🛡️ VaultChat does not operate central servers and does not collect personal data. No phone number, email address, or user account is required or stored.
VaultChat operates on a decentralized architecture using the Nostr open protocol. Specifically:
All application data is stored locally on your device in an encrypted format. See Section 2.
All application data — messages, contacts, conversation history, and identity keys — is stored exclusively on your device:
flutter_secure_storage backed by Android Keystore (Android) or Secure Enclave (iOS). The key is hardware-protected and is not transmitted.allowBackup=false and full data_extraction_rules configuration. Your data cannot be extracted through Google backup services.VaultChat implements the NIP-44 v2 specification for end-to-end message encryption:
Your private key never leaves your device. Without your private key, messages cannot be decrypted — including by VaultChat developers.
✓ If you lose your private key and have no backup, your message history cannot be recovered by anyone.
VaultChat relies on the following third-party infrastructure to function:
Nostr relay servers — Messages are routed through independent public relay servers. VaultChat currently connects to: relay.damus.io, nos.lol, relay.nostr.band, relay.primal.net, nostr.wine, and purplepag.es. These are third-party services not operated by VaultChat.
⚠️ Relay server operators receive encrypted message payloads and cannot read message content. However, relay operators may observe: the public keys of communicating parties, approximate message size, and message timing. This is an inherent characteristic of the Nostr protocol architecture.
File hosting services — When sending file attachments, files are encrypted AES-256-GCM on your device before upload to third-party file hosting services. These services receive only encrypted binary data and cannot read file contents.
VaultChat does not use advertising networks, analytics platforms, or crash reporting services that transmit personal data to third parties.
VaultChat does not require and does not collect:
Your identity is a cryptographic keypair generated locally on your device. Your public key serves as your identifier. It was generated mathematically on your device — VaultChat did not assign it and has no record of it.
VaultChat is not directed to children under the age of 13. We do not knowingly collect personal information from children. Because VaultChat collects no personal information from any user, this principle applies equally to all users regardless of age.
Parents or guardians with concerns may contact us at contact@vaultchat.app.
VaultChat does not collect or store personal data on any server. Most GDPR rights are satisfied by the application's architecture:
For any privacy-related request, contact us at: contact@vaultchat.app
We may update this Privacy Policy as the application evolves. Material changes will be communicated through an update to the date at the top of this page and a notice in the GitHub and release notes.
Continued use of the application after a policy update constitutes acceptance of the revised policy.
VaultChat is designed to leave no automatic traces of files or messages on your device. However, users should understand the following distinctions:
✔ VaultChat does not automatically save received files (images, PDFs, documents) to your device gallery or file storage. Files are decrypted in memory only when you open them and are not written to permanent storage by the application.
What VaultChat does NOT do automatically:
What remains outside VaultChat control:
⚠ VaultChat guarantees: no automatic traces. VaultChat cannot guarantee: no traces if the user explicitly saves, screenshots, or shares content. This distinction applies equally to all privacy-focused messaging applications, including Signal and similar products.
When a conversation is deleted:
The deletion is synchronized to both devices simultaneously. After deletion, the files cannot be recovered through VaultChat.
For privacy-related questions, data requests, or concerns:
We aim to respond to all privacy-related enquiries within 72 hours.