Privacy, in plain words.

QuietLink Privacy Policy · Effective 28 October 2026

Who operates the service

QuietLink is operated by GLOBIFANTASY - IMIGRAÇÃO, UNIPESSOAL LDA, Rua Conde Almeida Araújo, nº 7, 2745-155 Queluz, Sintra, Portugal. Contact snk.spears@gmail.com for support, privacy or safety requests.

This policy covers the app and the hosted service at quietlink.sujonkhan.xyz, including older service addresses that relay to the same backend. If your administrator gives you a different server, ask that operator about their hosting, account administration and retention practices.

Account and service information

An administrator authorizes new accounts using a one-use enrollment key. You choose a user ID and account password when redeeming it; there is no unrestricted public registration. Account passwords are sent over HTTPS for authentication. The server retains a separate random salt and a slow PBKDF2-HMAC-SHA256 password hash, not the plaintext password. It also stores the stable account identifier, account status, administrator permissions, hashed session and enrollment/recovery credentials, their expiry and use/revocation status, and short-lived hashed authentication-attempt counters. It also stores conversation membership, message and call identifiers, participants, timestamps, message types and sizes, opening/read status, deletion status, settings, block records and notification-delivery status. Administrators can issue enrollment or account-bound recovery keys, edit display names, disable access or permanently delete accounts. Issuing a recovery key immediately invalidates that account's password and active session. Redeeming it preserves the same account identifier, role and existing history while setting new login details. Changing a user ID or password in Settings also preserves the account identifier and history. Updated apps and the account website support independent sessions, so a website login does not replace your mobile session. Sessions expire after 90 days without use and no later than 365 days after creation; up to ten active sessions are retained, with the oldest replaced at that limit. Older app versions using the earlier login method still replace earlier sessions. Password changes, password resets and administrator recovery revoke existing sessions.

Display names and optional profile photos are readable service data, not end-to-end encrypted. Your stable account identifier does not change when you change your user ID or display name. Profile images are validated, resized and stripped of embedded metadata, then stored as JPEG; only authenticated friends, conversation participants, the account owner or an administrator can fetch them, subject to blocking. Do not use a sensitive image as your profile photo. No phone address-book access is needed.

Friend lists record relationships between existing accounts. Optional friendship codes expire after 24 hours and can be redeemed once; these differ from account enrollment or recovery keys and grant no administrator access. Only code hashes are stored. The server records their creator, expiry and successful redemption until expiry cleanup. Code-attempt counters protect against abuse. Existing conversations remain usable when a friendship is removed.

Optional account email and recovery

You can attach an email address in Settings or at the account website. We use it only for email verification, account sign-in and password recovery, not advertising. Adding or changing it requires your current account password and confirmation through a one-use link sent to the new address. Your existing verified address remains attached until the replacement is confirmed. An unverified address cannot recover your account. Email addresses and pending verification addresses are readable account data. Our configured email provider processes the recipient address, message content and delivery metadata. Verification links expire after 24 hours; password-reset links expire after 30 minutes. The database stores only hashes of those random link tokens, bound to your account and credential version. Raw links are held briefly in an in-memory delivery queue and sent to your inbox; they are not written to application logs or the account database. A local or external mail server may temporarily store queued email on disk until delivery, retry or expiry. Mail-server and inbox copies are subject to their own retention policies.

Opening the account website keeps its login token in that page’s memory only. Closing or refreshing it requires a new website sign-in. Email links put their token in a URL fragment, which the page removes from the address bar before use. Confirming a password reset revokes existing sessions and recovery links but keeps your account identifier, role, profile, friendships and chat history. It cannot recover chat PINs or decrypt earlier messages.

Messages, attachments and PINs

The app encrypts message and attachment content before sending it to the selected server. The server stores encrypted payloads and encrypted chat-key information. The account password authenticates access to the service; it is distinct from the device access PIN and shared chat PIN and does not encrypt conversations. Device access PINs and shared chat PINs are not sent in plaintext. Administrators cannot recover a forgotten chat PIN or reconstruct chat keys through an account-password reset. A four-digit chat PIN has only 10,000 possibilities and offers limited resistance to guessing, especially if encrypted key information is obtained. Encryption is not a promise of protection from every attacker.

