Legal
Privacy policy
Last updated 2026-11-06
This says exactly what Konvella holds about you, why, and for how long. It is specific on purpose: a privacy policy that could describe any service tells you nothing.
Who is responsible
The data controller is an independent developer. For anything in this policy, including a request to see or delete your data, write to support@konvella.com.
What we hold, and why
| What | Why | Kept |
|---|---|---|
| Username, display name, profile picture | So people can find and recognise you | Until you delete the account |
| Email address | Signing in, resetting a password, and security notices: a new sign-in, a password change, two-factor turned on or off | Until you delete the account |
| Whether your email address is confirmed, and a keyed hash of the 6-digit confirmation code while it is valid (never the code itself) | To make sure the address on a new account belongs to the person who made it | The code: 15 minutes. Whether it is confirmed: until you delete the account |
| Whether you want offers and discounts by email, or no emails at all, and when you said so | To send offers only if you turned them on (Settings, then Notifications). Off unless you turn it on; every offer email has a one-click unsubscribe | Until you delete the account |
| When you accepted the terms and privacy policy, and which version | A record that you agreed to them when you signed up | Until you delete the account |
| Password | Signing in | Stored only as an Argon2id hash — never the password itself |
| Messages and files you send | To deliver them and show your history | Until you or the recipient delete them, or you delete the account |
| Who you are friends with, and your groups | To show your conversations | Until you remove them |
| Two-factor secret and recovery codes | Second-factor sign-in | Until you turn two-factor off |
| Sign-in sessions: device name, browser, IP address, rough location | So you can see where your account is signed in and end a session you do not recognise | Until the session ends or expires |
| Devices your account has been used on: device name, browser, last IP address | To warn you when your account is used on a device it has not seen before | A year after the device was last used |
| Remembered devices, if you tick "Remember this device" | So that device can skip the two-factor code | 60 days, or until you remove it |
| Notification subscriptions for your devices | To deliver messages and calls while the app is closed | Until you sign out on that device, or six months unused |
| The address and device you signed up from | To spot a banned account returning under a new name | 90 days |
| If you joined through an invite: a keyed hash of your network (never the address itself) and whether your device already had an invite trial | So the free week from an invite goes to new people, not to a second account of the person who sent it | 90 days |
| Reports you make or that are made about you | Moderation, and so a decision can be reviewed | While the case is open, and afterwards as a record |
| Support requests you send from your account: what you write, our replies, your account's email address, and a keyed hash of your network (never the address itself) | To answer your request and keep support from being abused. Stored encrypted, readable only by you, signed in, and by Konvella staff | Until the request is closed, then two weeks |
| Billing: plan, payment dates and amounts, card brand and last four digits | To run your subscription and show your receipts | As long as tax law requires |
What we do not hold
- Your card number. It is entered on our payment provider's own page and never reaches us. We see the brand and the last four digits, and nothing else.
- Your call audio or video. Calls go directly between the people on them wherever the network allows. We are not in the middle recording anything.
- Any advertising profile. There are no adverts, no trackers and no analytics scripts on this site or in the app.
How it is protected
Messages, files, email addresses and two-factor secrets are encrypted where they are stored, with AES-256-GCM. Passwords are stored as Argon2id hashes, and recovery and password-reset codes as keyed hashes, so none of them can be read back even from a copy of the database. Everything between you and our servers travels over TLS. On the desktop, the details that keep you signed in are held in the encryption Windows or macOS provides for your own account, rather than in an ordinary file.
To be clear about one thing: messages are encrypted at rest, not end-to-end. Our servers can read them. That is what makes it possible to act on a reported message. If you need a service whose operator cannot read your messages at all, this is not that service.
Calls are different
Calls are end-to-end encrypted. Audio, video and screen sharing travel directly between the people on the call and are encrypted by the browser engine with DTLS-SRTP. The keys are negotiated between those devices and never leave them. Only the participants hold the keys needed to decrypt the audio — Konvella cannot decrypt, listen to, or record a call. Neither can anyone who compels us, because there is nothing on our side to hand over.
Our servers relay the connection setup — who is calling whom, and how the two devices should find each other — and nothing else. We know a call happened, between which accounts, and how long it lasted, because that is what billing and abuse reports need. We do not have its contents, and we do not record calls.
There is one attack this kind of encryption does not close by itself, and we would rather name it than let a padlock imply otherwise: because the setup passes through our servers, an operator who wanted to listen could try to put itself in the middle of that setup. So every call shows a safety number, under the padlock in the call window. If the people on the call read it aloud and it matches, nobody is in the middle — and if we ever tried, the numbers would not match. You do not have to take our word for any of this; that is the point of the number.
This applies to every call, one-to-one and group. There is no setting to switch it on and none to switch it off.
Automatic checks on files and pictures
Every file sent in a chat is checked automatically before anyone else can open it. There is no bot in your conversations and no person looks at anything at this stage; it is a step on our servers.
