Short version: Your messages and calls are end-to-end encrypted. We can't read them. We run a relay, not a surveillance network. We don't sell your data, serve ads, or use third-party analytics.
1. Who we are
Phaze ("we", "us", "our") is an independent encrypted messaging application available at phazechat.world and on Android via Google Play. For privacy questions: privacy@phazechat.world.
2. What we collect
When you register an account, we store:
- Your username, a bcrypt hash of your password, and your email address (used for verification and password reset only — never for marketing).
- Optionally, your display name and mood text.
- Your friends list and block list so we can route messages.
- Your NaCl public key — shared with contacts so they can encrypt messages to you.
- A Firebase Cloud Messaging (FCM) token — used to deliver push notifications to your Android device. See Section 5 for details.
- Connection metadata (IP address, device model string) transiently for rate-limiting and fraud prevention — retained for a maximum of 30 days.
3. Messages, calls, and files
- Direct messages are end-to-end encrypted with
NaCl box (Curve25519 + XSalsa20 + Poly1305) before they leave your device. The Phaze Nexus relay only sees ciphertext — we cannot decrypt your messages.
- Voice and video calls use WebRTC. As of this policy, a call or voice channel connects you to a room on the public Jitsi Meet service rather than a direct connection to the other person — see Section 5 for what that means. Our own Phaze servers never store or record call audio or video either way.
- File attachments you send are stored on our server so the recipient can retrieve them, including if they're offline at the time. We do not currently auto-delete them after a fixed period — deleting the message in-app removes it from the conversation but the underlying file is not yet purged from storage. We're working on automatic expiry; until then, treat anything you upload as retained indefinitely.
- Stories (photos/videos) are stored until you delete them or after 24 hours.
- Key backups (optional): if you use the key backup feature, your private key is encrypted with a PIN on-device before upload. We store the ciphertext only and cannot access your private key.
4. What we do NOT collect
- The plaintext content of your messages or calls.
- Your contacts' phone numbers or address book.
- Location data.
- Advertising identifiers or browsing history.
- Any data for advertising, profiling, or sale to third parties.
- Any data to train AI or machine-learning models.
5. Third-party services
- Firebase Cloud Messaging (Google): used to deliver push notifications to Android devices. Google receives your FCM device token. Subject to Google's Privacy Policy.
- Email delivery: verification and password-reset emails are delivered via an SMTP provider, which sees your email address and subject line.
- SMS (optional): if you opt into phone verification, handled via Twilio. Twilio sees your phone number and the OTP.
- TURN/STUN relay: our own relay, used to help WebRTC connections form when direct connections are blocked by NAT. It passes encrypted RTP packets and cannot decrypt call content.
- Jitsi Meet (8x8, Inc.): voice and video calls, and voice channels in Spaces, currently run as a room on the public
meet.jit.si service rather than through Phaze's own infrastructure. Jitsi's server sees your call's audio/video and, per their own policy, may apply end-to-end encryption depending on client support and room settings — it is not the same guarantee this policy makes for DMs. See Jitsi's privacy policy. We're moving calls onto our own infrastructure; this entry will be removed once that's done.
- Hosting:
phazechat.world runs on a commercial hosting provider. Your IP is visible to the provider for the duration of your connection.
6. Data retention
| Data type | Retention period |
|---|
| Account data (username, email, hashed password) | Lifetime of account, or 90 days after deletion request |
| Direct message ciphertext & metadata (sender, recipient, timestamp) | Lifetime of account (needed for cross-device history) — deleted with your account |
| Spaces channel messages | 30 days after posting |
| File attachments | Not currently auto-deleted (see Section 3) |
| Stories | 24 hours or until manually deleted |
| Connection logs (IP, device model) | 30 days |
| FCM push tokens | Until you sign out or uninstall |
7. Encryption
All data in transit uses TLS 1.2 or higher. Private messages use an additional layer of NaCl end-to-end encryption keyed to Curve25519 key pairs generated on-device. We do not hold, escrow, or have any access to your private keys. Passwords are stored as bcrypt hashes (cost factor 12).
8. Your rights
- Access: request a copy of the data we hold about you.
- Deletion: email privacy@phazechat.world to have your account and associated data purged.
- Correction: update your username or email from the app's Settings.
- Portability: your local message history is stored on your device and is yours.
We will respond to rights requests within 30 days.
9. Children
Phaze is not directed at children under the age of 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has created an account, contact privacy@phazechat.world and we will delete it.
10. Law enforcement requests
We respond to lawful process in the jurisdiction of our hosting provider. Because messages are E2EE, we cannot hand over content we do not have. We can produce the account metadata described in Section 2.
11. Changes to this policy
If we make material changes, we will update the "Last updated" date above and announce the change in the app. Continued use of Phaze after changes constitutes acceptance of the updated policy.
12. Contact
Questions or complaints: privacy@phazechat.world
Website: https://phazechat.world