Recipients decrypt content on their own device. Received attachments have no in-app Save or Share button. Outgoing voice recordings briefly use a protected temporary file, removed after completion, cancellation, backgrounding, or cleanup at a later launch following interruption. Original files selected from Photos or Files remain where you saved them. QuietLink cannot prevent every screenshot, another camera, or copies made outside the app.

Weather and location

Weather is optional. With permission, the app uses your location while open, rounds device latitude and longitude to one decimal place, and sends those approximate coordinates to Open-Meteo. City searches send the city name to Open-Meteo's geocoding service. These requests go directly to the provider, which also receives connection information such as your IP address. Open-Meteo says its troubleshooting logs may include coordinates and are retained for up to 90 days. See Open-Meteo's privacy information. You can use a city search or change location permission in device Settings. For weather notifications, the app can also send its observed temperature and observation time to the QuietLink server, linked to your account. No coordinates or city name are sent to that backend by this API. The latest snapshot replaces the previous one; a snapshot older than two hours is no longer used for push wording and is cleared by service housekeeping. A device may retain its own weather cache. Weather from a selected city must not be presented as your device location.

Shared conversation appearance

Either participant can choose a shared color theme or select a new background photo for that conversation. The app resizes a selected photo to at most 1600 pixels on either side, re-encodes it as a JPEG of at most 512 KiB without embedded location metadata, and encrypts the theme and photo with the unlocked conversation key before upload. The server stores only the latest encrypted appearance, its size, revision, author, change identifier and update time. It cannot read the theme or background. The other participant can decrypt and display it while their conversation is unlocked. A background is persistent conversation decoration, not a view-once attachment; it stays until either participant replaces or resets it or an account deletion removes the conversation. Resetting replaces the active image with an encrypted default theme. Deleting messages or hiding a conversation for yourself does not remove the shared background. Change identifiers and encryption-nonce records remain until the conversation is deleted to prevent unsafe reuse.

Existing private wallpapers from older app versions are not uploaded automatically. A new selection and save shares the selected photo with the other participant. Updated clients keep received shared images in memory and clear them when the app leaves the foreground, the conversation closes or access locks; original selected files and older private wallpaper files are not automatically erased. Backup and external-copy limits below also apply to appearance data.

Notifications

If allowed, Apple Push Notification service and Google Firebase Cloud Messaging process delivery information. Our server stores your push token and notification permission state against your account. Firebase uses installation and messaging identifiers. Legacy custom notification titles and messages are stored in readable form and may be sent through notification providers to a recipient's lock screen. Current clients select weather notifications: the server uses the recipient's recent temperature snapshot or an honest refresh message when no fresh snapshot is available; it does not use sender-written text in this mode. Temperature and observation data are readable service information. Android may format a notification using its own recent device weather cache. Weather refresh and delivery depend on device activity and connectivity. The app does not automatically include private message text or PINs in push payloads. Do not put private content, passwords, PINs or enrollment keys in your custom notification wording. An alert already accepted by a provider may still arrive after sign-out, blocking or deletion.

Audio and video calls

WebRTC carries microphone audio and optional camera video to the other participant. Encrypted connection signalling passes through our server, which stores call participants, mode, state, timing and encrypted signalling. Encrypted signalling is cleared when the call ends or expires; call status and timing records remain until account deletion. QuietLink has no call-recording feature. Peers and configured network traversal or relay providers can process IP addresses and connection information. Calls require the relevant microphone/camera permissions and end when the app backgrounds or the device locks.

Safety reports

Blocking stops new communication between the two accounts. Reporting sends your account identity, the reported account, a reason, and the explanation you choose to write to the server administrator. Reports are not anonymous. No private message, attachment or recording is attached automatically. Administrators can review reports and disable abusive accounts. A limited on-device text check rejects some explicit abusive phrases; it does not send those checks to the server and does not scan media or calls.

