Privacy Policy

1. Who we are

ShadowTalk is operated by the publisher of the ShadowTalk application. We are the controller of personal data processed to provide the service.

Privacy requests: privacy@shadowtalk.tech. Account-deletion requests: privacy@shadowtalk.techor the in-app Delete Account flow described below.

2. What this service is

ShadowTalk is a messenger. Direct messages, group messages, and file attachments are encrypted on the sender’s device with the Signal PQXDH and Double Ratchet protocols before they are uploaded. Private keys and decrypted history stay on the device. We cannot read those contents. Delivery still produces account, device, timing, and size metadata, which this policy covers.

ShadowTalk has not completed an independent security audit. End-to-end encryption reduces what we can access; it does not make the service anonymous.

3. Data we collect

3.1 Account data

When you register we store:

• Username (required)
• Password, stored only as a one-way hash
• Email address, if you provide one
• Phone number, if you provide one
• Account creation time

We issue a JSON Web Token when you sign in. The token identifies your account for up to 30 days and is stored on the device in platform secure storage (Android Keystore / iOS Keychain / equivalent on web).

3.2 End-to-end encryption material (public only)

To deliver encrypted messages we store, per device: a device identifier, the identity public key, signed pre-keys, one-time elliptic-curve pre-keys, and Kyber pre-keys. Private keys never leave the device.

3.3 Messages, groups, and attachments

We store on our servers:

• Ciphertext envelopes addressed to specific recipient devices
• Encrypted attachment files (opaque ciphertext, uploaded as ciphertext.bin)
• Sender and recipient account IDs, group IDs, and device IDs
• Timestamps and ciphertext size
• Group names, descriptions, membership, and admin flags

We do not store plaintext message bodies or attachment contents for current ShadowTalk clients. Legacy unencrypted rows from earlier versions of the backend, if any remain, are readable by the server until they are deleted.

3.4 Calls

Voice and video media travel peer-to-peer with WebRTC. We relay signaling JSON (offers, answers, ICE candidates, hang-up, and similar events) through wss://api.shadowtalk.tech/ws/calls/. After a call we store a call-event record with event type (voice or video, completed or missed), duration in seconds, a call identifier, and whether the call used audio or video. That call-event record is not end-to-end encrypted.

Call setup uses Google STUN servers at stun.l.google.com:19302and stun1.l.google.com:19302. Those servers learn IP addresses involved in establishing the media path. If we later enable a TURN relay, that relay would also see IP addresses and media packets for calls that cannot connect peer-to-peer.

3.5 Contacts

Finding people you already know is optional. If you use “Refresh contacts,” the app reads phone numbers from the device address book (not contact names or photos) and sends that list to /api/users/find-by-phones so we can return ShadowTalk accounts with matching numbers. We do not keep that list as a contacts database after the lookup; matching numbers that belong to registered accounts are already stored as those users’ profile phone numbers.

3.6 Location

We do not continuously track location. If you choose Share location in a chat, the app reads the current GPS coordinates and sends them as part of an encrypted message (a Google Maps URL). We cannot read those coordinates from the ciphertext. The recipient’s device can. Opening the link uses Google Maps under Google’s own terms.

3.7 Network and device metadata

Our API records the public IP address and TCP source port seen by the server (including values forwarded by Nginx) and the HTTP User-Agent when those are required for connection diagnostics. Reverse-proxy and application logs may also contain the requested URL, time, and status code.

Background collection of GPS, device model, screenshots, and gallery files is disabled. The endpoints POST /api/user-data and POST /api/collect-media return HTTP 410 and do not accept new uploads. Any records created by earlier versions of the software are deleted when you delete your account.

3.8 On-device data

The app keeps Signal private keys, ratchet state, and a decrypted message cache in an encrypted local database. Theme preference is stored in ordinary app preferences. Uninstalling the app removes on-device data that the operating system deletes with the app.

3.9 Website

The marketing site at shadowtalk.tech is static. We do not set advertising or analytics cookies there. The web client at app.shadowtalk.tech uses the same API as the mobile apps.

4. How we use data

• Create and authenticate accounts
• Deliver encrypted messages, attachments, and group membership updates
• Register public keys so other devices can encrypt to you
• Match optional contact phone numbers to existing accounts
• Set up and record the fact of voice and video calls
• Operate, secure, and debug the service
• Respond to deletion and support requests
• Comply with law where we are legally required to do so

We do not sell personal data. We do not show ads in the app. We do not use your messages to train models.

5. Legal bases (EEA / UK)

If the GDPR or UK GDPR applies:

• Contract: account, messaging, encryption-key distribution, and calls
• Consent: address-book lookup and in-chat location sharing (you can refuse and still use the rest of the app)
• Legitimate interests: security logs, abuse prevention, and keeping the service available
• Legal obligation: when we must retain or disclose data under applicable law

6. Sharing

We share data only as follows:

• Other ShadowTalk users you message, add to a group, or call, to the extent the protocol requires (public keys, usernames, ciphertext, call signaling)
• Google, when the app loads Inter / IBM Plex Mono through the google_fonts package, when a call uses Google STUN, or when someone opens a shared Maps link
• The virtual-private-server provider that hosts the machines we operate, which necessarily processes IP addresses and similar connection data
• Authorities, if required by valid legal process

Recipients of your messages hold decrypted copies on their devices. We cannot delete those copies.

7. Retention

• Account profile, public keys, ciphertext, and group membership: until you delete the account, except as noted below
• Auth tokens: expire after 30 days
• Operational logs: up to 30 days, unless we must keep them longer for security or legal reasons

If you delete your account, we remove the user row, direct messages you sent or received, attachments for those messages, encryption devices and pre-keys, envelopes addressed to you, chatrooms you created (including their messages), and your membership in other groups. Messages you sent in groups you did not create remain for the remaining members (as ciphertext).

8. How to delete your account

1. Open ShadowTalk while signed in.
2. Open the menu (three dots) on the home screen.
3. Choose Delete Account and confirm.

You can also email privacy@shadowtalk.techfrom the address on the account, or follow the instructions at https://shadowtalk.tech/delete-account.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export personal data, to restrict or object to certain processing, and to withdraw consent for optional features (contacts lookup and location sharing). California residents may also request a list of categories of personal information we collected and confirm that we do not sell or share it for cross-context behavioral advertising. Email privacy@shadowtalk.tech. We may need to verify the account before acting.

10. Children

ShadowTalk is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe we have, write to privacy@shadowtalk.techand we will delete the account.

11. Security

Passwords are hashed. Message and attachment payloads from current clients are ciphertext on the server. Private keys are stored on the device in OS-backed secure storage. Access to the API uses HTTPS. Call signaling uses WSS. These measures are not a guarantee against every attack. Keep your device updated and do not share your password.

12. International processing

We operate the service on servers we control. If you use ShadowTalk from another country, your data is processed on those servers. Public keys, ciphertext, and account data are transferred as needed to deliver the service you requested.

13. Permissions

The Android app may request:

• Internet — to reach api.shadowtalk.tech
• Camera and microphone — to send media and for calls, when you start those actions
• Contacts — only for optional user lookup
• Location — only when you share your location in a chat
• Bluetooth (calls / audio routing on some Android versions)
• Notifications-related wake lock for keeping a call session alive

You can deny optional permissions. Messaging still works without contacts or location.

14. Changes

If we change this policy, we will update this page and the effective date. Material changes will be called out on https://shadowtalk.tech or in the app when practical.

15. Contact

ShadowTalk
Email: privacy@shadowtalk.tech
Website: https://shadowtalk.tech
App: https://app.shadowtalk.tech