Privacy Policy

Gaslight

Gaslight is a messaging app with no accounts in the usual sense. You are not asked for a phone number, an email address or a password, and none is collected. Your identity is a UserID — eight characters such as A1B2-C3D4 — generated on your device from a recovery phrase that never leaves it.

This page describes what the app actually sends to a server, where that data is held, and how long it stays.

What we collect

Everything in this list is tied to your UserID.

• Your UserID, and an anonymous sign-in record that lets the server tell one device from another. The sign-in carries no personal details of any kind.
• Your public encryption keys. Public halves only. The private halves are derived from your recovery phrase on your device and are never transmitted.
• Your connections — which UserIDs you are connected to, who sent the request, whether it was accepted, declined or blocked, and when.
• The name you type on a connection request. When you add someone, the app offers a field so they can recognise you. Whatever you type there is stored unencrypted and is visible to the person you sent the request to. Leave it blank and nothing is stored.
• Your messages and media, encrypted — text, photos, videos and voice messages. These are encrypted on your device before they are sent. We hold ciphertext and cannot read any of it.
• Your profile picture, if you set one. Unlike messages, an avatar is not end‑to‑end encrypted: it is stored as an ordinary image reachable only through a short‑lived signed link issued to your contacts. It is the one item on this list that our storage provider could technically open. Setting no picture stores nothing.
• A notification token for your device, so a message can wake the app.
• A last‑seen timestamp, and read‑receipt timestamps if you leave read receipts on. Times only, no content.
• Two reliability counters — how often your device had to retry a key lookup during our ongoing move between backends. Numbers only.

What we do not collect

• No phone number, email address or password.
• No real name. The only name we ever hold is one you choose to type.
• No contact list. Contacts are added by UserID or QR code, one at a time.
• No location.
• No advertising identifier, and no analytics, crash‑reporting or attribution software of any kind. There is none in the app, so there is nothing to opt out of.
• Your recovery phrase, and every key derived from it. It is held in your device’s secure keystore and is never sent anywhere. We cannot recover it for you, reset it, or read your messages with it. If you lose both it and your device, that identity is gone.

Tracking

We do not track you. Nothing collected here is used to follow you across other apps or websites, shared with data brokers, or used for advertising. Nothing is sold.

Where it is stored

Gaslight is moving between two backends, so where your data sits depends on which version you run. Both are ours; the difference is set out here because it changes how long things are kept.

• Version 1.0.6 and later — Supabase (hosted Postgres). Identity, keys, connections, notification tokens, last‑seen and messages in transit.
• Version 1.0.6 and later also uses Google Firebase (Firestore and anonymous Firebase Authentication) for two things: a copy of your public encryption keys, and a record linking your UserID to an anonymous Firebase sign‑in.
• Versions before 1.0.6 — Google Firebase for everything the list above names, including messages, which that backend stores rather than relays.
• Backblaze B2 — encrypted photo, video and voice files from both backends, and profile pictures.
• Expo, and through it Apple and Google, deliver notifications. The next section says exactly what they are told.

These providers process connection details such as IP addresses in the course of serving requests, as any hosted service does.

What a notification contains

A notification carries the sender’s UserID, the fixed words “You have a new message”, and an identifier for the conversation. No part of a message is ever put in a notification. It is ciphertext our servers cannot read, and a notification is stored and logged by Expo, Apple and Google on its way to you — so it is deliberately left out.

How long it is kept

• Messages and read receipts in transit, in the main database (Supabase): deleted the moment your device confirms receipt. If a device never comes back, the message is deleted automatically after 30 days. A sweep runs every hour.
• Messages on versions before 1.0.6: kept until deleted. That backend stores conversations rather than relaying them, so there is no automatic expiry. This is the main practical difference between the two, and one of the reasons for the move.
• Encrypted media files: kept until the message they belong to is deleted for everyone. Media is downloaded only when you open it, sometimes long after the message arrives, so a file deliberately outlives the message’s delivery. Files left with no message pointing at them are queued for deletion.
• Identity, keys, connections, notification token and last‑seen: kept while your account exists. Deleting your account removes some of them and not others; the next section lists both.

Deleting your account

You can delete your account from inside the app at any time, with no email or request form. The steps are on the Account & Data Deletion page.

In the main database (Supabase), deleting your account removes your profile record, your public encryption keys and one‑time keys, your connections, your notification tokens, your profile picture, your last‑seen timestamp, and messages and read‑receipt signals addressed to you that had not yet been delivered.

The following remain on our servers after you delete your account, and we would rather say so here than let you find out later.

• Message content and media remain. A conversation belongs to both people in it. Deleting your account removes your own copy and your side of the relationship, but it does not reach into the other participant’s conversation and erase their messages. What stays is encrypted content that only a participant’s device holds a key for. To remove a conversation from your own device first, delete it in the app before deleting your account.
• Messages and read‑receipt signals you sent that the other person’s device had not yet collected. They are encrypted. Each stays until their device collects it or until it is automatically deleted after 30 days.
• A copy of your public encryption keys in Google Firebase.
• A record in Google Firebase linking your UserID to an anonymous Firebase sign‑in.
• An anonymous sign‑in record in our main database. It holds no personal detail, and once your profile record is deleted it is no longer linked to your UserID.
• The two reliability counters remain — your UserID and two numbers. We keep them to monitor the backend move described above. They carry no content and no personal detail, and they are not removed when you delete your account.
• Records that older versions of the app wrote to Google Firebase. Connection, notification‑token, online‑status and read‑receipt documents from those versions are not removed when you delete your account in the main database.

On your device, deleting your account erases your messages, your contacts and nicknames, and the recovery phrase itself. It does not erase your read‑receipt and theme preferences, media you opened (which the app keeps in a cache), cached profile pictures, or any media or backup files you exported or saved. The cache goes when you uninstall the app; files you exported or saved stay until you delete them.

Children

Gaslight is not intended for children under 13, and we do not knowingly collect data from them. Since we collect no age, name or contact details, we have no way to determine a user’s age.

Changes to this policy

If what we collect changes, this page changes with it, and the date below is updated. The backend move described above is in progress, and this page will be simplified once every platform is on one backend.

Contact

Questions about this policy or your data: support@thegaslight.app.