Privacy Policy

The short version

Dap has no accounts. We do not ask for your phone number, your email address, or a username, and there is nothing to sign up for. Your identity is a key pair your phone generates the first time you open the app and keeps on the device.

We never see your messages. They are end-to-end encrypted on your phone and decrypted on your contact's phone. Our relay only ever handles sealed ciphertext it cannot open, and it does not log your IP address.

We run no analytics, no trackers, and no advertising of any kind in the app. Our website keeps simple, cookieless visit statistics, which are described under “This website” below.

What we do not collect

There is no account record, so there is no profile to hold. Specifically, Dap does not collect or upload your phone number, your email address, your name, your address book or contact list, your location, or any device advertising identifier. Dap has no contact-discovery feature — it never uploads contacts to look for people you may know, because it has nothing to look them up against.

You add someone either in person, by showing each other a QR code, or through an invite link. In an invite link the key material travels in the part of the address after the #. Browsers do not send that part to the server, so the invite itself is not something our web server receives.

What our relay can see

To deliver a message when the other phone is offline, Dap stores it briefly on a relay we operate. The relay is built to know as little as possible, and it is worth being exact about what that means.

It can see: sealed ciphertext it has no key for, and the size and timing of that ciphertext; the opaque mailbox addresses a message is deposited to or collected from; that someone presented a valid token issued by the recipient; and how many mailboxes are currently open.

It cannot see: the contents of any message, who a mailbox belongs to, or who sent anything. Nothing in the relay accepts plaintext — the only thing it can be handed is a sealed envelope.

The connection between your phone and the relay is set up so your phone does not present a fixed identifier. Your network address is deliberately discarded rather than recorded: there is no per-connection, per-message or per-collection logging in the relay.

What is stored, and for how long

Messages. A message waiting for delivery is held as ciphertext and is deleted the moment your contact's phone collects it. If it is never collected, it expires on its own after 7 days.

Mailbox records. The small record that makes a mailbox addressable, together with the ticket used to send you a notification, is kept for up to 30 days and is refreshed each time that mailbox is used. So for a conversation you are actively using, that record persists rather than ageing out. It contains no identity, no message content and no network address.

Channels are different. Broadcast channels — Dappies, such as Iown News — are one-to-many and are not deleted when you read them. A channel post stays on the relay until it expires, so that everyone subscribed can still fetch it. Treat channels as public-ish announcements, not private conversations.

Everything else — your messages, your contacts, your keys — lives on your phone. Removing the app removes them. We hold no copy and cannot restore them for you.

Notifications

If you turn on notifications, Apple (APNs) or Google (FCM) hold a delivery token for your device, and our relay uses it to send a content-free ping so your phone knows to go and look. The alert text is fixed — it says only that there is a new message. No part of your message, and no sender information, is included in it or sent to Apple or Google.

Because one device token is used for the mailboxes on that device, the relay can tell that those mailboxes belong to the same phone. We would rather say so than imply otherwise.

What we do not claim

A privacy policy is only useful if it is honest about the edges, so here is what Dap does not protect against today.

Message contents are hidden, but the size and timing of sealed messages are visible to anyone who can watch the relay, and so is the fact that a particular mailbox address became active.

In the current app, the mailbox address used for a given contact stays the same for as long as that contact exists. The underlying protocol can rotate those addresses, but the shipped app does not yet do it, so we do not claim it.

The address used to receive introductions is derived from your public invite details, which means anyone holding your invite can work out that address and see when it is active — though not who you are or what was said.

When your phone connects, it opens the mailboxes for your conversations in one session. The relay cannot tell who you are, but it can tell that one anonymous user has roughly this many conversations and follows these channels. Hiding that would need an anonymising network, which Dap does not use today.

Your choices and your rights

You can leave or re-join any channel in settings, remove a contact at any time, and turn notifications off. Deleting the app deletes your identity and your message history from the phone; because we hold no account, there is nothing for us to delete on your behalf and nothing we could return to you if you asked for a copy.

Dap is not directed at children under 13, and we do not knowingly collect information from them. Since we collect no personal information at all, there is none to sell or share, and we do not.

This website

Everything above is about the Dap app and our relay. This page is part of our website, and the website keeps simple visit statistics — so it is worth being exact about that too, rather than letting “no analytics” read as covering both.

The measurement is cookieless. It sets no cookie, writes nothing to your browser’s storage, and does not fingerprint your device — so there is no consent banner to click, because there is nothing on your device to consent to. What it records is the page you looked at, the page you arrived from, how long you stayed, and your browser and device type, which your browser sends to any website you visit.

It does record your IP address, and derives an approximate country and city from it — on our own server, not by asking a third party. An IP address is personal data, and we would rather say so plainly than describe this as anonymous. Visits are grouped using a key that is recomputed from your IP and browser each day and cannot be reversed, so there is no lasting identifier: we cannot follow a visitor from one day to the next, or from this site to any other.

There is no advertising on this site and no ad network on it. If you arrive from an ad on another service, the click identifier in the web address is recorded for our own measurement only and is not sent back to that service. Nothing collected here is sold or shared, and none of it is linked to anything in the app — the app has no account and sends us nothing that could be joined to a website visit.

If your browser sends the Global Privacy Control signal we honour it, and you can opt out directly at Your Privacy Choices or by emailing support@iownsoftware.com. Our lawful basis for this limited measurement is legitimate interest in understanding whether the site is working.

Contact and changes

Dap is made by I Own Software LLC, 321 N Mall Dr, R259, Saint George, UT 84790, United States. For privacy questions, email support@iownsoftware.com.

If this policy changes in a way that affects what is collected or how long it is kept, we will update this page and the date at the top. Our company-wide documents are the Terms and Conditions, the I Own Software Privacy Policy and Your Privacy Choices; where they and this page differ about Dap, this page governs.