REDACTED

Privacy Policy

Last updated: September 2026

Redacted is built on a simple principle: your conversations are yours. We collect as little as possible, store nothing we don't need, and your messages are designed to disappear.

1. Who we are

Redacted is an encrypted messaging application developed and operated in Australia. We are committed to protecting your privacy and handling your data with transparency.

2. What we collect

We collect only what is necessary to operate the service:

Username — chosen by you at registration. Not your real name.
Password hash — your passphrase is hashed using bcrypt before storage. We never store or see your actual passphrase.
Public key — used for encryption. Generated on your device.
Message ciphertext — messages are stored in encrypted form on our server until they self-destruct, expire unread, or are deleted. The ciphertext is then permanently wiped from our database.
Photos, voice notes and videos — stored encrypted on our server until the message they belong to self-destructs, expires unread, or is deleted, and then deleted from our server.
Message records — which conversation a message belongs to, who sent it, when it was sent and opened, and its status. Used to deliver messages and run destruction timers.
Push notification token — only if you turn on notifications. Used only to deliver notifications.
Last-seen time — updated when you log in.

We do not collect your phone number, email address, real name, location, or contacts.

3. What we do not collect

Phone numbers or email addresses
Real names or identity documents
Location data or IP address access logs (our web server keeps no access logs; its error log can occasionally record an IP address and is deleted within 3 days)
Advertising identifiers
Contacts or address book data
Usage analytics or behavioural tracking
Third-party tracking cookies or pixels

4. How messages are handled

Messages in Redacted are designed to self-destruct. Here is exactly how it works:

Messages are stored in encrypted form on our server after being sent.
When the receiver opens a message, a countdown timer begins.
When the timer expires, the message status is set to "destroyed", the encrypted content is permanently wiped from our database, and any photo, voice note or video attached to it is deleted from our server.
Unread messages expire automatically after 7 days regardless of whether they were opened.
Messages sent with the "Never" timer are not destroyed automatically: they stay on our server after they are opened until they are deleted or the sender deletes their account.
Backups: for disaster recovery we keep a daily copy of our database (on our server and with Backblaze) for about 8 days, and our hosting provider, DigitalOcean, keeps weekly backups of the whole server for 4 weeks. Anything deleted from our live systems can remain in these backups for up to 4 weeks, after which it is permanently deleted.

5. Encryption

All communication between the app and our server uses HTTPS/TLS encryption. Messages are encrypted before leaving your device. Our server handles encrypted ciphertext only — we do not have access to the content of your messages.

6. Data sharing

We do not sell, rent, or share your personal data with any third parties for commercial purposes. We do not use advertising networks. We do not share data with data brokers.

We may disclose data only if required to do so by Australian law or a valid court order. In such cases we will provide only what is legally required, and only what we actually hold at that time — for example account details, message records not yet deleted, and any encrypted messages or media still on our server or in our backups.

7. Data retention

Account data (username, password hash, public key, push token, last-seen time) — retained until you delete your account, then removed from our live systems immediately.
Message content and media — wiped permanently upon self-destruction, expiry or deletion. Messages sent with the "Never" timer are kept until they are deleted or the sender deletes their account.
Message records (conversation, sender, timestamps, status) — deleted automatically once the message has been destroyed or has expired and was sent more than 7 days ago.
Server logs — our web server keeps no access logs. Its error log, which can occasionally record an IP address, is deleted within 3 days.
Backups — database copies are kept for about 8 days; full-server backups for up to 4 weeks.

8. Your rights

Under Australian Privacy Law and applicable regulations, you have the right to:

Access the personal information we hold about you
Request correction of inaccurate information
Request deletion of your account and associated data
Withdraw consent at any time by deleting your account

To exercise any of these rights, contact us at the address below.

9. Children

Redacted is not intended for use by anyone under the age of 16. We do not knowingly collect data from children. If you believe someone under 16 has created an account, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the date at the top of this page. Continued use of Redacted after changes constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at:

Email: theredactedapp@gmail.com
Website: redactedapp.com

To report abuse or illegal content, email theredactedapp@gmail.com. We respond within 48 hours.

12. Third party services

Redacted uses the following third party services to operate:

RevenueCat — processes subscription payments. Subject to RevenueCat's privacy policy.
Expo and Apple (Notifications) — deliver push notifications. Push tokens are shared with them for this purpose only.
DigitalOcean — hosts our server infrastructure in Sydney, Australia, and keeps weekly backups of it for 4 weeks.
Backblaze — stores our off-site database backups (encrypted at rest, kept about 8 days).