PRIVATEROOM · EIN BEWUSST PRIVATER RAUM

Privacy

Updated 13 October 2026 · Project and new test version under review

PrivateRoom is an end-to-end encrypted messenger project undergoing a security review. It is not released as an independently audited messenger. Content encryption does not make connection metadata invisible or protect a compromised endpoint.

Controller

Messages, device data and metadata

Messages and supported attachments are encrypted on the sender device and decrypted on the recipient device. Private decryption keys are not sent to the relay. The app may retain local contacts, messages, drafts and private keys on your device.

The relay processes encrypted packets, signatures, public sender and recipient identifiers, packet identifiers, sizes, creation and expiration times, and public authentication keys. Internet connections also expose IP addresses and technical TLS/HTTP information. These identifiers are pseudonymous rather than necessarily anonymous. Timing, packet sizes and relationships can disclose information.

Retention

The revised relay limits new packet lifetimes to 24 hours and removes expired packets on a scheduled cleanup pass, normally within one additional minute. Confirmed packets are removed from the active delivery queue. Hashed request replay evidence is retained for approximately ten minutes plus the short cleanup interval; limited packet acknowledgment identifiers remain for the applicable replay-protection window. The closed beta also retains the operator-approved public device identifiers. Public device authentication keys remain registered; contact the controller for removal without sending private keys.

Protected backups can contain earlier encrypted states and metadata. Removing an active packet does not instantly remove it from every backup; historical test and recovery copies remain protected until a separately authorized, targeted cleanup. No uniform automatic deletion deadline is currently promised for those old copies. Neither immediate deletion from all backups nor complete forensic erasure of every storage medium is promised.

Logs and service providers

The revised version disables automatic HTTP access logs. Sanitized failure logs are limited to failure category, general route, status and request identifier, without message bodies, keys, tokens, peer identifiers or full request URLs. Logs are rotated to a bounded size. Routine proxy access logging is disabled for this domain, but proxy error events may retain IP addresses, full request URLs including identifiers and technical request headers in protected operational logs. IP-free logging is therefore not guaranteed. Historical logs and backups from the previous version are not erased retroactively by an app update.

The website has no advertising or analytics scripts and loads no external fonts. External GitHub and Apple pages process data when you follow their links. Apple processes distribution and TestFlight data under its own terms. Ordinary support email is not a PrivateRoom encrypted conversation and includes your sender address and content. Do not send secrets or private conversation contents.

Purposes, legal bases and rights

Data is processed to provide requested communication and test functions and to maintain service security. Depending on the function, the relevant basis is Article 6(1)(b) GDPR for a requested contractual service, Article 6(1)(f) for necessary security and abuse prevention, or consent for an optional function that requires it. Applicable retention obligations remain.

Subject to legal conditions, you may request access, rectification, erasure, restriction, portability or object to processing, and withdraw consent prospectively. Contact miggu69@gmail.com. A secure check of your public device identifier may be necessary because the operator cannot decrypt message content. You may complain to the Austrian Data Protection Authority. The German policy provides further detail.

Prepared next beta: contact authorization and notifications

The next beta adds a recipient-signed list of permitted sender identifiers and its update and expiry times. This reveals additional contact relationships to the relay. Grants expire within seven days and are refreshed while using the app. Local blocking applies immediately; relay authorization is removed after the online update succeeds.

Optional notifications start disabled. If you enable them and grant iOS permission, the relay also processes the APNs device token, environment and a temporary association with your public device identifier. Registration expires after six days without renewal. Apple receives the routing token and a constant neutral activity alert, without sender identity, message text, attachment or private key. Push may be delayed, repeated or absent.

For its bounded retry window, the new relay also retains the sender and recipient associated with acknowledged packet identifiers. This supports owner-bound retries without duplicate queue entries. Server acceptance is not a read receipt.

These are prepared features, not a claim that the next beta is already distributed. See current beta status and device loss and recovery limitations.