Curtilage

Privacy policy

SecureMessaging privacy policy

How SecureMessaging handles your information.

Last updated:

Summary

  • SecureMessaging is a messaging app that works through a server. Out of the box, the app connects to our server. If your organization runs its own server and sends you an invitation, the app connects to that server instead, after you confirm a verification code.
  • Message text is encrypted on your phone with the Signal protocol before it is sent, and the server stores it only until the recipient's device picks it up. The server stores the encrypted text, not the readable text. It does see who sends to whom, and when. The phone app does not yet let you compare safety numbers with the person you are writing to, so it relies on the server to hand out the right public key for each person.
  • The phone app does not keep your message history. Messages show on screen while the app is open and are gone when you close it.
  • The phone app sends no usage analytics. The web version sends page and feature counts to the server you use (see "Analytics").
  • There are no AI features, no ads and no crash-reporting service.

What the app collects

To work, the app handles:

  • Your user name, which other people use to reach you, and, if you sign in through your organization's directory, the directory user name and password you type (sent to the server to sign you in; the app does not save the password).
  • Your passphrase. The app does not send your passphrase. It uses it to lock a backup copy of your encryption keys, and sends only a value calculated from it when you sign in on a new device, to prove you know it (see "Where it goes").
  • Your messages. Text you send and receive. In the phone app they are held in memory only while the app is open.
  • Your encryption keys. The app creates a private key on your phone. The public half is published on the server so that others can start an encrypted conversation with you.
  • The server address you chose, saved in the app's settings so it is remembered between launches.
  • An invitation code and email address, only if you open an invitation link. They fill in the sign-up form.

Where it goes

On your phone

  • The phone app saves only the server address in its settings. It does not save messages, contacts or your private key on the phone.
  • Android Auto Backup and device-to-device transfer are turned off for this app, so Android does not copy its data to a cloud backup or a new phone.

The server (ours, or your organization's) Every connection uses HTTPS (encrypted in transit). The app refuses an invitation that points at a plain, unencrypted address. The server stores:

  • Your account: user name, the date it was created, an email address if your account came from an invitation or directory, and a hash of each device's sign-in token (not the token itself).
  • Your public keys: the public identity key and pre-keys that others use to start an encrypted conversation with you.
  • A locked backup of your keys. When you create an account, the app uploads a copy of your private key and your device sign-in token, locked with your passphrase (scrypt key derivation and AES-256-GCM encryption). The server cannot open it without your passphrase. It releases the backup to a new device only after that device proves it knows the passphrase. A short or common passphrase makes the lock easier to guess, so choose a long one.
  • Messages waiting for delivery. Each message is stored as encrypted text, together with the sender's user name, the recipient, the time it was sent and its type (message, delivery receipt or group message). The server deletes a message as soon as the recipient's device confirms it has received it. A message that is never picked up stays on the server until it is picked up or the account is removed. There is no automatic time limit.
  • Groups: which accounts are members of which group, so the server can deliver group messages. Group chat is available in the web version only.
  • Contacts and feedback (web version): the contact list you save and any feedback you send are stored on the server as plain text, not end-to-end encrypted.

What the server can see: user names, who sends to whom and when, group membership, message sizes and your network (IP) address when you connect. What it cannot see: the text of your messages and your private key.

Your organization's sign-in service (optional)

  • If the server you use is set up for directory sign-in (LDAP or Active Directory) or single sign-on, the server checks your user name and password with your organization's own sign-in service.

Bridges to other chat services (optional, set up by the server's administrator)

  • A server administrator can connect the server to other chat services, such as Telegram, Slack, Discord, Microsoft Teams or Matrix. A message sent through a bridge leaves end-to-end encryption and reaches that service in readable form. The web version's bridge page says so. The phone app does not use bridges.

A third-party service you choose

  • None. The app does not connect to any service other than the server.

Permissions and why

  • Internet
    • Why the app asks: To connect to the messaging server
    • When: Granted at install
  • Network state
    • Why the app asks: To check whether a network connection is available
    • When: Granted at install

The app asks for no other permissions. It does not read your contacts, location, camera, microphone or files.

Analytics

The phone app does not send usage analytics.

The web version sends page views and feature clicks (event name, page, feature, action and a random session number) to the server you are signed in to. It never sends message text, keys or contact details. The server keeps these records for 90 days. On our server, the same page and feature events may also be forwarded to our own self-hosted analytics service. A server run by your organization does not forward them unless its administrator sets that up.

There is no crash-reporting service.

Sharing with other Curtilage apps

None. SecureMessaging does not exchange data with other Curtilage apps.

Your choices

  • Choose your server: the app connects to our server unless you accept an invitation to your organization's server. It always shows the server's verification code first, so the app is never switched to a different server without your confirmation.
  • Export: the web version can export the conversation history it keeps in your browser. The phone app keeps no history, so it has nothing to export.
  • Delete: messages are deleted from the server when your device receives them. To remove your account, its keys, its waiting messages, its contacts and its group memberships from the server, ask the server's administrator. There is no self-service delete in the app today. Uninstalling the app removes the saved server address.
  • Revoke: you can uninstall the app at any time. Your locked key backup stays on the server until the account is removed.

Children

SecureMessaging is not designed for or directed at children. It does not ask for anyone's age.

Changes to this policy

If we change this policy, we will post the new version on this page and update the date at the top.

Contact

Questions about this policy: https://curtilage.zone/contact