Tallis Privacy Policy

1. The short version

Messages, calls, attachments, your profile name and photo, reactions, read receipts, “typing” and “online” are encrypted on your phone before they leave it. Our server passes them on but cannot read them. The server keeps the data it needs to work, listed below, and sees some metadata while delivering. We do not sell data and do not share it with third parties. Apple and Google take part only as service providers: they deliver push notifications and, on Android, may check the app installation at registration (section 6).

2. What is end-to-end encrypted

• One-to-one messages and attachments (Olm/Double Ratchet), group messages (MLS), channel posts, calls (media is encrypted with a key our call server does not have).
• Your profile name and profile photo: they go to your contacts inside encrypted messages. The photo is stored on the server only as an encrypted file.
• “Typing”, “online / last seen” — only to people you have chatted with in the last two weeks, and only if you have not turned it off.

3. What the messaging server stores

The server has no “last seen” or login history, no list of your conversations, no read status and no contact lists. The app does not upload your address book.

4. IP addresses and logs

• The messaging server and the VPN control service do not receive your IP address (our proxy removes it) and keep no access logs of app requests. The VPN tunnel itself sees your address only in memory while connected (section 9).
• The proxy’s error log can contain the IP address of a failed request; it is kept for 14 days.
• The servers’ system journal (service events and errors) is kept for up to 30 days (currently 7). The call server can write IP addresses of call participants there when diagnosing problems.

5. What the server sees while working

To deliver, the server necessarily sees which account sends an encrypted envelope to which device and when, sizes of envelopes and files, and who is in a call while it lasts. It does not see what is inside. Link previews are made by your phone; the website sees your IP address (or the VPN address).

6. Push notifications and installation checks (Apple, Google)

On iPhone, pushes go through Apple (APNs, PushKit for calls). A push contains no text, no sender and no chat — only a signal to wake the app; your phone decrypts the message itself. Apple sees the push token and the time. The sender’s name (and the group or channel name) on a notification and the caller’s name on the call screen are added by your phone from its own data after the push arrives; they are shown by default and can be turned off in Settings → Notifications, and are never shown for hidden chats. Apple and Google do not receive these names.

On Android, when push notifications through Google are enabled, Tallis uses Google Firebase Cloud Messaging (FCM). A push is a data message with one fixed value — “sync” for new messages or “call” for an incoming call — and nothing else: no text, no sender, no chat, no names, no counter. Google sees the push token, the time and whether it is a message or a call. The app then fetches the messages from our server and decrypts them on the phone.

On Android, when you register without an invite code and this check is enabled, Tallis may use Google Play Integrity to protect registration from automated abuse. The app asks Google for a verdict on whether it is the genuine Tallis app from Google Play on a genuine Android device; Google processes technical signals about the device and the app under its own terms, and our server checks the verdict with Google. We use the result only to allow or refuse the registration and store neither the verdict nor any device identifier (section 3). If we turn on Google’s device recall feature, Google also keeps a mark that a Tallis account was registered on that device, to limit how many accounts one phone can create. Registering with an invite code does not use this check.

7. Key transparency log

To let apps check that the server does not substitute keys, Tallis keeps a public append-only log with nicknames (nick: labels in plain text) and account labels with fingerprints of device lists (32-byte hashes); if you added an e-mail address or phone number for finding you, also a disc: label derived from it (16 bytes that cannot be turned back into the address or number without our server’s secret key). Entries cannot be removed by design: after you delete your account, the history of the nickname, of your device list fingerprints and of disc: labels stays in the log. It contains no messages, contacts or names other than the nickname.

8. Reports and blocking

You can report a person, a message, a group, a channel or a post. A report contains the reason, what is reported, your account key, the reported account key (if known) and only the messages you select yourself. You see them and confirm before sending; they go to the Tallis team in readable form for review. Nothing else from the conversation is sent. Reports are kept for one year; reports you filed are deleted with your account. We cannot prove who wrote a message: our encryption deliberately has no per-message signature. Blocking works on your phone only; the list is not sent to us.

