Vili ChatPrivacy Policy
Vili Chat is built so that we learn as little as possible. Your messages are encrypted end to end, our servers cannot read them, and nothing we run keeps your address book. This policy says exactly what our servers do learn, why, and for how long.
1. Who we are
Vili Chat (the apps for macOS and iOS, a Windows app later, and the servers at vili.me) is operated by Evgenii Takhtai, who is responsible for the processing described here ("we", "the operator").
- Privacy, support and data-protection requests: support@vili.me
- Abuse and reports: abuse@vili.me
- Security vulnerabilities: security@vili.me
A postal address for data-protection matters is available on request at support@vili.me.
Features that do not exist yet, such as calls and the optional mirror, will be described here before they are released.
2. In short
- Messages, photos, files and their names are encrypted end to end on your device. Only the people in the conversation can read them. Our servers handle ciphertext only.
- To let people find you by phone number, our directory keeps a keyed hash of your number and your devices' public keys. It never stores your number in plain text.
- Contact discovery sends your contacts' phone numbers for matching. They are hashed during the request and never stored or logged.
- No advertising, no analytics, no tracking, no third-party SDKs that collect data. We do not sell or share your data for marketing.
- Nothing is backed up to our servers. You can delete your account in the app at any time.
3. On your devices
Your conversations, contacts list, attachments and keys live on your devices. The app keeps them in an encrypted database (SQLCipher) whose key is protected by the system keychain. Your account's identity key and each device's keys are created on the device; the private keys never reach our servers. When you link another of your devices, the identity key is copied to it directly over an authenticated connection between the two devices.
Device names (for example "Evgenii's Mac") travel between your own devices end to end. While a device registers, its name goes to the directory once, so that the Telegram bot and your existing devices can show it before you confirm (section 6); the server erases it when the registration completes.
4. What our servers learn
Vili's servers are separate components with separate credentials and separate data, so that one component cannot see what another holds.
- Directory
Connects a phone number to an account. It stores an HMAC of your number (a hash computed with a secret key only the directory holds), your account's public key, the public keys of your devices and whether each is a full device, a hash of your registration-lock PIN if you set one, and the last day on which one of your devices was active (used for the inactivity rule in the support FAQ). It also keeps abuse limits for the number, and, when your account key changes, a record of the old key so your contacts can be told. During a request it sees your device's IP address, which it keeps in memory for rate limiting only.
- Verifier
Confirms that you control the number (section 6). It sees your number for the length of one request and passes it to the directory, which hashes it at once; neither writes it to disk.
- Relay
Helps devices find each other and passes encrypted traffic when a direct connection is not possible. It sees device identifiers (public keys), connection times and the amount of encrypted data. It cannot read the data.
- Wake
Asks Apple (and, for Windows, Microsoft) to wake or notify a device (section 8). It stores push tokens and a security counter per device, and keeps in memory, for at most 20 minutes, which device asked to wake which one, to enforce limits. A device can be woken only by peers it has authorised.
- Abuse intake
Receives the reports you choose to send (section 9). It has no access to the directory or to anything else.
Server logs record outcomes and counts. The directory, verifier, wake and abuse logs contain no phone numbers, account or device keys, device lists, push tokens, report contents or IP addresses. The relay's logs can contain the first 10 hexadecimal characters of a connecting device's key, connection identifiers and connection addresses. Logs are rotated by size and are not archived. The proxy in front of our API keeps no access log.
5. How long we keep it
| Data | Where | Kept until |
|---|---|---|
| Keyed hash of your number, account key, device public keys, PIN hash and attempt counters, last active day, abuse limits | Directory | You delete your account, or the number is registered to a new account |
| A registration in progress (device key, device name, one-time code) | Directory | 1 hour after its 10-minute code expires; 25 hours if the number was verified. The device name is erased as soon as the registration completes |
| After you delete your account: the keyed hash of the number, the deleted account key and the number's abuse limits | Directory | 30 days, so that deleting and re-registering cannot reset limits or hide a key change |
| Key-change notice (the replaced key and when it changed) | Directory | 90 days after the change; after a deletion at most 120 days in total |
| Link between an old and a new account key after a key rotation (two public keys and signatures, no phone number) | Directory | 365 days after the rotation, then the old key alone for 30 more days. It stays after account deletion, so that a removed device cannot reuse the old key |
| Phone numbers checked during contact discovery | Directory memory | The end of the request; never stored or logged |
| Your phone number in plain text | Verifier and directory memory | The end of the request; never written to disk |
| Telegram chat identifier and the pending registration | Verifier | You share your contact, or 10 minutes |
| SMS route (when available): the provider's verification identifier and counters; a keyed hash of the number with that day's count of codes sent | Verifier | 10 minutes; the daily count until the day ends (UTC) |
| Push tokens | Wake | You delete your account or turn off the token, Apple or Microsoft reports it invalid, or 90 days pass without the app refreshing it |
| A device's wake security counter | Wake | 90 days after its last change, once the device has no push token |
| Which device asked to wake which device, and when | Wake memory | At most 20 minutes |
| IP addresses | Memory of each server, for rate limits | The server restarts or the limit expires; never written to the directory, verifier, wake or abuse logs |
| Abuse reports | Abuse intake | The report is handled, and at most 90 days after it was received |
| Number of reports your account sent today | Abuse intake | The day ends (UTC) |
| Server logs | Each server | Rotation by size (five files of 10 MB per component) |
| E-mail you send us | Our mailbox | As long as needed to answer you; for abuse cases normally no longer than 90 days |
| Encrypted server backups (directory, wake and, while a report is being handled, the abuse intake) | Backup storage | At most 30 days |
Deleted database rows are overwritten. Server backups are encrypted, access-restricted and kept for at most 30 days, so a deletion reaches every backup within 30 days.
