Privacy, in plain words.

QuietLink Privacy Policy · Effective 18 September 2026 (v3 update)

Who operates the service

QuietLink is operated by GLOBIFANTASY - IMIGRAÇÃO, UNIPESSOAL LDA, Rua Conde Almeida Araújo, nº 7, 2745-155 Queluz, Sintra, Portugal. Contact snk.spears@gmail.com for support, privacy or safety requests.

This policy covers the app and the hosted service at quietlink-api.onrender.com. If your administrator gives you a different server, ask that operator about their hosting, account administration and retention practices.

Account and service information

An administrator creates your username and account identifier and gives you an invitation. There is no public registration. The server stores account status, administrator permissions, invitation expiry and hashed invitation/session credentials. It also stores conversation membership, message and call identifiers, participants, timestamps, message types and sizes, opening/read status, deletion status, settings, block records and notification-delivery status. Administrators can create accounts, replace invitations, edit display names, disable access or permanently delete accounts.

In v3, display names and optional profile photos are readable service data, not end-to-end encrypted. Your stable account identifier and username do not change when your display name changes. Profile images are validated, resized and stripped of embedded metadata, then stored as JPEG; only authenticated friends, conversation participants, the account owner or an administrator can fetch them, subject to blocking. Do not use a sensitive image as your profile photo. No phone address-book access is needed.

Friend lists record relationships between existing accounts. Optional friendship codes expire after 24 hours and can be redeemed once; these differ from activation invitations and grant no administrator access. Only code hashes are stored. The server records their creator, expiry and successful redemption until expiry cleanup. Code-attempt counters protect against abuse. Existing conversations remain usable when a friendship is removed.

Messages, attachments and PINs

The app encrypts message and attachment content before sending it to the selected server. The server stores encrypted payloads and encrypted chat-key information. Device access PINs and shared chat PINs are not sent in plaintext. A four-digit chat PIN has only 10,000 possibilities and offers limited resistance to guessing, especially if encrypted key information is obtained. Encryption is not a promise of protection from every attacker.

Recipients decrypt content on their own device. Received attachments have no in-app Save or Share button. Outgoing voice recordings briefly use a protected temporary file, removed after completion, cancellation, backgrounding, or cleanup at a later launch following interruption. Original files selected from Photos or Files remain where you saved them. QuietLink cannot prevent every screenshot, another camera, or copies made outside the app.

Weather and location

Weather is optional. With permission, the app uses your location while open, rounds device latitude and longitude to one decimal place, and sends those approximate coordinates to Open-Meteo. City searches send the city name to Open-Meteo's geocoding service. These requests go directly to the provider, which also receives connection information such as your IP address. Open-Meteo says its troubleshooting logs may include coordinates and are retained for up to 90 days. See Open-Meteo's privacy information. You can use a city search or change location permission in device Settings. For v3 weather notifications, the app can also send its observed temperature and observation time to the QuietLink server, linked to your account. No coordinates or city name are sent to that backend by this API. The latest snapshot replaces the previous one; a snapshot older than two hours is no longer used for push wording and is cleared by service housekeeping. A device may retain its own weather cache. Weather from a selected city must not be presented as your device location.

Notifications

If allowed, Apple Push Notification service and Google Firebase Cloud Messaging process delivery information. Our server stores your push token and notification permission state against your account. Firebase uses installation and messaging identifiers. Legacy custom notification titles and messages are stored in readable form and may be sent through notification providers to a recipient's lock screen. Updated v3 clients select weather notifications: the server uses the recipient's recent temperature snapshot or an honest refresh message when no fresh snapshot is available; it does not use sender-written text in this mode. Temperature and observation data are readable service information. Android may format a notification using its own recent device weather cache. Weather refresh and delivery depend on device activity and connectivity. The app does not automatically include private message text or PINs in push payloads. Do not put private content, PINs or invitation codes in your custom notification wording. An alert already accepted by a provider may still arrive after sign-out, blocking or deletion.