9. VPN

With the built-in VPN your internet traffic goes through our server in Germany and websites see the server’s address. For each VPN device the server stores: the public keys, the internal tunnel address, the platform, the creation date, a hash of the connection password, the Tallis account the device belongs to (as a pseudonym that only our messaging server can match to your account; so that one account has no more than five VPN devices) and, if revoked, the revocation mark (revoked records stay). When VPN usage limits are in effect, the server also counts the data volume per calendar month under that pseudonym — only the number of bytes, without sites or times. These records are not removed when you delete your account. We do not record your traffic, visited sites or connection times; the current connection address is held only in the server’s memory while connected. Ad and tracker filtering, where the app offers it, is off by default; if you turn it on, it runs only on your phone against a built-in list, and nothing is filtered on our servers.

10. Network quality statistics and the connection helper

A small model on your phone helps choose the best connection route; it runs only on the phone. If you turn on “Help improve connection” (off by default), once a day the app sends: counts of measurements in fixed buckets for delay, packet loss and connection gaps, the connection type (e.g. Wi-Fi or cellular), the route type and the week of the year. It is sent without your account, device ID or signature; the server keeps only weekly sums. Purpose: improving the connection helper.

11. Crash reports

On iPhone, iOS collects crash and hang reports on your phone (MetricKit). The app keeps them on the device and never sends them by itself; you can share them manually from Diagnostics. If you allowed “Share with App Developers” in iOS, Apple may pass us its own reports.

On Android, if the app crashes or stops responding, it writes a short report into its own storage on the phone: the error type and where in the code it happened (stack trace), the app version, the Android version and the phone model — without the error text, messages, keys, contacts or names. The app keeps the last 10 reports and never sends them by itself. After a crash it offers to send a report; you can also do this in Profile → Report a Problem. The report goes as an ordinary e-mail to info@nun-ar.org (or any other way you choose in the share sheet) only when you send it; you can read the attached log before sending, and anything in it that looks like an address, e-mail, phone number, nickname or key is masked. If you allowed usage and diagnostics sharing on Android, Google may give us aggregated crash and performance statistics for the app through Google Play.

12. Deleting your account

In the app: Profile tab → Delete account (at the bottom) → Delete (from the account’s main phone). The server deletes your account, devices, keys, waiting messages, push tokens, nickname, e-mail and phone hashes, invites, anti-abuse counters linked to the account, channels you own and reports you filed. What remains: messages already delivered stay on recipients’ phones; encrypted attachment files until they expire (≤ 14 days); request nonces (≤ 24 hours); encrypted messages you scheduled to send later, until their send time (the server cannot tell they are yours); your authorship of posts in other people’s channels (≤ 1 year); reports others filed about you (≤ 1 year); the key transparency log (section 7); the App Attest record, if any; on Android, Google’s device recall mark, if that feature is on (section 6); VPN device records and monthly volume counts (section 9); aggregated statistics; encrypted server backups, which keep earlier copies of the database for up to six months.

If you cannot use the app (for example, you lost your phone), ask us by e-mail to delete the account — see Support for how we match such a request to the account. The administrator deletes the same data on the server as the in-app deletion; data on the lost phone itself we cannot erase.

13. Your rights

We process data on these legal bases under the GDPR: to provide the service you asked for (Art. 6(1)(b)) — your account, devices, keys and message delivery; our legitimate interests in keeping Tallis secure and preventing abuse (Art. 6(1)(f)) — request protection, anti-abuse counters, App Attest and Play Integrity, reports and the key transparency log; your consent (Art. 6(1)(a)) — optional e-mail or phone number and network quality statistics, which you can remove or turn off at any time.

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Most of your data you can change or delete in the app; deleting your account removes it from the server (section 12). Because messages are end-to-end encrypted, we cannot read or hand over their content. You can lodge a complaint with a supervisory authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD) — or with the authority in your EU country.

Tallis is intended only for people aged 18 or older. Write to info@nun-ar.org.

14. Changes

We publish changes on this page and update the date above.