Privacy policy

This policy describes what the Chatimix app, the Chatimix server and the chatimix.com website do with your data. It describes how the software actually works. The source code is licensed under the AGPL-3.0 and is available on request, so every statement here can be checked against it.

Who runs Chatimix

Chatimix is run by the Chatimix project.

Operator details: to be added by the owner before this policy takes effect.

The short version

• Your messages from every network are kept in a database on your device.
• Texts (SMS and MMS) go through your mobile carrier. They reach the Chatimix server only end-to-end encrypted, when you link a computer or browser to your phone.
• Chatimix messages, attachments and calls are end-to-end encrypted. The Chatimix server passes messages on and stores them, but cannot read them. It does see metadata, such as who talks to whom and when.
• The Chatimix server is one server at Amazon Web Services in Frankfurt, Germany.
• WhatsApp, Telegram and other networks are reached from your device, never through a server-side bridge. Their messages pass through the Chatimix server only end-to-end encrypted, when your phone relays them to a device you linked.
• Your phone number is not stored on the server, only a keyed hash of it.
• There are no ads, no analytics and no crash reporting in Chatimix, and the website sets no cookies.

What stays on your device

Chatimix keeps its data in the app's private storage on your device. Other apps cannot read that storage. Chatimix does not add its own encryption on top of it, except for the network sessions noted below, so anyone who can unlock your device and read app storage can read it.

• The message database (chatimix.db): your conversations and messages from every network, the names and numbers of the people in them, attachment details, the people you blocked, link previews, and a search index of message text.
• Media: photos, videos, voice notes and files you receive or send, kept in the app's cache folders.
• Settings (settings.json): your choices in Settings, the phone number you verified, and the list of your contacts that contact discovery found on Chatimix.
• Your Chatimix session and encryption keys: the keys that decrypt your Chatimix messages, kept in a separate database (chatimix_matrix.sqlite) next to the message database.
• Network sessions: what the app needs to stay signed in to WhatsApp, Telegram and other networks you connect. The Telegram, Signal and Messenger sessions are encrypted with a key held by the Android Keystore (the Keychain on iOS and macOS). The WhatsApp session and its message cache (whatsapp.db) are protected by the app's private storage only.
• Call history (chatimix_calls.json): who you called, when, for how long, and whether it was a video call.

In the web version, the same data is kept in your browser's storage for the Chatimix site, except call history, which the web version keeps only until the page is reloaded.

Chatimix opts out of Android's device backup and of Android's transfer to a new phone, so none of these files go to Google's backup. On iOS and macOS, its data is excluded from iCloud backup and Time Machine. To move to a new phone, use Chatimix's own encrypted backup or its transfer to new phone.

Texts (SMS and MMS)

When Chatimix is your SMS app, texts are sent and received by your phone through your mobile carrier, the same way as with any other SMS app. They are stored in Android's own message store and copied into the Chatimix database on your device.

Your carrier handles texts as it always does. Beyond that, three features involve texts:

• Linked devices. When you link a computer or browser to your phone (see Linked devices), the phone relays your texts to it through the Chatimix server, end-to-end encrypted.
• Reporting spam. When you report a sender, the app looks at the last 5 messages from them and forwards the texts among them, as SMS, to your carrier's spam reporting number 7726. Any Chatimix messages among them are reported to the Chatimix server (see below). Reporting also blocks the sender.
• Fall back to SMS. With fall back to SMS on in Settings › Chats (it is on unless you turn it off), a Chatimix message that cannot be delivered within 30 seconds is sent as an SMS or MMS through your carrier instead. That copy is not end-to-end encrypted. The thread shows when this happens.

Linked devices

You can link a computer or a browser to your phone by scanning a code. The phone then relays your texts and the messages of the networks it runs (WhatsApp, Telegram and the others) to your linked devices, starting with the last 92 days, and sends the messages you write there.

