Privacy Policy

We cannot read your messages

Every message, voice note, photo and video you send is encrypted on your own device before it leaves it, using AES-256-GCM with keys exchanged via ECDH P-256. Only you and the person you are chatting with hold the keys needed to open them.

Our servers store only unreadable encrypted data. We cannot decrypt your conversations, we cannot hand their contents to anyone, and we cannot recover them if you lose your password.

Your keys stay on your device

Your private key is generated on your device when you create your account and is protected by your password and PIN. It is never sent to us in a usable form. Because of this, losing your password means past messages cannot be recovered by anyone, including us.

What we do process

• •Account details: your email address, username and display name, used to sign you in and let friends find you.
• •Delivery information: which accounts are members of a conversation and when a message was delivered or read, so encrypted messages reach the right device.
• •Notification tokens: a device identifier used to send you alerts about new messages or money received.
• •Profile content: your avatar and anything you choose to post publicly, such as Moments.
• •Payment records: the amount, currency, status and date of transfers you make or receive.

Payments

Payments are processed by Stripe, and payouts to China are processed by Wise. Card numbers, bank details and identity documents are collected and held by those providers under their own privacy policies — UniChat never stores your card number or banking credentials.

We do keep a record of your transactions so your wallet history and balances are accurate, and because payment providers require us to keep records for anti-fraud and accounting purposes.

Email and notifications

If a push notification cannot reach you, we may email you to let you know a message is waiting. That email contains the sender's name and a link to open the chat — never the message itself, which remains encrypted and unreadable to us and to the email provider.

What we never do

• •We do not sell your data or share it with advertisers.
• •We do not use your data to build advertising profiles.
• •We do not track your location.
• •We do not read, scan or analyse the contents of your chats — technically we cannot.

How long we keep things

Encrypted messages remain stored so you can reload your history on your devices. Account information is kept while your account exists. If you ask us to delete your account, your profile, messages and contacts are removed, except payment records we are required to retain for legal and accounting reasons.

Your rights

You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account. Since your message contents are encrypted with keys only you hold, an export can only include your account and payment information.

Children

UniChat is not intended for anyone under 16 years old. If you believe a child has created an account, contact us and we will remove it.

Changes to this policy

If we change this policy in a way that affects you, we will update the date at the top of this page and, where the change is significant, let you know in the app.