VutalkPrivacy Policy
This policy explains what information Vutalk collects, why, how long we keep it, and what you can ask us to do with it. It describes the service as it actually works, including the places where we hold more than we would like to.
Vutalk is operated by a private company, which is the controller of your personal information.
1. Information we collect
The service is designed to know as little about you as possible.
- Email address. Registering requires an email address that can receive a verification code. We store it, in readable form, because it is how you sign back in on a new device and how you recover the same account after reinstalling. It is not searchable: nobody can find you by entering your email address.
- Internal account identifier. Each account carries a number allocated by our server and derived from your email address with a secret key. It exists because the system needs an internal identifier, it is never shown to you or to anyone else, and it does not correspond to any telephone line.
- Username, if you set one. A username is the only way another person can find you. We store a hash of it so that lookups work, plus a ciphertext that only someone holding your link can open.
- Profile information. Your display name, photo and about text are end-to-end encrypted. We cannot read them.
- Technical operating data. To deliver messages and prevent abuse we process the minimum a connection requires: the date of your last connection at day-level precision, the client version, and short-lived data used for rate limiting.
- Push notifications. To wake your device we send Apple's push service a notification containing no message content. Apple consequently learns that your device received a notification from Vutalk. Notification text is composed on your device, after decryption.
- Payment information. Purchases are handled by Apple. We do not receive or store your card number.
2. Information we deliberately do not collect
- No phone number. We never ask for one and never send an SMS.
- No address book. Vutalk does not upload your contacts and performs no contact matching, on our servers or anywhere else. There is no contact discovery feature to disable.
- No advertising identifiers, no third-party analytics, no third-party trackers.
- No log of who you communicate with.
3. What we cannot see
Message content, voice and video calls, attachments, group names and group membership are end-to-end encrypted. The keys exist only on the devices taking part in the conversation, so our servers cannot decrypt any of it. We do not retain your message history or the content of your calls.
4. Why we are allowed to process it
Where the GDPR or a comparable law applies, we rely on the following bases:
- Performance of a contract, for the data needed to create your account and deliver your messages.
- Legitimate interests, for preventing spam, fraud and abuse, and for keeping the service secure and available.
- Legal obligation, where we are required to retain or disclose something.
- Consent, for anything optional, which you can withdraw at any time.
We do not use your information for advertising, and we do not build advertising or behavioural profiles.
5. How people find each other
Only by username. You share a username, a link or a QR code with whoever you want to reach you. Vutalk does not upload your address book, does not match it against our users, and does not let anyone search for you by email address or by number.
If Vutalk asks for access to your contacts, it is only so that you can save someone to your address book or view and share a contact card. That access is used on your device and nothing is sent to us.
6. Sharing of information
- Infrastructure providers. We use cloud providers for servers, storage, networking and content delivery, and an email provider to send verification codes. They act on our instructions. Content reaches them only in encrypted form. See the current list.
- Legal requests. In response to a valid and legally binding request we may disclose the limited account information we hold. Because content is end-to-end encrypted, we cannot produce messages or call content. See our transparency page.
We do not sell, rent or trade your personal information, and we do not share it for cross-context behavioural advertising.
7. Retention and deletion
Undelivered messages are removed from our servers as soon as they are delivered, and in any case after 30 days. Deleting your account from within the app removes your profile, your username and your encrypted backup data.
One thing survives account deletion, and we would rather tell you than let you discover it: the record linking your email address to its internal account identifier is kept. It is what lets you use the same address later and land back on the same account instead of being locked out. If you want that record erased as well, email us and we will delete it within 30 days and confirm when it is done — after which the address behaves as though it had never registered.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete personal information about you, to object to or restrict certain processing, and to withdraw consent. Write to xiaosan9288@gmail.com from the address on the account and we will respond within 30 days. We do not charge for this and we will not treat you differently for asking.
If you are in the EEA or the UK and are not satisfied with our response, you may complain to your local data protection authority.
9. California residents
We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. The categories we collect, and why, are listed in sections 1 and 4 above. Use the address in section 8 to make a request; we will verify it against the email address on the account.
10. Children
Vutalk is not directed to children under 13, and where your jurisdiction sets a higher minimum age, that higher age applies. We do not knowingly collect personal information from children under 13.
11. International processing
Our servers are located in several countries. To provide the service, your information may be transferred to and processed in a country other than the one you live in. Where we transfer personal information out of the EEA or the UK, we rely on the appropriate safeguards available under the applicable law, such as the standard contractual clauses.
12. Security
We use end-to-end encryption, transport encryption, encrypted local storage and access controls. No system can be guaranteed perfectly secure, and encryption in transit does not help if someone has your unlocked device — so please keep your device lock and your recovery credentials safe.
13. Changes to this policy
We may update this policy. If a change is material we will highlight it in the app or on this page before it takes effect. The date at the top always reflects the current version.
14. Contact us
Questions about this policy go to xiaosan9288@gmail.com.