This goes through a private conversation on the Chatimix server that has no member but you. It is end-to-end encrypted like any Chatimix chat, so only your own verified devices can read it; the server stores and passes on the encrypted data and sees its size and timing. Unlinking a device in Settings › Linked devices signs it out.

Link previews

With link previews on in Settings › Privacy (they are on unless you turn them off), your device reads the page behind the first https link in a message to show its title and image, and identifies itself to that website as a Chatimix link preview. It does this for links in your own messages and in conversations you accepted, never for a message from an unknown sender. The request goes straight from your device to that website, never through a Chatimix server, so the website sees your IP address and that someone opened the link. The preview is kept on your device. The web version does not show link previews.

Chatimix messages and the Chatimix server

Chatimix messages use the Matrix protocol on a Matrix homeserver (Tuwunel) at matrix.chatimix.com that the Chatimix project runs itself. Chatimix account ids look like @name:chatimix.com. Federation is turned off, so the server only exchanges messages between its own accounts and never with other servers. New accounts are created only through the identity service, after you verify your phone number (see below).

Messages and attachments are encrypted on your device before they are sent, and only the devices in the conversation hold the keys to read them. The server stores the encrypted messages and attachments so that your other devices and the other people in the chat can fetch them. They have no automatic expiry. Chatimix chats are encrypted by default, and the server is set up to encrypt every new room.

When you delete a Chatimix message, the server removes it from the conversation but keeps the encrypted original for up to 60 days before erasing it.

The server cannot read your messages, but it does see:

• your account id (your @username), your display name, your profile photo if your account has one, and your presence (whether you are online and when you were last active);
• a hash of your password, which it needs to check your sign-in;
• the list of devices signed in to your account, with their names;
• which accounts are in which conversations, and so who talks to whom;
• when each message is sent and roughly how large it is;
• the IP addresses your devices connect from, which also appear in the server's logs;
• your read receipts: with read receipts off in Settings › Privacy, Chatimix sends private ones, which the server keeps for your own devices and does not pass on to anyone else;
• typing notices, which Chatimix sends only while typing indicators are on in Settings › Privacy;
• who joins a call, and when (see Calls);
• the reports you file about a Chatimix message: your account id, the conversation and message they point to, and the reason you picked. Reports are kept for the people who run the server to review;
• your encrypted key backup, if you set one up (see Backups).

The server does not fetch link previews.

In Edit profile › who can see, you choose how much of your profile the server passes on:

• last seen: with nobody, the app always reports you as offline, so the server has no online status to share. A status message you set is still shared. With everyone or contacts, your presence is shared with the people you share a conversation with; the server cannot narrow it further.
• photo: with everyone, the photo is on your public profile, which anyone on the server can look up. With contacts, it is removed from your public profile and kept only in the conversations you have joined. With nobody, it is removed from both. Chatimix cannot upload a profile photo yet, so this applies only to a photo your account already has.
• phone number: Chatimix never puts your number in your profile.

Where the server runs

The Chatimix server is one server at Amazon Web Services (AWS) in Frankfurt, Germany (region eu-central-1). AWS provides the machine and its disks; the Chatimix project runs everything on it. The homeserver, the identity service and the call token service run on this server.

Encrypted snapshots of the server's disks are taken every day and kept for 14 days, so that the server can be restored after a failure. Data deleted from the server, including deleted accounts, can therefore remain in these snapshots for up to 14 days.

Your phone number and contact discovery

Creating a Chatimix account starts with verifying your phone number. A small service next to the server, the identity service, handles this.

Verification. The identity service passes your number to an SMS verification provider, Twilio Verify (Twilio Inc.), which texts you the code and checks it. Twilio receives your phone number. Until Twilio Verify is set up on the server, verification is unavailable, and so is signing up by phone: the service never makes up codes of its own.

Your password. When you create or delete your account, your password passes through the identity service on its way to the homeserver. The identity service does not store it.

