Privacy Policy

In short

Your private chats, groups and broadcast lists are end-to-end encrypted. We cannot read them.
We collect only what we need to run the service: your number, your profile and your devices. We do not sell your data.
The app contains no analytics or advertising trackers.
Message notifications sent through our servers never carry your message text.
You decide who sees your photo, last seen and number, and you can export your data or delete your account in Settings.

Who we are and what this covers

This policy explains how SALOPHA (“we”) handles your data when you use the SALOPHA app on Android and iPhone, SALOPHA Web, the desktop apps and salopha.com. It applies to everyone who uses these services.

What we collect

Account data

Your phone number, which is your identity on SALOPHA. We send it a 6-digit code valid for 5 minutes and store it in protected form. Authorised support staff may see the code when helping you sign in, and every such view is logged.
Your profile: the name you choose, your photo, your about line, your username if you create one, and your city and language if you add them.
Last seen, shown to others according to your privacy settings.

Device data

Each device’s name, operating system, app version and public encryption key.
The push token your device’s system issues so we can deliver notifications.
We may process your device’s IP address to run the service and protect it from abuse, for example rate limits. When you link a computer, your phone shows only part of its address so you can recognise it.

Contacts

If you allow access to your contacts, the app turns each number into an encrypted fingerprint (HMAC-SHA256) on your device and sends the fingerprints with the saved names. We keep the number and name only for people who use SALOPHA. We do not store the numbers of people who don’t; we keep a fingerprint re-keyed with a key that never leaves our servers so we can tell you when they join; it is refreshed with every full sync and deleted when you delete your account. Contacts you add by hand are stored with their number and name.

What you send

What we can see of your content depends on the type of conversation, as the next section explains. We also store what you publish openly, such as status updates and channel posts, and what you share with businesses.

Support and reports

When you contact support or report a chat, we keep what you send us. In encrypted chats we only see the messages you choose to include in the report.

End-to-end encryption

Private chats, groups, community announcements, broadcast lists and notes to yourself are end-to-end encrypted with MLS (the RFC 9420 standard). Each of your devices has its own key, and private keys never leave your devices. Attachments are encrypted on your device with a new key for each file (AES-256-GCM), sent inside the encrypted message.

This means we cannot read these messages or their attachments. Our servers do need some metadata to deliver them, such as who sent a message, when, its size, and an attachment’s type, size, dimensions or duration, and file name if it has one.

Not end-to-end encrypted: business chats, chats with the AI assistant, status updates, channels, workspace, order and invoice records, and calls. These are encrypted in transit and on our servers, and we can access them to run the service.

When you link a new device, older messages do not move to it, and we do not offer cloud backup of encrypted chats at the moment. Messages stored on your device are protected by your device’s own security, so use a screen lock and the app lock.

How we use your data

To create your account, verify your number and sign you in on your devices.
To deliver your messages, calls and notifications, and sync your account across devices.
To apply your privacy settings and protect you from abuse, such as limits on chats with strangers and review of group adds.
To run features you choose, such as businesses, mini apps and the AI assistant.
To answer support requests and reports, and to comply with the law.

We do not sell your data, and we do not use your conversations for advertising.

We host most of the service on servers we run ourselves, including storage, calls and databases. We rely on the following for specific parts only:

Provider	Why	What they receive
OTPIQ	Sending your verification code by SMS	Your phone number and the code
Google (Firebase Cloud Messaging), Apple (APNs) and browser push services	Delivering notifications to your devices	Your push token, the chat or sender name and message IDs, without message text. A call notification includes the caller’s name and public photo link. Other notifications, such as order updates, may include a short summary unless they are sensitive or you turned previews off.
OpenAI	The AI assistant for business, a paid add-on a business turns on	Only in business chats where the business enabled it: the business profile, its settings and the last 12 messages of that chat. Never used with your private chats.
GIPHY	Searching GIFs and stickers	The search words you type. On the web and desktop, searches go through our servers.
OpenStreetMap	Showing maps	The map tiles you view, and your device’s IP address.
Your phone’s place-lookup service (Apple or Google)	Turning a map point into a city or area name	The coordinates you pick.
Cloudflare	Protecting our website and network	Traffic to our website and some services, including IP addresses.