Device storage and permissions

The device stores access-PIN verification and retry information, your remembered user ID and your account session. iOS protects the session in Keychain; Android encrypts it with an Android Keystore key. The app does not intentionally save the account password. Unlocked chat keys are kept in memory rather than intentionally persisted for later unlocking. Permissions are requested for features you choose: location, notifications, camera and microphone. File selection shares the selected item, not your whole photo library or address book. Manage permissions in your device Settings.

Providers and processing purposes

We use a hosted server for the service, a configured transactional email provider for account verification and recovery, compatibility relays for older server addresses, Apple and Firebase for notifications, Open-Meteo for weather, and configured WebRTC services for call connectivity. They process the data needed for those functions, including technical service data. Data can be processed outside your country. We use account, content and delivery information to provide the features you request; safety and limited technical records help protect the service. Optional device permissions can be withdrawn in Settings. Support correspondence is used to answer your request. Do not email passwords, PINs, enrollment/recovery keys or unnecessary private content.

Retention and deletion

Retained texts stay until deleted. Users can apply their timer to future sent texts, received texts, or both. If the sender's sent policy and recipient's received policy both apply, the shorter enabled timer wins. The timer is fixed when a new message is sent and begins when the recipient opens it. Automatic payload expiry affects both participants' active service copies. Settings changes do not retime existing messages. Older v1-format sends retain their original behavior. View-once payloads are removed from active server records during the one-time opening flow. Attachments use view-once handling. Delete for me hides a message from your account. Deleting a conversation for yourself hides the conversation and its existing messages only for your account; your partner retains their history. A new message can bring the conversation back, but earlier hidden messages stay hidden. This does not erase the shared server payload needed by the other participant. A sender's Delete for both removes its active encrypted payload for both participants. Message identifiers, timestamps and status metadata can remain after payload removal.

Settings → Delete account permanently removes your account, password hash, verified and pending email addresses, session and email/enrollment/recovery credentials, push binding, settings, display name, profile image, weather snapshot, friendships, friend invitations by or redeemed by the account, account-linked feature counters, blocks, and all conversations involving your account—including their message, attachment, shared appearance and call records—from the active service for both participants. Reports by or about the deleted account are also removed. Your partner's unrelated conversations remain. Signing out or disabling an account is not deletion. Your local device access PIN remains until changed or removed through device/app management.

Administrators can permanently delete another account with the same active-data cleanup; the admin deletion route prevents self-targeting and removal of the last enabled administrator. Profile photos can also be removed separately. Weather snapshots expire after two hours, friend invitations after 24 hours, and feature-attempt counters are cleaned after one day. Hashed authentication-attempt counters expire after 15 minutes and may briefly remain after account deletion. Unused production enrollment/recovery keys stop working after 24 hours; isolated synthetic review keys use 30 days. Expired email-link records are cleaned when new email links are issued; consumed verification metadata may remain until then. A new link replaces the previous link of the same purpose for that account. Password changes and resets remove all its email-link records. Expired or revoked noncanonical session records are cleaned on a later sign-in; the canonical legacy token can retain a revocation record until credentials rotate or the account is deleted. Expired, used or revoked enrollment/recovery key metadata can remain while the related accounts exist. Other account and operational records remain while the account exists; no general time-based purge is applied. Resolving or dismissing a report retains its details unless the relevant account is deleted or the operator separately removes it. Manual safety backups and provider snapshots may retain older data after active deletion. They are not changed by in-app deletion and currently have no single fixed automatic purge period controlled by this app. Contact us for backup-specific deletion handling. Copies retained by recipients or independently by providers are outside the active database controls.

Your choices and requests

You can change permissions, block/report a contact, delete messages or your account, and request access, correction or deletion by emailing snk.spears@gmail.com. We may verify account ownership without asking for your password, PIN or recovery key. Depending on applicable law, you may also object to or restrict processing, request portability, withdraw consent, or complain to a data-protection authority. QuietLink is intended for adults, not children.

Policy updates

We will update this page's effective date when the policy changes. Contact us if anything is unclear.