Download

Documents

Privacy policy

Last updated: August 15, 2026

This is a courtesy translation: if the two versions differ, the original Italian text prevails. Read the original

Privacy, explained simply

Your privacy is the reason Hidesay exists.

Every message is encrypted directly on your device before it is sent. Our servers only receive data that is already encrypted, and they don’t have the private key needed to read it.

Hidesay is designed around a very simple principle: the server should know as little as possible. It keeps only the information strictly necessary to make the service work, and nothing more.

What the server needs to know

For Hidesay to work, the server has to handle some technical information.

Your account

When you create an account, a random identifier is generated and you receive an access token.

That token is the only credential needed to access your account.

The server never stores the token in plain text. It only stores a hash computed with Argon2id, enough to check that the token is valid but impossible to use to rebuild the original token. In practice, your token stays known only to you and your devices.

If you choose to fill in your profile, the server also stores:

  • your username and any additional usernames;
  • first name, last name and bio;
  • your public PGP key and its fingerprint;
  • profile photo and cover image.

Your private key, on the other hand, never leaves your device.

Sessions

So that you can see which devices are linked to your account and sign them out whenever you want, the server keeps a list of active sessions.

For each session, it stores:

  • the hash of the session token;
  • creation date;
  • last use;
  • expiry date;
  • device name;
  • platform;
  • app version;
  • operating system version.

If you turn on two-step verification, the server only stores the information essential to the method you chose:

  • the TOTP secret, if you use an authenticator app;
  • or the hash of the additional password;
  • or your email address, if you choose to receive codes by email.

Recovery codes, too, are stored only as hashes.

Messages

Messages are encrypted on your device before they are even sent.

The server only receives:

  • the message, already encrypted with OpenPGP;
  • the metadata essential for delivery (sender, recipient or conversation, date and time, any reply to another message);
  • the information needed to handle reactions, pinned messages and channel views.

Attachments are treated the same way: they reach the server already encrypted, and the server cannot read their content.

Groups and conversations

To manage groups and channels, the server needs to know some organizational information, for example:

  • members;
  • roles;
  • permissions;
  • any restrictions or bans;
  • invitations and join requests;
  • archived, pinned or muted chats;
  • folders;
  • read markers;
  • blocked users;
  • custom names assigned to contacts.

This information exists solely to make the app work.

Push notifications

To deliver notifications, we use Firebase Cloud Messaging (FCM).

The server stores your device’s FCM token, needed solely to reach it when a new message arrives.

When someone writes to you, Google does not receive the content of the message.

Only a small, invisible technical notification is sent through Firebase, and its sole purpose is to wake up the app when it is in the background.

That notification does not contain:

  • the text of the message;
  • the sender;
  • the conversation;
  • attachments;
  • any information that could be used to reconstruct the content of the communication.

When the app wakes up, it connects directly to the Hidesay servers, downloads the already encrypted message, decrypts it only on your device, and only then shows the visible notification.

In other words, the content of your conversations does not pass through Firebase.

What never reaches our servers

There is information we don’t ask for and never receive.

This includes:

  • phone number;
  • contact list;
  • location;
  • advertising identifiers;
  • biometric data;
  • IP addresses.

This information also always stays on your device:

  • your OpenPGP private key;
  • the key passphrase;
  • the app PIN;
  • any biometric data used to unlock it.

We have no access to any of this information.

Why this data is needed

The information the server handles is used solely to:

  • authenticate your account;
  • deliver messages;
  • sync multiple devices;
  • manage groups and channels;
  • send you push notifications;
  • protect your account from unauthorized access.

We do not use your data for:

  • advertising;
  • profiling;
  • marketing;
  • training artificial intelligence models.

We do not sell, rent or hand over users’ data to anyone.

When you delete something, it’s really deleted

On Hidesay there is no such thing as "deleted from the app but kept on the server".

When you delete something, the server deletes its own copy too.

This applies to:

  • messages deleted for everyone;
  • chats and histories;
  • groups and channels;
  • attachments;
  • profile photos;
  • cover images;
  • reactions;
  • settings;
  • folders;
  • blocks;
  • and any other data associated with your account.

We do not keep hidden copies or searchable archives of deleted content.

The only exception concerns what has already been downloaded to other users’ devices. If a message has already been received and stored on the recipient’s device, we have no way to access that device or to delete its content.

How long data is kept

The server keeps data only for as long as necessary.

  • Messages encrypted with PGP remain until they are deleted or until any self-destruct timer expires.
  • Sessions remain until you sign out or until they expire.
  • Temporary two-step verification codes are deleted automatically a few minutes after failed sign-ins, or instantly after a successful sign-in.
  • Profile information remains for as long as you choose to keep your account.

Deleting your account

You can delete your account at any time, on your own, inside the app: Access and security → Account → Delete account. There’s no need to write to us or to wait for someone to process a request. You’ll find every step on the Delete account page.

To confirm, we ask for your full access token, not just the session already open on your phone, and for your second factor if you have turned one on. Recovery codes are not enough: they are for getting back into an account, not for closing it.

Two different ways to close your account

We ask you what to do with the messages you have already sent, because the result for your data is different.

If you choose to delete them, your account row and everything linked to it are erased from the database, including the messages you wrote in private chats, groups and channels. A private chat is made of two people: if you also delete the messages, the other person’s copy disappears too, because half a conversation cannot exist.

If you choose to leave them with the people who received them, the content of the messages remains readable to those who received them, but your account still stops being identifiable: name, username, bio, photo, public key, token and second factor are erased and replaced by a random identifier that does not lead back to you. It is not a "kept" account: it is a profile made anonymous, shown to those who read those messages as "Deleted account", which nobody, you included, can access anymore. In data protection terms, your personal data is erased anyway; only the content of the messages remains, which is also the other person’s data and not just yours.

Groups and channels

If you own groups or channels, deleting your account closes them for all members, whatever you chose for your messages: they belong to you and are not automatically passed on to anyone else. In groups where you are simply a member, on the other hand, deleting your account is the same as leaving: the group carries on for those who stay.

What is removed in any case

  • your profile;
  • your usernames;
  • your public key;
  • uploaded images;
  • all sessions, on every device;
  • push notification tokens;
  • settings;
  • memberships in groups and channels;
  • any other data associated with your account.

Copies of messages that have already been downloaded to other participants’ devices remain on their devices, because we have no access to users’ devices.

Deletion is immediate and permanent: the token stops working the instant you confirm, and we keep no backups from which to restore an account closed by mistake. Precisely because it requires the token, if you have lost it together with any second factor, we have no technical way to verify that the account is yours, so we cannot delete it for you on a written request.

Your rights

If the GDPR applies to you, you can ask at any time to:

  • access your data;
  • correct it;
  • erase it;
  • restrict its processing;
  • object to its processing;
  • receive it in a portable format.

We can provide you with everything stored on our servers. As for messages, we can only give you the encrypted version, because that is the only form in which they exist on our systems.

Write to [email protected] to exercise any of these rights. You also have the right to lodge a complaint with the supervisory authority of your country; in Italy, this is the Garante per la protezione dei dati personali.

In a nutshell

Hidesay is designed to know as little as possible.

Your messages are encrypted before they leave your device.

Your private key is never transmitted.

Your access token is never stored in plain text.

Firebase does not see the content of your conversations.

And when you delete something, it is deleted from our servers too.

See also the terms of service and the page on the security model.