CryptoChat Privacy Policy

Effective date: April 14, 2026
Last updated: May 8, 2026

Data Controller

ALLDIGITAL CLEVERGUY
Website: cleverguy.it/softwaredev
Contact email: alldigital@cleverguy.it

Summary (one sentence)

CryptoChat does not collect, store, transmit, share, sell, or process any personal data of any kind. The app works entirely offline on your device.

Data we collect

None.

CryptoChat does not collect any personal data. Specifically:

• We do not collect your name, email address, phone number, or any identifier
• We do not collect location data
• We do not collect device identifiers (Android ID, IMEI, MAC address, Advertising ID)
• We do not collect usage analytics or crash reports
• We do not use cookies, fingerprinting, or any tracking technology
• We do not access your contacts, calendar, microphone, or SMS messages
• We do not read your clipboard history beyond loading a single item when you explicitly request it
• We do not log anything: no local logs, no remote logs, no error reports

Data we transmit

None.

CryptoChat has no INTERNET permission declared in its AndroidManifest.xml. This is technically enforced by Android: the app physically cannot open any network connection, call any API, load any remote resource, or contact any server.

The only situation in which any data leaves your device is when you explicitly choose to share an encrypted message via the Android system share sheet. In that case, the encrypted text is passed to the messaging app you pick (e.g., WhatsApp), and that app processes it according to its own privacy policy. CryptoChat has no visibility into or control over what happens afterward.

Data we store on your device

Only non-sensitive preferences.

CryptoChat persists the following items on your device using Android's DataStore API (local preferences file, sandboxed to the app):

• Whether you completed the onboarding flow (boolean)
• Your selected visual theme (string)
• Your selected language preference (string)
• Auto-clear timer duration (integer)
• Whether clipboard auto-paste is enabled (boolean)
• Whether Matrix rain animation is enabled (boolean)
• Whether haptic feedback is enabled (boolean)
• Your daily encryption count and the current day (used to enforce the free tier limit of 5 encryptions per day)
• Whether CryptoChat Premium has been purchased (boolean)

Nothing else is stored. Your messages, passwords, hints, result text, and clipboard content are kept only in memory during the current session. When the app is closed (or killed from recents), everything is gone. There is no database, no message history, no encrypted vault, no cloud sync, and no backup.

Cloud backup and device-to-device transfer are explicitly disabled via allowBackup="false" and data_extraction_rules in the app manifest, so none of CryptoChat's preferences are ever uploaded to your Google account.

In-app purchases

CryptoChat offers one optional in-app purchase: CryptoChat Premium at €2.99 one-time.

Payment processing is handled entirely by Google Play Billing. CryptoChat never sees your payment method, credit card number, billing address, or any other financial information. CryptoChat only receives a simple signal from the Google Play Billing Library indicating whether the Premium product has been purchased and acknowledged. This signal is stored locally as a boolean preference.

For Google Play's data handling, please refer to Google's privacy policy.

Permissions requested

CryptoChat declares the following Android permissions, each with a specific minimal purpose:

• CAMERA: requested on-demand only when you tap the QR code scan button. Used to read a QR code containing an encrypted message. The camera is released immediately after scanning. CryptoChat never records, stores, or transmits anything captured by the camera.
• VIBRATE: used to provide haptic feedback when you tap buttons. Can be disabled in Settings.
• com.android.vending.BILLING: used exclusively by Google Play Billing for the Premium in-app purchase flow.

CryptoChat does not request (and does not need) any of the following: INTERNET, ACCESS_NETWORK_STATE, READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, READ_CONTACTS, READ_CALENDAR, READ_SMS, RECORD_AUDIO, or any other sensitive permission.

Clipboard protection

Sensitive clipboard flag (ClipDescription.EXTRA_IS_SENSITIVE on Android 13+) is set on all items CryptoChat places on the clipboard. The system clipboard UI will hide the preview and clipboard history managers will skip these entries.

Children's privacy

CryptoChat does not target children and does not knowingly collect any information from children. The app's age rating is PEGI 3 / ESRB Everyone / IARC 3+, meaning the content is appropriate for all ages, but the app's usefulness is primarily for adults who need to protect their communications. CryptoChat complies with COPPA and GDPR Article 8 by default, because it collects no data from anyone.

Your rights under GDPR and similar laws

Because CryptoChat does not collect, process, or store any personal data, the following rights do not have anything to apply to:

• Right of access (Art. 15 GDPR) — there is no data to access
• Right to rectification (Art. 16) — there is no data to correct
• Right to erasure (Art. 17) — there is no data to erase, but you can uninstall the app to remove the local preferences
• Right to data portability (Art. 20) — there is no data to export
• Right to object (Art. 21) — there is no processing to object to

If you believe CryptoChat is processing personal data despite the above, please contact alldigital@cleverguy.it and we will investigate immediately.

Cryptography

CryptoChat uses the following standard, well-vetted cryptographic primitives via Android's built-in Java Cryptography Extension (JCE):

• AES-256-GCM (authenticated encryption with associated data, tag 128 bits)
• PBKDF2-HMAC-SHA256 key derivation with 100,000 iterations
• SecureRandom for salt and IV generation (16 bytes salt, 12 bytes IV per message)

Keys are derived from your password on-the-fly at encryption/decryption time and are never stored.

Third parties

CryptoChat integrates with the following third parties for limited, specific functions:

1. Google Play Billing Library (for the Premium in-app purchase) — governed by Google's privacy policy
2. ZXing (embedded open-source library for QR code generation and scanning) — fully offline, no network calls

CryptoChat does not use: Firebase, Google Analytics, Crashlytics, Sentry, Amplitude, Mixpanel, AppsFlyer, Adjust, Facebook SDK, AdMob, any ad network, or any tracker SDK.

Changes to this policy

We may update this privacy policy from time to time. Material changes will be reflected in the app's update notes on Google Play and by updating the "Effective date" at the top of this document. Non-material changes (typos, clarifications) will not be announced.

Contact

ALLDIGITAL CLEVERGUY
alldigital@cleverguy.it
cleverguy.it/softwaredev