Privacy policy
Last updated: 7 October 2026
us2us is designed so that your conversations live only on your phone and the phone of the person you talk to, not on our servers.
Our server (the “relay”) only carries encrypted envelopes until they are delivered. It cannot see what your messages say, who writes to whom, your username, your contacts or your location. We never ask for your phone number or e-mail address.
What the relay stores, and for how long
The relay stores only the following. Everything is either a public key, encrypted data, or a one-way hash.
| Data | How long |
|---|---|
| Random account id | Until you delete your account, or after 180 days without any connection |
| Hash of your username (PBKDF2, 100,000 rounds; never the username itself) | As long as the account. After a username change the old hash stays reserved for you for 14 days, so nobody can take it. |
| Your public keys (identity key and pre-keys for starting sessions) | As long as the account. One-time pre-keys are deleted the moment they are handed out. |
| SHA-256 hashes of your login token and access key | As long as the account; replaced ones are deleted at once |
| Last connection date (day only, no time) | As long as the account |
| Encrypted message envelopes and the recipient account id | Until your phone confirms delivery, at most 14 days |
| Encrypted files (photos, videos, voice, documents) and the uploading account | Until deleted (usually right after the recipient downloads them), at most 14 days |
| Hashes of used anti-spam tokens | Until the token expires (at most 10 minutes) |
What the relay can never see
- The content of your messages, photos, files and voice notes
- Who sent a sealed message
- Your username in clear text
- Your contacts, display name and profile photo
- Your location or live location
- Your secret code, or anything derived from it
What the relay sees while it works
- Your IP address while you are connected. The relay does not log IP addresses; use Tor or a VPN if you want to hide yours.
- Which account each envelope is addressed to, its (padded) size and its time.
- Which account uploads a file.
- Your “active” status is end-to-end encrypted and the relay stores nothing about it. But each time the app opens, it sends one batch of encrypted envelopes to the contacts you share your status with; a hostile relay that logged IP addresses and timing could use those batches to guess contact lists. Our relay keeps no such logs. If you want protection anyway, turn off “Show when I’m active” or use Tor or a VPN.
Apple, Google and notifications
- us2us uses no push notifications. Apple and Google are not involved at all: no notification is ever sent, and no identifier of your device is given to them or to us, so they cannot learn who receives messages, or when.
- The trade-off: while the app is closed you cannot see new messages. They arrive when you open the app, directly from our relay.
- Downloading the app from the App Store or Google Play is subject to Apple’s and Google’s own privacy policies.
Data on your phone
- Your messages, contacts and settings exist only on your phone, encrypted with your secret code. The code never leaves your phone.
- Only you create an account backup file; it is encrypted with your secret code and never sent to us. Messages are not part of it.
Analytics, ads and logs
- There are no analytics, ads, trackers or cookies in the app or on this site. This site loads no fonts or scripts from anywhere else.
- The relay does not log request contents, tokens, keys or IP addresses. The web server keeps no access logs; its error log may contain an IP address when a connection fails, and is deleted after 14 days.
- We never back up messages or files. For disaster recovery only the account directory (account ids, username hashes, public keys) may be backed up, encrypted, and such backups are kept at most 7 days.
Deleting your data
- When you delete your account in the app, your account, keys, waiting messages and the files you uploaded are deleted from the server immediately.
- If you uninstall the app and never connect again, your account is deleted automatically after 180 days.
- Because we do not know your phone number or e-mail, we cannot identify you; that is why deletion happens inside the app.
Contact
Questions about this policy? Write to us: support@us2us.app