Draft. This document needs legal review and the items marked [FILL IN] must be completed before publication. Remove this block once approved.

Privacy policy

Last updated: 28 October 2026

1. Who is responsible for the data

The SECUNITY Messaging app connects only to the server run by your organisation or by the person who set it up (the Server operator). The Server operator is the controller of your data. SECUNITY, as the app vendor, does not run the server and has no access to your data unless it is also the Server operator. Operator details: [FILL IN: name, address, e-mail, data protection officer if any].

2. What data the server processes

• account identifier, display name and avatar (if set),
• messages and attachments; in end-to-end encrypted conversations the server stores only encrypted data that it cannot read,
• an encrypted copy of your keys (if you create a recovery key); the server does not know the recovery key,
• technical metadata: list of devices, room membership, message time and size, IP addresses in server logs,
• push notification token and notification server address.

3. What the app does not do

• it contains no analytics, ads or tracking tools,
• it sends no crash reports outside the Operator's server,
• it does not connect to the vendor's or any third party's servers,
• it does not use Google Firebase services (Android version).

4. Notifications

On Android, notifications are delivered by the Operator's notification server. The notification contains no message content; the app fetches it from the server after receiving the signal. [FILL IN when the iOS version is released: notifications on iOS pass through the Apple Push Notification service.]

5. Legal basis and retention

[FILL IN: legal basis for processing (e.g. contract, legitimate interest, consent), message and log retention period set by the Operator.]

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection, and to lodge a complaint with a supervisory authority. Send requests to the Server operator: [FILL IN: contact address].

7. Security

Connections to the server are encrypted (HTTPS) and conversation content is end-to-end encrypted. Remember to protect your recovery key (how).

8. Changes

We will announce changes to this document on this page.