Privacy Policy

When you send a message, the relay receives an encrypted blob, a randomly generated room identifier, and a timestamp. It does not receive your message, and it holds no key that could open the blob.

The relay does process the connection's IP address while it is handling the request — it has to, in order to rate-limit and to keep abusive traffic off the service. See 05 / Network addresses for exactly what happens to it.

No account exists, so none of the usual account data does either:

• Phone number or email address
• Contact list or address book
• Message or media contents in readable form
• Advertising or device-tracking identifiers
• Location data

Because the relay holds only ciphertext, it cannot read your messages, identify who you are talking to, or reconstruct a conversation.

Benda is a non-profit project. There is no advertising, no subscription, and no data to sell — which is the reason none of the above is collected. Donations fund the relay.

The relay keeps a database. Saying otherwise would be false, so here is exactly what is in it:

Encrypted message payload

Ciphertext. Indistinguishable from random bytes.

Room identifier

Random 32-character value, not derived from you.

Authentication token

Keyed hash. The token itself is never stored.

Public keys

Encrypted at rest; used only for routing.

Timestamps

For expiry and deletion only.

Sensitive fields — authentication tokens, public keys, message ciphertext, invitation tokens and push addresses — are additionally encrypted at rest with AES-256-GCM under a key held only by the server operator. Equality lookups on tokens use a keyed hash, so the value can be matched without being stored.

Messages are sealed on your device before they are sent, using X25519 key agreement with XSalsa20-Poly1305 authenticated encryption. The relay never holds a decryption key.

Your identity is derived locally from your PIN using PBKDF2-HMAC-SHA256 with 200,000 iterations. It is never transmitted and there is no account to reset.

This is the part most privacy policies are vague about, so it is stated plainly.

• Your IP address is used in memory to rate-limit requests and to detect abuse.
• Rate-limit counters are per device, keyed on a random installation identifier, not on the address. This is deliberate: mobile networks put many subscribers behind one address, so counting per address would apply one person's usage to their neighbours.
• An address that repeatedly attacks the service can be blocked, and a permanent block is written to a plain list on the server. That list contains addresses and nothing else.
• Addresses are never correlated with rooms, messages, or identities, and there is no access log tying a request to any content.

Undelivered messages are removed after a time-to-live that the room's owner sets — between 1 and 720 hours, with the default set by the operator. Messages can also be given a shorter individual expiry, and are deleted when it passes. Media is purged on the same schedule.

Once deleted, the ciphertext is gone. Nothing links it to you, and no backup of it is retained.

There is no server-side identity to delete, so erasure is local and immediate: clearing the app's data, or entering the decoy PIN, destroys the cryptographic keys on the device and makes any remaining ciphertext undecryptable.

You can also delete a room from inside the app, which removes it and its messages from the relay.

For vulnerability reports or cryptographic questions, write to TODO@TODO.