Qorchat privacy policy

The short version

Your conversations are end-to-end encrypted. We cannot read them.
A phone number is optional. Qorchat works without one.
If you add a number, we do not keep the number itself — we keep a keyed one-way hash of it.
To send you a code, the number must be handed to a delivery provider and to mobile carriers. They see it. We do not pretend otherwise.
We do not sell or rent your number, and we do not pass it to anyone for their own marketing or messaging.
This website sets no cookies and loads nothing from any other company.

What we collect

Your account: A username you choose, a passcode verifier, and the cryptographic keys your devices publish so other people can start an encrypted conversation with you. We never receive your passcode itself or the private keys that decrypt your messages.
Messages in transit: Encrypted message payloads are held only until the receiving device collects them, and we cannot decrypt them. Delivering a message requires knowing which account it is for; it does not require knowing what it says, and we do not know what it says.
A phone number or email address, only if you add one: Adding one is a choice you make inside the app, and you can remove it again at any time. Nothing about signing up or using Qorchat requires one.
This website: The program that serves these pages writes no record of your visit at all — not the page, not your address, not your browser. No cookies are set, no scripts run, and nothing is loaded from another company's servers, so nothing on the page reports your visit anywhere. Our own ingress server, which sits in front of it, has access logging switched off for this site, so it does not write a line for your visit either. If a request fails, that server may note the error — with the address the request came from — in its diagnostic log, which we keep only for troubleshooting and never use as a record of who visited. One piece of infrastructure does see every request, and we will not pretend it does not: Cloudflare, Inc. carries the connection and terminates its encryption at its edge, so it sees the request in the same way any network provider in the path would. We do not run analytics.

What we store about a phone number

This is the part people ask about, so it is written precisely.

The number you type is normalised to its international digits, and a keyed HMAC-SHA256 hash of that is what is written to our database. The number itself is not stored in that record, and there is no column that holds it.
Alongside the hash we store which kind of identifier it is, the moment it was verified, and whether you asked to be findable by it.
When you agree to receive codes by text, we keep a record of that agreement beside the hash: which version of the wording you agreed to, which screen you agreed on, when you agreed (by your phone's clock) and when we received it. The number itself is not in that record either. No code is sent unless that record has been kept.
The six-digit code is not stored either. A keyed hash of the code, bound to that one verification attempt, is stored so the code you type can be checked against it.
A code is valid for ten minutes, and five wrong guesses spend it.
We allow at most six codes per account per hour, and at most ten codes per day to any one destination — counted against the hash, not against the number.
The text we send names the product, the six digits, and one instruction. It does not name you, your account, your username, or anyone you talk to.
The code is never written to a log, an error message or an operator's console.
If you remove the number in the app, or delete your account, the number's hash is removed from your account. So that we can show, if it is ever questioned, that a text was sent with your agreement, a short proof of the agreement is kept for 12 months afterwards and then deleted: the keyed hash, the wording version, the screen, when you agreed, when we received it, and when and why it ended. It is not linked to your account. The same proof is kept if a code was sent to a number that was never confirmed.

Who else sees your phone number

A verification code cannot reach a handset without somebody being told which handset. We will not claim otherwise.

Amazon Web Services, Inc. is our SMS delivery processor. When you ask for a code, the destination number and the text of the message are sent to AWS End User Messaging SMS so that it can be delivered. AWS processes this on our instructions, to deliver that message.
Mobile carriers. AWS hands the message to the carrier networks that actually reach your handset. They see the destination number, as they must to route a text. Your own carrier's handling of the message is governed by its own terms and privacy practices.

That is the whole list. We do not sell your number, we do not rent it, and we do not give it to anyone — affiliate, partner or advertiser — to use for their own messaging or marketing. The only reason it leaves our service is to deliver a code you asked for.

If you never add a phone number, none of the above happens, because there is no number to send anywhere.

