Privacy Policy

Gaslight

Gaslight is a messaging app with no accounts in the usual sense. You are not asked for a phone number, an email address or a password, and none is collected. Your identity is a UserID — eight characters such as A1B2-C3D4 — generated on your device from a recovery phrase that never leaves it.

This page describes what the app actually sends to a server, where that data is held, and how long it stays.

What we collect

Everything in this list is tied to your UserID.

• Your UserID, and an anonymous sign-in record that lets the server tell one device from another. The sign-in carries no personal details of any kind.
• Your public encryption keys. Public halves only. The private halves are derived from your recovery phrase on your device and are never transmitted.
• Your connections — which UserIDs you are connected to, who sent the request, whether it was accepted, declined or blocked, and when.
• The name you type on a connection request. When you add someone, the app offers a field so they can recognise you. Whatever you type there is stored unencrypted and is visible to the person you sent the request to. Leave it blank and nothing is stored.
• Your messages and media, encrypted — text, photos, videos and voice messages. These are encrypted on your device before they are sent. We hold ciphertext and cannot read any of it.
• Your profile picture, if you set one. Unlike messages, an avatar is not end‑to‑end encrypted: it is stored as an ordinary image reachable only through a short‑lived signed link issued to your contacts. It is the one item on this list that our storage provider could technically open. Setting no picture stores nothing.
• A notification token for your device, so a message can wake the app.
• A last‑seen timestamp, and read‑receipt timestamps if you leave read receipts on. Times only, no content.
• Two reliability counters — how often your device had to retry a key lookup during our ongoing move between backends. Numbers only.

What we do not collect

• No phone number, email address or password.
• No real name. The only name we ever hold is one you choose to type.
• No contact list. Contacts are added by UserID or QR code, one at a time.
• No location.
• No advertising identifier, and no analytics, crash‑reporting or attribution software of any kind. There is none in the app, so there is nothing to opt out of.
• Your recovery phrase, and every key derived from it. It is held in your device’s secure keystore and is never sent anywhere. We cannot recover it for you, reset it, or read your messages with it. If you lose both it and your device, that identity is gone.

Tracking

We do not track you. Nothing collected here is used to follow you across other apps or websites, shared with data brokers, or used for advertising. Nothing is sold.

Where it is stored

Gaslight is moving between two backends, so where your data sits depends on which version you run. Both are ours; the difference is set out here because it changes how long things are kept.

• Android 1.0.6 and later — Supabase (hosted Postgres). Identity, keys, connections, notification tokens and messages in transit.
• iOS, and Android before 1.0.6 — Google Firebase (Firestore and anonymous Firebase Authentication). The same categories.
• Backblaze B2 — encrypted photo, video and voice files from both backends, and profile pictures.
• Expo, and through it Apple and Google, deliver notifications. The next section says exactly what they are told.

These providers process connection details such as IP addresses in the course of serving requests, as any hosted service does.

What a notification contains

A notification carries the sender’s UserID, the fixed words “You have a new message”, and an identifier for the conversation. No part of a message is ever put in a notification. It is ciphertext our servers cannot read, and a notification is stored and logged by Expo, Apple and Google on its way to you — so it is deliberately left out.

How long it is kept

• Messages in transit, on Android 1.0.6 and later: deleted the moment your device confirms receipt. If a device never comes back, the message is deleted automatically after 30 days. A sweep runs every hour.
• Messages on iOS and older Android versions: kept until deleted. That backend stores conversations rather than relaying them, so there is no automatic expiry. This is the main practical difference between the two, and one of the reasons for the move.
• Encrypted media files: kept until the message they belong to is deleted for everyone. Media is downloaded only when you open it, sometimes long after the message arrives, so a file deliberately outlives the message’s delivery. Files left with no message pointing at them are queued for deletion.
• Identity, keys, connections, notification token, last‑seen and read receipts: kept while your account exists, and removed when you delete it.

Deleting your account

You can delete your account from inside the app at any time, with no email or request form. The steps, and the full list of what is erased, are on the Account & Data Deletion page.

Two things survive deletion, and we would rather say so here than let you find out later.

• Message content and media remain. A conversation belongs to both people in it. Deleting your account removes your own copy and your side of the relationship, but it does not reach into the other participant’s conversation and erase their messages. What stays is encrypted content that only a participant’s device holds a key for. To remove a conversation from your own device first, delete it in the app before deleting your account.
• The two reliability counters remain — your UserID and two numbers. We keep them to monitor the backend move described above. They carry no content and no personal detail, and they are not removed when you delete your account.

Everything Gaslight stored on your device — messages, contacts, settings and the recovery phrase itself — is erased at the same time.

Children

Gaslight is not intended for children under 13, and we do not knowingly collect data from them. Since we collect no age, name or contact details, we have no way to determine a user’s age.

Changes to this policy

If what we collect changes, this page changes with it, and the date below is updated. The backend move described above is in progress, and this page will be simplified once every platform is on one backend.

Contact

Questions about this policy or your data: rashidbahattabmp@gmail.com.