What the identity service keeps. For each verified number it stores a keyed hash of the number (made with a secret only the service holds), your account id and the time it was stored. It does not store the number itself.

Registration lock. If you turn on registration lock in Settings › Account, the identity service also stores a salted Argon2id verifier of your PIN next to that keyed hash, never the PIN itself. Registering your number on a new phone then asks for the PIN. Turning the lock off deletes the verifier.

You can take your number out of the identity service at any time with Settings › Privacy › find me by number › nobody. Nobody can then find you by your number, and any registration lock is removed too. Setting it back to everyone asks you to verify the number by SMS again. When you change your number in Settings › Account › change number, you verify the new number by SMS and the service replaces the old binding with the new one in one step. If the new number was bound to another account, it now points to yours.

When you delete your account from a device where you verified your number, the app deletes it through the identity service, which also removes this binding. From a device where you did not verify your number, the account is deleted on the homeserver only and the binding stays; set find me by number to nobody first, or delete the account from the device where you verified it.

Contact discovery. To show which of your contacts are on Chatimix, the app turns the phone numbers in your address book into a standard international format, hashes each one with SHA-256, and sends only the hashes. Names and other contact details never leave your device. Phone numbers can be recovered from such hashes by trying every possible number, so the identity service could work out which numbers you checked. It does not store them: it compares them with its bindings, answers with the accounts that match, and forgets the request.

During setup, if you allow access to your contacts, discovery runs once to show who you know on Chatimix; those results are not kept. In People, after you choose to find people you know, the matches are kept on your device, and from then on discovery checks again at most once a day while you use the app.

Limits and logs. To stop abuse, the service counts requests per number, per account and per network address. Counters hold only keyed hashes, and each counter is deleted within minutes after its time window ends. Its log lines record the kind of request, its result and how long it took, and your account id when an account is created, deleted or changes number, when a registration lock is turned on or off, and when a request for your account fails. The service does not write phone numbers or IP addresses to its logs. When Twilio answers with an unexpected error, its error text is logged as Twilio sent it.

WhatsApp, Telegram and other networks

Chatimix connects to WhatsApp, Telegram and the other networks in Settings › Networks with a client that runs inside the app on your device. It talks directly to that network's own servers, as the network's own apps do. Chatimix does not use server-side bridges: your sessions on those networks stay on your device, and a Chatimix server never connects to those networks for you. Their messages reach the Chatimix server only end-to-end encrypted, when your phone relays them to a device you linked (see Linked devices).

Those networks see what they always see when you use them, and their own privacy policies apply. In particular:

• WhatsApp sees a linked device on your account: named Chatimix when you link by scanning a code, and shown as a Chrome browser on Linux when you link with a phone number code.
• Telegram sees that you log in with the Chatimix app.
• Signal sees a linked device on your account. Messenger is signed in through a messenger.com page shown in the app. Signal and Messenger are not part of the iOS app.

iMessage is not available yet.

When you disconnect a network, the app signs out of it and deletes the session from your device. Messages already copied into your inbox stay on your device.

Calls

Chatimix calls use LiveKit Cloud, a hosted media service run by LiveKit, Inc., which relays the audio and video between the devices in a call. A service on the Chatimix server, the call token service, checks that you are a member of the conversation and gives your device a short-lived token to join the call.

Audio and video are end-to-end encrypted. Each device in a call makes its own AES-GCM keys and sends them, encrypted, only to the other devices in the call; the keys change when someone leaves. LiveKit Cloud relays the encrypted media and cannot hear or see the call.

LiveKit Cloud does see:

• the IP addresses of the devices in a call;
• the call's room name, which is derived from the Chatimix conversation;
• each participant's identity in the call, which is derived from their Chatimix account id and device;
• when each participant joins and leaves, and how much encrypted media flows.

The Chatimix server sees who joins a call in which conversation, and when. The call token service records your account id, device and conversation in its logs each time you join a call. The call list in the app is kept only on your device.

