Privacy Policy

Introduction

Verboo ("we", "us", or "our") is a real-time messaging and communication platform, currently under active development and available through open beta testing. This Privacy Policy explains how we handle personal information when you use the Verboo application, SDKs, services, and related websites. As the product evolves, this policy will be updated to keep matching how it actually works.

We keep the personal data we collect to a minimum, we don't use it for advertising or profiling, and we don't sell or share it. The sections below describe what that data is and how it's handled.

Data Collection

• Account email: When you register, we collect the email address you provide. It is used solely to verify your account and to let you recover access if you lose your password — not for marketing, and not shared except as described under Data Sharing below.
• Message, room, and file data: To deliver messages, calls, and files to the right recipient, this data passes through our server infrastructure, and may be held briefly (e.g. when a recipient is offline) until it can be delivered. We do not read, analyze, or otherwise access this content as part of normal operation, and it is not kept longer than the service needs it for.
• Diagnostic logs — only when you choose to send them: The app keeps a local, on-device activity/debug log (connection and call events, e.g. "connecting", "call started", transport/reconnect status — never your message text). It is kept on your device only, for up to 7 days and up to 10 MB; older entries are removed automatically. You can turn it off in Settings → Data and Storage, which erases what was kept, or erase it there at any time. After you send a log, the copy on the device is erased. Nothing is sent anywhere automatically. If you run into a problem and tap "Send to Server" in the app's Log screen, that log file — together with basic device info (model, OS version, CPU architecture, app version/build) — is uploaded to our own storage, tied to your account, and used only to investigate the issue you reported. We don't run this in the background, don't sample it for analytics, and don't send it to any third party.
• No background analytics or tracking: Outside of a log you explicitly choose to send as described above, the app does not send usage statistics, crash reports, or telemetry data to any external service.
• No advertising: Verboo does not display advertisements and is not integrated with any advertising networks.

Data Stored Locally on Your Device

The following data may be stored locally on your device by the Verboo application for offline access and functionality:

• Contact information: Names and identifiers of people you have communicated with, used to auto-resolve chat titles.
• Chat history: Messages exchanged within conversations, stored in an encrypted local database on-device.
• Encryption keys: Hardware-backed AES encryption keys (Android Keystore / iOS Keychain) used to protect the local message database. These keys are tied to your device's secure hardware and cannot be extracted by other applications.

Data Security

We take security seriously. Verboo employs multiple layers of protection:

• On-device encryption: The local database (SQLCipher on Android) is encrypted with a hardware-backed AES key wrapped by the device's secure enclave or keystore.
• TLS transport security: All communications between your app and the Verboo server use TLS, ensuring data in transit is protected from interception.
• No third-party SDKs for analytics or tracking: The application does not integrate any external services that collect personal information.
• End-to-end encryption: Since version 1.8.0 of the apps, direct chats, encrypted groups and calls are end-to-end encrypted. Messages, files, and the audio and video of calls are encrypted on the sender's device with keys that never leave the devices of the people in the conversation unencrypted; our infrastructure relays them, and briefly holds them for delivery, without being able to read them. To deliver them, our servers still process service data: who communicates with whom and when, the size and kind of each message or file, the members of groups and the network addresses of devices, and they store the public keys of devices, which others use to encrypt messages to them.
• Chat backup: If you have created a recovery phrase and have not switched the backup off, your device seals the keys to your conversations with a key derived from your recovery phrase, and only then sends the backup to us. The phrase never reaches us. We store the sealed backup, a fingerprint of a verification value derived from the phrase, and the facts that a backup exists, its approximate size, when it was last updated and when a device last presented the correct phrase. Without the phrase neither we nor anyone else can open the backup.
• Channels and open groups: Channels and open groups are not end-to-end encrypted. Their content is protected in transit by TLS, and our infrastructure has technical access to it while relaying or holding it for delivery. We do not access, read or analyse it as a matter of policy and practice.
• Reports: When you report a message, a post, a user, a group or a channel, the app sends the report, and the reported message with up to five messages before it, end-to-end encrypted to Verboo's moderation account. Verboo's moderators can read what you report. We keep reports for one year, and reports of content involving a minor for at least ten years, to pass them to the competent authorities. Messages you send through Contact Us are read by us and copied to our support mailbox.

Data Sharing

We do not sell, rent, or share your personal data for advertising or marketing purposes. The one third party involved in handling your data is our transactional email provider, ZBounce, which delivers account-related emails (registration verification, password recovery) on our behalf — it receives only the email address needed to send that specific message. We do not disclose your data to any other third party.

Turning voice and video messages into text happens on your device; our server takes no part in it. The exception is an iPhone or iPad on iOS 18 and a Mac on macOS 15: there speech is recognized by Apple's servers, so the recording is sent to Apple, only after your explicit consent and only for the messages you ask to be turned into text. This is the only other case in which your data goes to a third party.

On Windows, speech is recognized on your computer by Whisper, an open speech recognition model developed by OpenAI, run by the open whisper.cpp library; no recording or message leaves your computer for this.

Children's Privacy

Verboo is not intended for use by children under the age of 12. We do not knowingly collect personal information from children under 12. If you believe a child has provided personal data through our application, please contact us.

Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information, including the right to access, correct, or delete it. The personal data we retain is the account email address described above, plus any diagnostic log you've chosen to send us. You can:

• Contact us to have your account email address deleted.
• Contact us to have any diagnostic log you've sent us deleted.
• Uninstall the Verboo application from your device at any time.
• Clear all locally stored data (messages, contacts) through the app's settings.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by updating the "Last Updated" date at the top of this policy and, if required by applicable law, through other appropriate channels.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Verboo Team
Email: support@verboo.org