Files are scanned for malware. A file found to be malicious is deleted, along with its message. Nothing happens to the account that sent it. To check a program or document against known malware we may send its fingerprint (a SHA-256 hash, from which the file cannot be rebuilt) to VirusTotal, a malware database. The file itself is not sent anywhere.
Pictures are not currently checked automatically for nudity. Explicit pictures still break the rules: when one is reported, a moderator reviews it and may remove it and limit the account.
Links in messages open normally. A link that downloads a file directly asks you to confirm first; that check happens in the app on your device, and it tells us nothing. To show a preview card under a link, our server fetches the page itself — so the website sees our server, not you.
Who else sees it
We do not sell your data and we do not share it for advertising. It reaches other people only here:
- The people you send it to. Obviously, but worth saying.
- Paddle, our payment provider, who handles subscriptions as merchant of record and receives what they need to bill you.
- Our hosting and storage providers — Render (servers), MongoDB Atlas (database) and Cloudflare R2 (large attachments) — who store the encrypted data on our behalf and may not use it for anything else.
- Moderators, when something is reported. For a reported message they see that message and the account it came from; for a reported account they see its profile — name, username, bio and pictures.
- The authorities, if we are legally required to hand something over. We will tell you when we are allowed to.
A few features work by asking an outside service a narrow question. None of them is given your messages, and none may use what it receives for anything else:
- Have I Been Pwned — when you choose a password, we check it against passwords leaked in other services' breaches. Only the first five characters of a hash of the password are sent; never the password, and never enough to work it out.
- ipwho.is — the IP address a sign-in came from, to show a rough city and country in your list of signed-in devices.
- GIPHY — what you type into the GIF search. The GIFs themselves load from GIPHY's servers, which therefore see your IP address when one is shown.
- Push notification services — Apple, Google, Microsoft or Mozilla, whichever your device uses, carry notifications to it while the app is closed. The content is encrypted for your device and they cannot read it; they see only that a notification was delivered.
- Cloudflare — sits in front of konvella.com to keep it up and to stop attacks and bots. Like any network provider it sees the IP address and browser of each visit, but not your messages, which travel encrypted. When you sign up, its bot check (Turnstile) looks at the browser to tell a person from a script; it does not identify you.
- GitHub — the desktop app downloads its updates from GitHub, which sees the IP address doing the download.
- An email delivery service, when we send you an email such as a password reset, a security notice or, if you asked for them, an offer. Today that is Resend, sending from the EU.
Your rights
Two of these you do not have to ask us for. Open Settings › Account & Security › Your data in the app:
- Download your data gives you one file containing your profile, your friends, your groups, the messages you sent and a list of the files you uploaded. What other people wrote is not included: a conversation is two people, and the other half is not yours to take away in a file.
- Delete your account does it immediately. There is no grace period and no undo, so take a copy first if you want one.
Both ask for your password again, and for a code if you have two-factor authentication on. That is not because we doubt you are signed in; it is so that a borrowed unlocked laptop is not enough to empty your account.
When you delete your account:
- Your profile, your friends list and your sign-in go straight away.
- Messages you sent are removed. In a group chat the words go but the message keeps its place in the conversation, so nobody else's thread reshuffles around the gap.
- A group you own passes to its longest-standing member, so a group does not disappear because the person who created it left. A group with nobody else in it is deleted.
- What other people wrote stays theirs. We do not delete someone else's messages because you left.
- If you reported somebody, the report is kept but no longer points at you. It is their account of something that happened to them, and your leaving does not unmake it.
- Records of moderation decisions made by our team are kept. They exist to show what we did, and a deletion that erased them would defeat the only reason we keep them.
You can also ask us to correct anything that is wrong, or to stop processing your data in a particular way. Write to support@konvella.com and we will answer within 30 days. There is no charge. If you are in the EU or the UK and you think we have handled your data badly, you can complain to your national data protection authority.
Cookies
We use no advertising cookies, no analytics and no tracking of any kind. The only cookies set are strictly necessary ones:
- Security cookies from Cloudflare (such as
cf_clearanceand__cf_bm), set when the site checks that a visitor is a person rather than a bot. They hold no personal profile and expire within a day. - Checkout cookies from Paddle, on the payment page only, which it needs to take a payment you have asked to make.
Because these are strictly necessary for security or for something you asked for, the law does not require your consent for them, so there is no cookie banner asking for it. Our typefaces are served from konvella.com itself rather than from a third party.
The app also stores a few things locally on your own device — your theme, your microphone choice, the tokens that keep you signed in, and which announcements you have already seen. They stay on your device.
Children
Konvella is not for anyone under 16. If we learn an account belongs to a child under that age, we close it and delete its contents.
Where your data is
Our servers and database are hosted in the United States and the European Union. If you are in the EU or the UK, that means your data may be transferred outside your country; we rely on the standard contractual clauses our providers offer for those transfers.
Changes
If we change this policy in a way that affects you, we will tell you in the app before it takes effect rather than quietly editing this page.
Questions: support@konvella.com