Notifications

Chatimix does not use a push notification service such as Firebase Cloud Messaging or Apple Push Notification service. Notifications are created by the app on your device.

Google Play services on Android

The Android app uses parts of Google Play services that run on your phone:

• Code scanner. Scanning a code (to link a device or WhatsApp) uses Google's ML Kit barcode scanner, which Google Play services provides. The images are processed on your phone, but Google Play services may send Google its own usage data about the scanner, under Google's privacy policy.
• Wear OS. If you pair a Wear OS watch, the app sends it a summary of your unread conversations through Google Play services, so you can read and reply on the watch. It follows Settings › Notifications › preview: with name only the text is replaced, and with nothing only counts are sent.

Service providers

These companies process data for Chatimix, only as described above:

• Amazon Web Services hosts the Chatimix server in Frankfurt, Germany.
• Twilio Inc. (Twilio Verify) receives your phone number to send and check verification codes.
• LiveKit, Inc. (LiveKit Cloud) relays the encrypted audio and video of calls.

What Chatimix does not do

• It has no advertising and no analytics.
• It has no crash reporting and no other tracking tools, and Chatimix itself does not send usage data anywhere.
• It does not sell or share your data.

Backups

Chatimix can back up your message keys and the keys that prove your identity to your other devices (your cross-signing keys) to the Chatimix server, so that you can read your encrypted history on a new device. This is optional and set up in Settings › Chats › encrypted backup. The backup is encrypted with a passphrase you choose, and you get a recovery key that works in its place. Both stay with you. The server stores the encrypted backup and cannot open it.

The key backup holds keys only, not messages. Your encrypted Chatimix messages stay on the server as described above. Texts and messages from other networks are not included.

Exporting your data

Settings › Account › export my data writes a .zip file with your conversations on this device: a chatimix-export.json file with your conversations and their members, the messages, details of each attachment, your blocked list, your Chatimix account id and your verified number, plus the photos, videos and files that are on this device. Call history, settings, discovered contacts and link previews are not part of the export. On a phone you choose where to save it; in the web version it downloads. The export is made on your device and never sent anywhere. The file is not encrypted, so keep it somewhere safe.

Deleting your account

You can delete your Chatimix account in Settings › Account › delete account, after confirming your password. The app asks the server to deactivate the account and erase its data. On a device where you verified your number, the request goes through the identity service, which also removes your phone number binding (see above for a device where you did not).

Deleted data can remain in the server's encrypted disk snapshots for up to 14 days (see Where the server runs).

Deleting your account does not remove data on your device: texts, messages from other networks and messages already in your inbox stay there. To remove them, uninstall Chatimix or clear its storage in Android settings. Messages you sent remain on the devices of the people you sent them to.

Your data and your choices

• Most of your data is on your own device, where you can see it in the app, and you can take a copy with export my data (see above).
• You choose which networks to connect, and you can disconnect any of them in Settings › Networks.
• You can block senders and filter unknown senders in Settings › Privacy. Blocking takes effect in the app on your device and is not shared with the server or other networks.
• In Settings › Privacy you also choose who can add you to groups and who can call you: everyone, contacts or nobody. Contacts means people in your phone's contacts and people you have a one-to-one conversation with that is not a request from an unknown sender and not blocked. Group invites from anyone else are declined, and their calls do not ring and show as missed.
• Contact discovery needs your permission to read contacts, and you can withdraw that permission in Android settings.

The chatimix.com website

The chatimix.com website sets no cookies, runs no scripts and loads nothing from other servers: no fonts, analytics or tracking from third parties. Like any web server, it keeps standard access logs of each request, with your IP address, the time and the page you asked for. These logs are kept for up to 14 days to keep the site secure, and then deleted.

Changes to this policy

This policy may change as Chatimix changes. The date at the top shows when it last changed.

Contact

For questions about this policy or your data, write to support@chatimix.com.

This address is being set up and is pending the owner's confirmation.

See also the terms of use and the help center.