Privacy policy
Last updated 18 August 2026
SatChat is a messenger built so that the people running it cannot read what you write. This page says what we hold, what we do not, and what you can do about it.
What we hold
| Data | Why | How long |
|---|---|---|
| Apple user identifier | Signing you in | Until you delete your account |
| Google account id, if you use Google | Signing you in | Until you delete your account |
| Phone number, if you sign in with one | Signing you in | Until you delete your account |
| Email, if you did not hide it | Account recovery | Until you delete your account |
| Username and display name | So people can find you | Until you delete your account |
| Avatar, if you set one | Shown to your contacts | Until you delete your account |
| Public keys for each device | Encrypting messages to you | Until you remove the device |
| Who is in a conversation | Delivering messages | Until you delete your account |
| Sealed message contents | Delivering messages | Until collected, 30 days at most |
| Push token | Notifying you | Until you sign out |
What we never hold
- Your messages in readable form. Your iPhone seals them before they reach us and we have no key that opens them.
- Your private encryption keys. They are generated on your device and never transmitted. There is no backup of them anywhere.
- Your address book. SatChat never uploads it. You find people by username.
- Location history. Only a location you choose to send, sealed like any message.
- Advertising identifiers. No advertising, no third party trackers in the app.
Choosing how you sign in
You can sign in with Apple, Google, an email address and password, or a phone number. The choice changes who else learns you use SatChat, and nothing else: your encryption keys are created on your iPhone afterwards and derive nothing from the account.
Google's sign-in tells Google you use SatChat. A phone number means an SMS, which your carrier can see. Sign in with Apple shares the least of the four and can hide your email address, which is why it is the first button on the screen.
What we can see
We can see that you messaged someone and when. Routing a message requires knowing where to send it, so our servers hold the sender, the recipient devices, sizes and timestamps. We cannot see the contents.
Notifications
A notification says you have a new message. It does not carry the text, because we never had it, and it does not name the sender either. A lock screen is the one place where somebody other than you is most likely to be looking.
Diagnostics
The app reports crash counts, send failures and connection type as a category. It never reports message contents, precise location or anything tying an event to a particular message. On a very limited connection it reports nothing at all, since that bandwidth belongs to your messages.
This website
The site loads Google Analytics only after you accept the banner. Decline and nothing is loaded and no cookie is set. You can change your answer with the Cookie preferences link in the footer. Your theme choice is stored in your own browser and never sent anywhere.
Your controls
- Delete your account. Settings, then Delete account. Two taps. It removes your account, username, devices, keys and undelivered messages from our servers, and no email to support is involved.
- Sign out. Removes the keys and messages from that device. Messages already there stop being readable.
- Block someone. They cannot message you and we stop delivering to you on their behalf.
- Report someone. The report carries metadata and your account of what happened. We cannot read the messages you are reporting, which is a real limit and a direct cost of the encryption.
- Remove a device. It stops receiving new messages.
Children
SatChat is for people aged 13 and over. It has no features directed at children.
Changes
If this policy changes in a way that affects what we collect, we will say so in the app before the change takes effect.
Contact
Write to hello@kodefoundry.com.