Audio and video calls

WebRTC carries microphone audio and optional camera video to the other participant. Encrypted connection signalling passes through our server, which stores call participants, mode, state, timing and encrypted signalling. Encrypted signalling is cleared when the call ends or expires; call status and timing records remain until account deletion. QuietLink has no call-recording feature. Peers and configured network traversal or relay providers can process IP addresses and connection information. Calls require the relevant microphone/camera permissions and end when the app backgrounds or the device locks.

Safety reports

Blocking stops new communication between the two accounts. Reporting sends your account identity, the reported account, a reason, and the explanation you choose to write to the server administrator. Reports are not anonymous. No private message, attachment or recording is attached automatically. Administrators can review reports and disable abusive accounts. A limited on-device text check rejects some explicit abusive phrases; it does not send those checks to the server and does not scan media or calls.

Device storage and permissions

The device stores access-PIN verification and retry information and your account session in Keychain. Unlocked chat keys are kept in memory rather than intentionally persisted in Keychain. Permissions are requested for features you choose: location, notifications, camera and microphone. File selection shares the selected item, not your whole photo library or address book. Manage permissions in iPhone Settings.

Providers and processing purposes

We use Render for hosting, Apple and Firebase for notifications, Open-Meteo for weather, and configured WebRTC services for call connectivity. They process the data needed for those functions, including technical service data. Data can be processed outside your country. We use account, content and delivery information to provide the features you request; safety and limited technical records help protect the service. Optional device permissions can be withdrawn in Settings. Support correspondence is used to answer your request. Do not email PINs, invitation codes or unnecessary private content.

Retention and deletion

Retained texts stay until deleted. In v3, users can apply their timer to future sent texts, received texts, or both. If the sender's sent policy and recipient's received policy both apply, the shorter enabled timer wins. The timer is fixed when a new message is sent and begins when the recipient opens it. Automatic payload expiry affects both participants' active service copies. Settings changes do not retime existing messages. Older v1-format sends retain their original behavior. View-once payloads are removed from active server records during the one-time opening flow. Attachments use view-once handling. Delete for me hides a message from your account. Deleting a conversation for yourself hides the conversation and its existing messages only for your account; your partner retains their history. A new message can bring the conversation back, but earlier hidden messages stay hidden. This does not erase the shared server payload needed by the other participant. A sender's Delete for both removes its active encrypted payload for both participants. Message identifiers, timestamps and status metadata can remain after payload removal.

In iOS version 1.0.0 build 2 or later, Settings → Delete account permanently removes your account, session and invitation credentials, push binding, settings, display name, profile image, weather snapshot, friendships, friend invitations by or redeemed by the account, abuse-prevention counters, blocks, and all conversations involving your account—including their message, attachment and call records—from the active service for both participants. Reports by or about the deleted account are also removed. Your partner's unrelated conversations remain. Signing out or disabling an account is not deletion. Your local device access PIN remains until changed or removed through device/app management.

Administrators can permanently delete another account with the same active-data cleanup; the admin deletion route prevents self-targeting and removal of the last enabled administrator. Profile photos can also be removed separately. Weather snapshots expire after two hours, friend invitations after 24 hours, and feature-attempt counters are cleaned after one day. Other account and operational records remain while the account exists; no general time-based purge is applied. Resolving or dismissing a report retains its details unless the relevant account is deleted or the operator separately removes it. Manual safety backups and provider snapshots may retain older data after active deletion. They are not changed by in-app deletion and currently have no single fixed automatic purge period controlled by this app. Contact us for backup-specific deletion handling. Copies retained by recipients or independently by providers are outside the active database controls.

Your choices and requests

You can change permissions, block/report a contact, delete messages or your account, and request access, correction or deletion by emailing snk.spears@gmail.com. We may verify account ownership without asking for your PIN. Depending on applicable law, you may also object to or restrict processing, request portability, withdraw consent, or complain to a data-protection authority. QuietLink is intended for adults, not children.

Policy updates

We will update this page's effective date when the policy changes. Contact us if anything is unclear.