CIPHERA Privacy Policy
CIPHERA is an end-to-end encrypted messenger for iPhone, iPad, Mac and Windows. This policy explains what personal data the CIPHERA service processes, why, for how long, who else is involved and what rights you have.
1. Who is responsible
The controller of your personal data is MSCS di Stefan E., Via Carso 31, 24052 Azzano San Paolo (BG), Italia. For any question about privacy or to exercise your rights, write to office@support-remote.org / stefan@support-remote.org.
2. What we cannot see
The content of your messages, the audio and video of your calls and the content of the files you send are encrypted on your device with keys that only the devices taking part hold. Our servers store and forward this encrypted data but cannot decrypt it. We therefore do not have, and cannot hand over, the content of your communications.
Your private keys stay on your devices. If you set up recovery, a recovery backup is stored on our server encrypted with your recovery code, which we never receive; we cannot open it.
3. What we process and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Your e-mail address, the display name and the account identifier given by the sign-in method you choose (Sign in with Apple, or a code sent to your e-mail address), and whether the e-mail address was verified | To create your account, sign you in and let people you communicate with identify you | Performance of the contract (Art. 6(1)(b)) |
| One-time sign-in codes sent to your e-mail address, stored only as keyed hashes, with the number of wrong attempts | To confirm that the e-mail address is yours | Contract; legitimate interest in security |
| Your CIPHERA ID, the public parts of your identity and device keys, signed device lists and prekeys | So that other users' apps can encrypt to your devices and check that the keys really are yours | Contract |
| Device information: device name, platform (iOS, iPadOS, macOS, Windows), app version, when each device and session was added and last active | To show you, in Security Center, every device and session on your account and let you remove them | Contract; legitimate interest in account security (Art. 6(1)(f)) |
| Your contact list in CIPHERA, the conversations and groups you are in and members' roles | To deliver messages to the right people and to show conversation membership | Contract |
| Routing data of encrypted messages and files: sender and recipient account and device, size, time | To deliver encrypted data to the right devices | Contract |
| Call records: when you call someone, that your account and device called their account, and when. We do not record whether the call was answered, how long it lasted, or anything said or shown in it | To connect the call (the ring reaches the other person's devices) and to keep the security record described in section 6 | Contract; legitimate interest in security (Art. 6(1)(f)) |
| Security events of your account (for example a new device, a changed key, a revoked session) | To show you what happened to your account's security | Contract; legitimate interest in security |
| Push notification tokens of your Apple devices (stored encrypted) | To tell your device that something new is waiting. Notifications carry no message content | Contract |
| Only if a CIPHERA deployment is run for members only: its member list (the e-mail addresses and e-mail domains allowed to use it, who added each entry, when, a short note and, if removed, when) and refused sign-in attempts of unlisted addresses, stored only as keyed hashes (no e-mail, no IP address) | To decide who may create an account, to disable accounts whose membership ended and to limit repeated attempts | Legitimate interest in running a members-only service (Art. 6(1)(f)); contract once you are a member |
| Privacy and security settings (for example whether others can find you by e-mail) | To apply your choices | Contract |
| Abuse reports: the reason, the accounts involved, your note and the messages you choose to include from your own copy of the conversation | To review reports and act against abuse | Legitimate interest in keeping the service safe |
| Sign-in attempts, stored only as keyed hashes (no e-mail, no IP address) | To stop password-guessing and automated abuse | Legitimate interest in security |
| Organization membership, if you join an organization in CIPHERA | See section 5 | Contract |
We do not store IP addresses in our database or in our logs. Your IP address is used for the duration of a request, including to limit abusive request rates, and is then discarded. Calls connect directly between the devices; if we offer a call relay and a call goes through it, the relay uses the addresses of both devices for the duration of that call only. We do not use analytics, advertising or tracking tools, we do not sell data and we do not build profiles.
4. Who can see what inside CIPHERA
People you communicate with see your display name, your CIPHERA ID, your public keys and the list of your devices (their apps need it to encrypt to each of your devices). If "Findable by e-mail" is on in your privacy settings, someone who already knows your e-mail address can find your account.
On a members-only deployment, operators — the people MSCS di Stefan E. designates to manage the member list — see that list (addresses, domains, who added an entry and when) in the Access section of their Security Center and receive a security event when it changes. They cannot see the content of anyone's communications.
