VutalkTerms & Privacy
Both documents appear in full below. The related pages cover subprocessors, account deletion and reporting.
Privacy Policy
This policy explains what information Vutalk collects, why, how long we keep it, and what you can ask us to do with it. It describes the service as it actually works, including the places where we hold more than we would like to.
Vutalk is operated by a private company, which is the controller of your personal information.
1. Information we collect
The service is designed to know as little about you as possible.
- Email address. Registering requires an email address that can receive a verification code. We store it, in readable form, because it is how you sign back in on a new device and how you recover the same account after reinstalling. It is not searchable: nobody can find you by entering your email address.
- Internal account identifier. Each account carries a number allocated by our server and derived from your email address with a secret key. It exists because the system needs an internal identifier, it is never shown to you or to anyone else, and it does not correspond to any telephone line.
- Username, if you set one. A username is the only way another person can find you. We store a hash of it so that lookups work, plus a ciphertext that only someone holding your link can open.
- Profile information. Your display name, photo and about text are end-to-end encrypted. We cannot read them.
- Technical operating data. To deliver messages and prevent abuse we process the minimum a connection requires: the date of your last connection at day-level precision, the client version, and short-lived data used for rate limiting.
- Push notifications. To wake your device we send Apple's push service a notification containing no message content. Apple consequently learns that your device received a notification from Vutalk. Notification text is composed on your device, after decryption.
- Payment information. Purchases are handled by Apple. We do not receive or store your card number.
2. Information we deliberately do not collect
- No phone number. We never ask for one and never send an SMS.
- No address book. Vutalk does not upload your contacts and performs no contact matching, on our servers or anywhere else. There is no contact discovery feature to disable.
- No advertising identifiers, no third-party analytics, no third-party trackers.
- No log of who you communicate with.
3. What we cannot see
Message content, voice and video calls, attachments, group names and group membership are end-to-end encrypted. The keys exist only on the devices taking part in the conversation, so our servers cannot decrypt any of it. We do not retain your message history or the content of your calls.
4. Why we are allowed to process it
Where the GDPR or a comparable law applies, we rely on the following bases:
- Performance of a contract, for the data needed to create your account and deliver your messages.
- Legitimate interests, for preventing spam, fraud and abuse, and for keeping the service secure and available.
- Legal obligation, where we are required to retain or disclose something.
- Consent, for anything optional, which you can withdraw at any time.
We do not use your information for advertising, and we do not build advertising or behavioural profiles.
5. How people find each other
Only by username. You share a username, a link or a QR code with whoever you want to reach you. Vutalk does not upload your address book, does not match it against our users, and does not let anyone search for you by email address or by number.
If Vutalk asks for access to your contacts, it is only so that you can save someone to your address book or view and share a contact card. That access is used on your device and nothing is sent to us.
6. Sharing of information
- Infrastructure providers. We use cloud providers for servers, storage, networking and content delivery, and an email provider to send verification codes. They act on our instructions. Content reaches them only in encrypted form. See the current list.
- Legal requests. In response to a valid and legally binding request we may disclose the limited account information we hold. Because content is end-to-end encrypted, we cannot produce messages or call content. See our transparency page.
We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising.
7. Retention and deletion
Undelivered messages are removed from our servers as soon as they are delivered, and in any case after 30 days. Deleting your account from within the app removes your profile, your username and your encrypted backup data.
One thing survives account deletion, and we would rather tell you than let you discover it: the record linking your email address to its internal account identifier is kept. It is what lets you use the same address later and land back on the same account instead of being locked out. If you want that record erased as well, email us and we will delete it within 30 days and confirm when it is done — after which the address behaves as though it had never registered.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete personal information about you, to object to or restrict certain processing, and to withdraw consent. Write to xiaosan9288@gmail.com from the address on the account and we will respond within 30 days. We do not charge for this and we will not treat you differently for asking.
If you are in the EEA or the UK and are not satisfied with our response, you may complain to your local data protection authority.
9. California residents
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. The categories we collect, and why, are listed in sections 1 and 4 above. Use the address in section 8 to make a request; we will verify it against the email address on the account.
