privacy policy

last updated: September 17, 2026

hqchat (listed on the App Store as hqChat) is an end-to-end encrypted messenger. This policy describes what the app and its servers do and do not collect. The guiding principle: it is built so that we cannot read your messages.

what we cannot see

Your messages are end-to-end encrypted on your device using an HQC-256 post-quantum key exchange and AES-256-GCM. The keys are generated on your device and never leave it. Our servers relay already-encrypted data between devices and are technically unable to decrypt it.

what we store

• Your username — the handle you choose, so others can find you.
• Your public key — needed to route encrypted messages to you.
• Friend connections — stored so we can deliver messages and presence.
• Undelivered messages — if you are offline, the encrypted message is held in your session on our message broker, in memory, for when your device reconnects. We cannot read it, and it is not written to any database. The session holds at most 1000 messages and ends after two hours offline: past either limit, undelivered messages are dropped, oldest first, and never arrive.
• Push token — if you enable notifications, so we can wake your device. Notification payloads contain no message content.
• A message you report, if you report one — reporting uploads your own copy of that message so a human can read it (App Store Guideline 1.2 requires a way to report content, and a report with nothing to look at is a complaint). A report also records who filed it, who it is about, and which conversation it came from. It is deleted after 90 days. We cannot verify an excerpt — it is the reporter's own copy and anyone could type anything — so it is read as what somebody handed in, not as proof of what was said.
• Who you have blocked — a row naming the two accounts, so a block holds across your devices and cannot be walked around by adding you again. Deleted with your account.
• A supporter name, if you type one — donations are optional and processed by Stripe. If you choose to put a name on the supporters page, that name is stored on its own: no email, no hash of one, no customer id, no amount, and nothing linking it to any account. A donation and an identity cannot be connected from our database by anyone, including us. If you type nothing, nothing is stored at all.

what we do not collect

• No message content — we cannot decrypt it. The single exception is a message you choose to report: see "what we store" above and the end-user licence agreement. We would rather carry the asterisk than write a sentence that stops being true the first time somebody reports harassment.
• No address-book or contact uploads.
• No advertising identifiers, ad networks or third-party ad trackers.
• No behavioural or advertising analytics, and no profiling for marketing. (We do collect crash and hang reports — see below.)
• No selling or sharing of personal data, ever.

crash reports and diagnostics

We use Sentry (Functional Software, Inc.) for crash reporting. The app sends a report only when it crashes, hangs for two seconds or more, or is stopped by the system for using too much memory. A report may contain the app and OS version, device model, language and region; the crash or hang itself, including stack traces; and up to 50 of the app's events before it (memory warnings, which screen was open), with usernames, ids and key-shaped strings removed on the device. It contains no performance tracing, no record of network requests, no screenshots or screen recordings, and no user or installation identifier. On the server only, a report may include your username or public key when that is needed to reproduce a routing error.

Your encrypted messages are never included and remain unreadable to us and to Sentry. This data is used solely to diagnose stability problems — never for advertising, never to build a profile — and is not sold or shared. Sentry processes it as our data processor under its own privacy terms.

your private keys

Your identity's private key is stored in the device Keychain and Secure Enclave, protected by your device biometrics. It is never transmitted to us. If you delete the app or reset your data, the identity — and your ability to decrypt past messages on that device — is permanently lost. This is by design, and there is no recovery path.

deleting your account

You can permanently delete your account at any time from the app: settings → delete account. This removes your username, public key, friend connections, push token, queued messages and your blocks from our servers, and erases the data stored on your device. It cannot be undone.

One thing does not go, and we would rather explain it than leave it out. A report somebody filed about you survives your account deletion, until its own 90 days are up. If it did not, deleting an account would be a way to erase the complaints against it — delete, re-register, start again — and a reporting mechanism that works like that is not one. What deletion does do to reports is remove your half: every report you filed stops naming you as the person who filed it. The message excerpt in it was one you chose to hand in about somebody else, so it stands, and it expires on its own clock either way.

data retention

Undelivered messages live only until delivery. Account data persists until you delete your account. Reports are deleted 90 days after they are filed — not when the account they name is deleted, and not when the reporter's is; the clock is the report's own and nothing lengthens or shortens it. Donation records are held by Stripe, not by us, and are retained by Stripe as required for payment and tax purposes.

children

hqchat is not directed to children under 13 (or the minimum age in your country) and we do not knowingly collect their data.

third parties

We use Apple (push notifications), Stripe (donations), Cloudflare (network and edge) and Sentry (crash reporting). Each processes only the limited data described above under their own privacy terms.

changes

We may update this policy; material changes will be reflected by the date above.

contact

Questions about privacy: support@martinrougeron.me.