don't share it for advertising. We disclose data to authorities only where the law requires it; see what data exists.

14. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict how we use it (Art. 18);
• receive data you gave us in a portable format (Art. 20);
• object to processing based on our legitimate interests (Art. 21);
• lodge a complaint with a supervisory authority. In Romania this is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, dataprotection.ro). You can also complain in the EU country where you live or work.

How to use them

• In the app: Settings → Delete all data removes your local chat keys, contacts and history and requests closure of your relay mailboxes and deletion of notification registrations. Keep an internet connection available for the server requests. If they cannot complete, normal relay expiry still applies. Uninstalling alone should not be relied on to erase every secure-storage item.
• By email: write to hello@qriton.com. We answer within one month; for complex requests this can be extended by up to two more months, and we will tell you if it is.

Because Confy has no accounts, we usually can't tell which relay data belongs to you. Where that's the case, we can only act on a request if you give us information that lets us find the data (Art. 11 GDPR). For relay data, the quickest and most complete way to erase it is Delete all data in the app. We will never ask you for message content or private keys.

15. Minimum age

You must be at least 16 years old to use Confy. The nearby room lets you talk to people you don't know, so it isn't suitable for children. We don't knowingly process data of anyone under 16. If you believe a child is using Confy, please tell us at hello@qriton.com.

16. Security

We protect data with end-to-end encryption between contacts, encrypted connections (TLS) to the relay, signed requests so that only the holder of a mailbox key can read or write that mailbox, rate limits, and a hardened, single-purpose server. No system is perfectly secure; if we learn of a personal data breach that affects you, we will tell the supervisory authority and you where the law requires it.

17. Changes to this policy

If we change this policy, we will publish the new version on this page with a new date. If a change significantly affects how we handle your data, we will say so clearly at the top of this page before it takes effect.

Questions: hello@qriton.com.