10. Children
Vutalk is not directed to children under 13, and where your jurisdiction sets a higher minimum age, that higher age applies. We do not knowingly collect personal information from children under 13.
11. International processing
Our servers are located in several countries. To provide the service, your information may be transferred to and processed in a country other than the one you live in. Where we transfer personal information out of the EEA or the UK, we rely on the appropriate safeguards available under the applicable law, such as the standard contractual clauses.
12. Security
We use end-to-end encryption, transport encryption, encrypted local storage and access controls. No system can be guaranteed perfectly secure, and encryption in transit does not help if someone has your unlocked device — so please keep your device lock and your recovery credentials safe.
13. Changes to this policy
We may update this policy. If a change is material we will highlight it in the app or on this page before it takes effect. The date at the top always reflects the current version.
14. Contact us
Questions about this policy go to xiaosan9288@gmail.com.
Terms of Service
These terms form the agreement between you and the company operating Vutalk ("Vutalk", "we") regarding your use of the Vutalk app and related services. By using the service you accept these terms.
1. Eligibility and registration
You must be at least 13 years old, and old enough under the law where you live, to use Vutalk. Registering requires an email address that can receive a verification code. We do not ask for a phone number.
2. Your account
You are responsible for keeping your device, your device lock and your recovery credentials secure. Because content is end-to-end encrypted, we cannot recover lost messages or backup keys for you — no support request can work around this, so keep those credentials somewhere you will still have them.
One account belongs to one person. Do not share it, and do not use it on behalf of someone who is barred from the service.
3. Acceptable use
When using Vutalk, you agree not to:
- engage in unlawful activity, or publish or distribute unlawful content;
- send spam, conduct bulk unsolicited promotion, or commit fraud;
- harass or threaten others, or distribute hate speech;
- distribute content that sexualises minors, or groom or sexually extort a minor;
- interfere with, probe or attempt to compromise the integrity, security or availability of the service;
- access the service through unauthorised automation, or circumvent access limits or quotas;
- impersonate another person or misrepresent your affiliation.
We cannot read your messages, so enforcement rests on reports and on signals visible without reading content. How to report abuse
4. Paid features
Some features may require payment. Prices and billing periods are shown at the time of purchase. For purchases made through the App Store, payment, renewal and refunds are handled under Apple's terms. Except where the law requires otherwise, fees paid are non-refundable.
5. Intellectual property
The Vutalk name, logo and interface belong to us and are protected by intellectual property law. These terms grant you no right to use our trademarks. Content you send remains yours; you grant us only the limited licence needed to deliver it.
Vutalk's clients and server include open-source software distributed under the GNU Affero General Public License v3. Nothing in these terms limits the rights that licence grants you in that code, and the applicable notices are included with the app. Source code requests
6. Export controls
Vutalk contains cryptography and is subject to export control laws. You agree not to use, export or re-export it in violation of those laws, and not to use it if you are located in an embargoed territory or are on a restricted-party list.
7. Changes and suspension
We may add to, change or discontinue parts of the service. We may limit or end your access if you breach these terms, or where doing so is necessary to protect the service and its other users. You may delete your account and stop using the service at any time.
8. Disclaimer
The service is provided "as is" and "as available". To the fullest extent permitted by law, we make no warranties, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the service will be uninterrupted, error-free or perfectly secure.
9. Limitation of liability
To the fullest extent permitted by law, we are not liable for indirect, incidental, special, punitive or consequential damages, or for loss of profits, data or goodwill. Our total liability is limited to the amount you paid us in the 12 months before the claim arose, or USD 100 if you paid nothing. Nothing here excludes liability that cannot lawfully be excluded.
10. Updates to these terms
We may update these terms. Material changes will be flagged in the app or on this page before they take effect. Continuing to use the service after a change is published means you accept the updated terms.
11. General
If a provision of these terms is held unenforceable, the rest remains in force. Our not enforcing a provision on one occasion is not a waiver of it. You may not transfer your rights under these terms; we may transfer ours in connection with a merger, acquisition or sale of assets, on notice to you. These terms are the entire agreement between us about the service.
12. Contact us
Questions about these terms go to xiaosan9288@gmail.com.