Who carries the app's connection

The Qorchat app reaches our service over the public internet through Cloudflare, Inc., which provides the network path and terminates the connection's transport encryption at its edge. It therefore sees that a device is talking to us, and when. It does not see your messages: those are encrypted end-to-end between devices, underneath the transport, and our own service cannot read them either. The app additionally checks a signature our service puts on its answers, so a change made in the middle of that path would be detected by your phone rather than accepted.

Your own AI endpoint

If you add your own AI endpoint and turn it on in a chat, Qorchat sends the question and the messages you review to that endpoint, straight from your phone, only when you tap Send. Qorchat's service does not see them; what the endpoint keeps is up to whoever runs it.

Pause delivery and Offline mode

If you turn on Pause delivery or Offline mode, Qorchat keeps which one is on, when it ends, and when your last Offline mode began and ended, and uses them only to hold or turn away messages sent to you. It never learns what anyone wrote, and it does not record who was turned away.

Nudges, broadcasts and shared updates

Nudges: If you send a nudge, Qorchat keeps which account sent it and which account it was for for one hour, and when it was sent for one day, to enforce the limits on how often people can be nudged. It contains no message. If you choose that nobody can nudge you, Qorchat keeps that setting.
Broadcast lists: If you send a broadcast, Qorchat keeps for two days which accounts it was sent to, whether each one accepted it, and how many people it went to, so that trying again reaches the same broadcast and the limits on repeated sends can be applied. It never sees the words. Each account has a private broadcast key so Qorchat can check that a person agreed to receive your broadcasts without holding your contact list. If you report a sender, or turn off broadcasts from contacts, Qorchat keeps that choice; reports count towards pausing a sender's broadcasts for 30 days.
Notify when available: If you choose people to tell when you are unavailable, Qorchat keeps a scrambled reference for each of them until fifteen minutes after your Pause delivery or Offline mode ends, and never longer than a day, so that they can ask to be told once. If someone asks, Qorchat keeps which account asked until the request is answered or a day passes. It never tells anyone when you were last active, and never tells anyone who else asked.
Contact codes: If you stop sharing a contact code, Qorchat keeps a scrambled reference to that code for up to ten minutes, the longest a code can live, so that it cannot be used after you stopped sharing it.
Now, Now Playing and Shared Checklists: These travel end-to-end encrypted like messages. Qorchat holds each copy only until it is delivered or the line expires, and cannot read it.

Text messages are only sent after you agree to them on a screen in the app that asks for that specifically, separately from anything else you are agreeing to. You can withdraw that consent at any time by removing the phone number from your account in the app, or by replying STOP to a message. See the SMS terms.

How long we keep things

The hash of a verified number: Until you remove that number, or delete your account.
The record of your agreement to receive texts: While the number is on your account. After you remove the number, delete your account, or leave a sent code unconfirmed, a short proof of the agreement (the keyed hash, the wording version, the screen, and when you agreed and when it ended) is kept for 12 months, not linked to your account, and then deleted.
An unverified code challenge: Ten minutes, or until the code is used or spent.
Undelivered encrypted messages: Until the receiving device collects them, or the service's retention window expires, whichever comes first.
Delivery-duplicate records: Our SMS delivery step keeps a short-lived record of each delivery's random identifier, so that a retry cannot become a second text. That record holds the identifier and nothing else — no number, no code.
Website request records: None are written by the program serving these pages, and access logging is switched off for this site at our ingress server. A failed request may leave an error line in that server's diagnostic log, kept only for troubleshooting.

Your rights

Depending on where you live you may have the right to ask what we hold about you, to have it corrected, to have it deleted, and to object to or restrict how it is used. Account deletion is available in the app and removes your account and its identifier hashes; the short proof of an agreement to texts described above is kept for 12 months, not linked to your account, and then deleted. For anything else, write to support@qorwyn.com and we will answer within 30 days.

We cannot produce the content of your messages on request, because we cannot read them.

Children

Qorchat is not directed at children under 13, and we do not knowingly collect their personal data.

Changes to this policy

If this policy changes in a way that affects what we do with your phone number, the date at the top changes and the new version is published here before the change takes effect.

Contact

Fourthman LLC. Email support@qorwyn.com.

Privacy policy