The short version

We can't read your messages, hear your calls, or open your files — they're encrypted on your device before they leave it. What we can see is listed below, honestly. If any of it bothers you, Nyktos isn't the app for you, and we'd rather tell you that here than bury it.

What we cannot see

• Message text — sealed with your recipient's public key on your device
• Call audio and video — peer-to-peer, encrypted in transit, never touches our server as media
• File contents — photos, videos, and voice notes are encrypted before upload
• Your private encryption keys — they never leave your browser

What we need to run the service

Everything below is stored in plaintext on our servers. None of it is message content — but it's still your data, so here's exactly what it is and why we keep it:

• Account details — username, display name, bio, avatar, email address. People need to find you and know it's you.
• Contact graph — who your contacts are, who invited whom. This is how adding people works.
• Groups — group names and member lists. The server needs to know where to deliver messages.
• Message metadata — who messaged whom and when. Ciphertext only for the content itself. Routing is impossible without this.
• Polls — poll questions and votes are plaintext by design, so everyone can tally them without extra crypto.
• Reactions, read receipts, typing indicators — small signals that make chats feel alive. They're metadata, not content.
• Login records — IP address, country, city, device type, timestamp. This is how you (and we) spot someone breaking into your account. You can review and wipe them from the admin panel.
• Page visits — which pages you load, with IP and device info. Basic analytics so we know what's being used. This is a form of tracking, and we're not going to pretend it isn't.
• Call setup data — when you start a voice/video call, the signaling data (connection offers) passes through our server unencrypted. It can reveal your IP address to us, and network details to the other caller. The actual voice/video is peer-to-peer and encrypted.

Why we log some of this

Every item above exists because the service breaks without it — delivery needs routing data, abuse prevention needs login records, and knowing which pages get used tells us what to fix. We don't log anything for advertising: there's nothing to sell and no one to sell it to.

What we don't do

• No ads, no ad trackers, no selling data — there is nothing to sell
• No third-party analytics SDKs in the app
• We never hand message content to anyone, because we don't have it to hand over

Data retention

Messages live until you delete them or until a disappearing-message timer lapses, at which point they're hard-deleted with their attachments — not archived, not recoverable. Login records are kept for security review and can be wiped from the admin panel. Delete your account and your profile, contacts, and metadata go with it; ciphertext addressed to you becomes permanently unreadable once your keys are gone.

Your rights

You can export, correct, or delete your account data at any time — contact [email protected] and we'll handle it. Because of E2EE, "export" covers your profile and metadata, not message contents — only your devices hold those.

Changes

If this policy changes in a way that meaningfully expands what we collect, we'll say so in the app before it takes effect.