Privacy Policy

1. Who we are

Redacted is an encrypted messaging application developed and operated in Australia. We are committed to protecting your privacy and handling your data with transparency.

2. What we collect

We collect only what is necessary to operate the service:

• Username — chosen by you at registration. Not your real name.
• Password hash — your passphrase is hashed using bcrypt before storage. We never store or see your actual passphrase.
• Public key — used for encryption. Generated on your device.
• Message ciphertext — messages are stored temporarily in encrypted form on our server until delivered. Once a message self-destructs, the ciphertext is permanently wiped from our database.
• Timestamps — when messages were sent and opened, used only to calculate destruction timers.

We do not collect your phone number, email address, real name, location, contacts, or any other personal information.

3. What we do not collect

• Phone numbers or email addresses
• Real names or identity documents
• Location data or IP address logs
• Device identifiers or advertising IDs
• Contacts or address book data
• Usage analytics or behavioural tracking
• Third-party tracking cookies or pixels

4. How messages are handled

Messages in Redacted are designed to self-destruct. Here is exactly how it works:

• Messages are stored in encrypted form on our server after being sent.
• When the receiver opens a message, a countdown timer begins.
• When the timer expires, the message status is set to "destroyed" and the encrypted content is permanently wiped from our database — replaced with nothing.
• Unread messages expire automatically after 7 days regardless of whether they were opened.
• We do not maintain backups of message content. DigitalOcean automated backups are not enabled on our server.

5. Encryption

All communication between the app and our server uses HTTPS/TLS encryption. Messages are encrypted before leaving your device. Our server handles encrypted ciphertext only — we do not have access to the content of your messages.

6. Data sharing

We do not sell, rent, or share your personal data with any third parties for commercial purposes. We do not use advertising networks. We do not share data with data brokers.

We may disclose data only if required to do so by Australian law or a valid court order. In such cases we will provide only what is legally required — which in most cases is limited to username and account creation timestamp, as we do not retain message content.

7. Data retention

• Account data (username, password hash, public key) — retained until you delete your account.
• Message content — wiped permanently upon self-destruction or expiry.
• Message metadata (timestamps, status) — retained briefly for operational purposes, then deleted.

8. Your rights

Under Australian Privacy Law and applicable regulations, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent at any time by deleting your account

To exercise any of these rights, contact us at the address below.

9. Children

Redacted is not intended for use by anyone under the age of 16. We do not knowingly collect data from children. If you believe someone under 16 has created an account, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the date at the top of this page. Continued use of Redacted after changes constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Email: theredactedapp@gmail.com
Website: redactedapp.com

To report abuse or illegal content, email theredactedapp@gmail.com. We respond within 48 hours.

© 2026 Redacted. Built in Australia. No logs · No traces · No compromise.