We also share data with:

Other users: your profile, last seen and status according to your privacy settings, and your messages with the people you message.
Businesses you contact: see “Businesses”.
Mini apps you use: see “Mini apps”.
Authorities when the law requires it. We cannot hand over the content of encrypted messages we hold no keys for.

Businesses

When you message a business, its team reads the conversation to reply, according to their roles and branches, and may add internal notes and labels. Customers do not see which employee replied. A business may keep your name, and your number if it knows it, in its customer list along with a rating and internal notes, and orders, invoices and bookings include your name, number and amounts.

Each business is responsible for how it uses its customers’ data. If a business turns on the AI assistant for business, your messages in that chat are sent to OpenAI as described above. SALOPHA does not process payments.

Mini apps

Each service gets an identifier for you that is its own, so it never sees your SALOPHA ID and cannot link you across services.
Services ask for specific permissions. Official and trusted services may receive your name and photo automatically, and your number only if it is visible to everyone in your settings; anything else needs your consent.
You can review and revoke each service’s permissions in Settings.
No service ever receives your personal messages. What you share with a service is governed by its own privacy policy.

AI assistant

The SALOPHA AI assistant, for translation, voice-note transcription and reply suggestions, runs on servers we operate and does not send your data to a third party. It only receives text from your chats when you explicitly ask, and we do not keep what it processes.

Location

We do not track your location. When you share your location or live location in an encrypted chat, it is sent end-to-end encrypted. In business chats the coordinates you share are stored on our servers. You can stop sharing live location at any time.

How long we keep data

Encrypted messages in transit: removed from the delivery queue once your device receives them, and after 7 days at most.
Disappearing messages: the server copy is wiped when the time you chose runs out, from 1 hour to 90 days.
Delete for everyone: available to the sender for 48 hours; the content is wiped and a “deleted” marker remains.
Status updates: 24 hours at most.
Unfinished uploads: deleted after a day.
Your data export: the download link lasts 7 days.
Backups: encrypted nightly backups; we keep the latest 14.

We keep other data for as long as your account exists, or as long as it is needed to run the service or required by law.

Your choices and rights

Privacy settings: who sees your last seen, online status, photo, about and number; read receipts; who can add you to groups; who can call you; who can find you by number; and silencing unknown callers.
Block and report people and businesses.
Export your data in Settings: your profile, settings, contacts, blocks, chat memberships, business roles, transactions and notifications. Encrypted chats live on your devices and are not part of the export.
Delete your account in Settings, Account: we clear your profile right away, release your number, end your sessions and devices, and delete your two-step PIN and contact fingerprints. If you own an active business, transfer or close it first.
Linked devices: review them and remove any from your phone.
Device permissions such as contacts, camera, location and notifications: withdraw them in your device settings.

For any request about your data, write to [email protected].

How we protect your data

End-to-end encryption for private chats and groups, encryption in transit for all connections, and encryption of data stored on our servers and in backups.
Two-step verification with a 6-digit PIN that locks after 5 wrong attempts.
App lock and chat lock with your fingerprint, face or device passcode.
Short-lived sessions, and the whole session is ended if an old token is ever reused.
Linking a computer needs a code valid for two minutes, scanned by a signed-in phone, and your approval, with at most five computers.

No system is perfectly secure, and we keep improving our protections. If you find a security issue, tell us at [email protected].

Children

SALOPHA is not intended for children. You must be at least 13 years old, or the minimum age in your country if that is higher, to use the service.

Where data is processed

Your data may be processed on servers outside your country, ours or those of the providers listed above. We apply the same protections wherever it is processed.

Changes to this policy

We may update this policy as SALOPHA evolves. We change the “Last updated” date above, and tell you in the app if a change is significant.

Contact us

For privacy questions or data requests: [email protected]. In the app: Settings, then Help.