5. Organizations
If you join an organization in CIPHERA, its owner and security administrators can see your display name, e-mail address, your devices (name, platform, app version, activity dates) and security events relevant to the organization's policy. They cannot see the content of your communications.
6. How long we keep data
| Data | Kept |
|---|---|
| Account data, keys' public parts, devices, contacts, settings, security events, push tokens | Until you delete your account or the item (for example a removed device) |
| Your entry on a member list (members-only deployments) | Until an operator removes it; a removed entry keeps its removal date so that the account it disabled stays disabled, and is deleted with your account data on request |
| One-time e-mail sign-in codes (keyed hashes) | 10 minutes, or until used |
| Encrypted messages waiting for delivery | Until delivered to every recipient device, and never longer than 30 days |
| Encrypted files | 30 days after upload, then deleted (storage keeps deleted data for up to 7 more days) |
| Sign-in attempt records (keyed hashes) | 30 days |
| One-time sign-in challenges and tokens | Minutes to hours, until they expire |
| Abuse reports | Until reviewed and then for as long as needed to handle repeated abuse, at most 12 months after the decision; reports you filed are deleted with your account |
| Security audit log: account and device identifiers, the type of action and its time (for example "device revoked"), and for some actions the other account involved — who called whom, who blocked or reported whom, whose identity a user recorded as verified — or, for files, the conversation and the file size. No e-mail, name, message, file or call content | Append-only and tamper-evident; kept while the service operates, because it is the record that proves security actions were taken |
| Operational server logs (no IP addresses, no content) | 30 days |
| Backups of the database | Up to 35 days, then overwritten |
When you delete your account we delete your identity keys, devices, contacts, direct conversations, group memberships, recovery backup, settings, security events, push tokens and reports you filed. We keep only a minimal marker (your account identifier, CIPHERA ID and the deletion date, with e-mail and name removed) so that other users see that the account was deleted instead of an error, and the entries of the security audit log described above, including those that name your account as the caller or the person called. On a members-only deployment your e-mail address stays on the member list until an operator removes it; ask us if you want it removed as well.
7. Service providers and other recipients
We use these providers. Where a provider processes data on our behalf, it is bound by a data processing agreement and must protect the data at least as well as this policy describes.
- Microsoft Azure (Microsoft Ireland Operations Ltd) hosts our servers, database, encrypted file storage and logs (and the call relay, when we offer one), in Italy North (Milan) in the European Union, and sends the e-mail with your sign-in code (Azure Communication Services, data stored in Europe). Processor.
- Apple delivers push notifications to Apple devices and, if you choose it, provides Sign in with Apple (including private relay e-mail addresses). Apple acts under its own privacy policy for these services. CIPHERA is free and sells nothing, so we receive no purchase or payment data from Apple.
- Google or Microsoft, only if CIPHERA offers sign-in with them and you choose it, confirm your identity to us. They act under their own privacy policies. The App Store app offers Sign in with Apple and the e-mail code.
We disclose data to authorities only when the law requires it, and we can only disclose what we have (section 3), never the content of communications. Where a provider transfers data outside the European Economic Area, it relies on the transfer mechanisms of the GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses.
8. Security
Encryption of content is end to end, using published algorithms (X25519, Ed25519, AES-256-GCM, HKDF, SHA-2). Connections to our servers use TLS. Your devices protect their keys with the device keychain and your app PIN or biometrics. Security Center shows every device and session on your account so you can remove any you do not recognize. No system is perfectly secure; if your device itself is compromised, end-to-end encryption cannot protect what is displayed on it.
9. Your rights
Under the GDPR you have the right to access your data, to rectify it, to erase it, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. You can see most of your data in Security Center and delete your account in the app at any time (Settings → Delete account). For anything else write to office@support-remote.org / stefan@support-remote.org; we answer within one month. You can also lodge a complaint with the data protection authority of the country where you live, work or where you believe the infringement took place.
10. Children
CIPHERA is not intended for anyone under 16 years of age. We do not knowingly process data of children under 16; if you believe a child has an account, write to us and we will delete it.
11. Changes to this policy
If we change this policy we will publish the new version here with a new effective date and, for significant changes, tell you in the app before they take effect.