6. Verifying your number
You register with a phone number you control. Two routes confirm it:
Telegram
The app opens a chat with the Vili Chat bot on Telegram. The bot shows your device's name and a six-digit code that the app shows too, so you can check that the request is yours. You then share your own contact with the bot; it accepts only the contact of the Telegram account that sends it. The verifier passes the number to the directory, which keeps only its keyed hash. We do not keep your Telegram user ID. Telegram learns that your Telegram account talked to our bot and the number you shared; Telegram's own privacy policy applies to that.
SMS (when enabled)
We are adding verification by text message for selected countries. When it is enabled, it is provided by Twilio (Twilio Verify, Twilio Inc., United States): Twilio receives your number, generates and sends the code, and checks it; Twilio keeps the number, the code, the time and the delivery status under its own retention rules. We keep no number and no code: only Twilio's verification identifier and counters for 10 minutes, and a keyed hash of the number with the day's count of codes sent until the day ends. This section will be updated with the details before SMS verification starts.
After the proof, a number that already belongs to an account can only move to a new key with the approval of one of that account's devices or its registration-lock PIN, and the account's contacts see a key change.
7. Finding your contacts
If you allow Vili Chat to access your contacts, the app sends the phone numbers from your address book (no names, e-mail addresses or other fields) to the directory, in batches signed by your device. The directory hashes each number, checks which belong to Vili accounts, answers with their public keys, and forgets the numbers when the request ends. Daily limits stop anyone from testing large numbers of phone numbers. The results stay on your device. You can decline access and add people by number instead, and you can withdraw access at any time in your device's settings.
We never contact anyone in your address book and never build a database from it.
8. Notifications
A phone or computer that is asleep cannot receive a direct connection, so a sender's device asks our wake server to have Apple wake yours. If you allow notifications, the app gives Apple's push service (APNs) and our wake server a push token. A push from us contains no sender and no message: a visible notification carries the placeholder "Vili Chat · New message", which your device replaces after decrypting a short encrypted hint that only your device can open. Apple therefore learns that your device received a push from Vili Chat and when, but not who wrote or what. Silent pushes that let the app fetch messages in the background carry no visible text at all. The Windows app will use Microsoft's push service (WNS) in the same way.
9. Reports and blocking
Blocking happens on your devices; our servers do not learn whom you block.
When you report someone, you choose up to 20 of their messages. The app sends our abuse intake, signed by your account: your account's public key, the reported account's public key, your conversation's safety code, a one-way hash of the conversation identifier, the reason you picked, your optional note, and the selected messages as you see them together with their encrypted originals (whose framing also carries the conversation's random identifier). Nothing is sent without your action. Only the operator reads reports, on the server, to decide what to do (see the Terms of Use). A report is deleted when it has been handled, and at the latest 90 days after it arrived. We disclose a report only where the law requires it, for example to the authorities for illegal content. The person you report is not told who reported them.
You can also write to abuse@vili.me.
10. Deleting your account
In the app, open Settings › Account › Delete Account… and confirm. Deletion needs an internet connection; if the server cannot be reached, nothing is deleted.
- Deleted at once: your number's entry and your device list on the directory, the push tokens of your devices that can be reached, and everything on the device you delete from: keys, messages, attachments and caches.
- Kept for a limited time: the pseudonymous record of the number and the deleted key for 30 days; a key-change notice for your contacts for up to 120 days; the link from an earlier key, if your key was ever rotated, for the rest of its 365 days; push tokens of offline devices until they expire after 90 days; encrypted server backups for at most 30 days.
- Not affected: messages your contacts already received stay with them; backup archives in folders you chose are yours to delete; a saved recovery kit no longer restores the account.
If you no longer have any device, see Lost every device or write to support@vili.me.
11. Backups and the recovery kit
Vili Chat has no cloud backup of its own. When you register, the app shows a recovery kit: 24 words that restore your identity if you lose every device. Keep it offline; we never see it. Encrypted backups, when the app offers them, are protected by a passphrase you choose and are written only to a folder you pick (for example iCloud Drive, OneDrive or an external disk). If that folder is a cloud service, its provider's terms apply to the encrypted file.
12. Other services involved
- Hosting: our servers run on virtual machines rented from a cloud server provider in Japan. The provider operates the hardware that holds the data described in this policy; message contents are not part of it, because they are encrypted end to end.
- Telegram (registration route, section 6) and Twilio (SMS route, when enabled).
- Apple (push notifications, and the App Store and TestFlight under Apple's own terms) and Microsoft (push notifications for the Windows app).
- Cloudflare serves this website and our domain's name service. It processes your IP address and request details to deliver pages and to protect against attacks. This site sets no cookies and runs no scripts or analytics.
These services may process data outside your country, including in Japan and the United States. We pass them only what is described above.
13. Legal bases
We operate under the laws of Thailand, including the Personal Data Protection Act B.E. 2562 (2019). Where another data protection law also applies to you, such as the EU or UK GDPR, you have its rights as well. Our legal bases are:
- Providing the service you asked for: registration, the directory, relaying, notifications, account deletion.
- Legitimate interests in keeping the service secure and free of abuse: rate limits, abuse limits that survive deletion for 30 days, key-change notices, logs, handling reports.
- Your consent: access to your contacts and notifications, which you grant and withdraw in your device's settings.
- Legal obligations: for example passing illegal content to the authorities where the law requires it.
14. Your rights
Depending on where you live, you can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable form; you can also complain to your data protection authority (in Thailand, the Personal Data Protection Committee). Most of these you can do yourself in the app. For the rest, write to support@vili.me. Because we keep so little that identifies you, we may ask you to confirm the request from one of your devices before we act. We answer within one month.
15. Children
Vili Chat is not for children. You must be at least 16 years old to use it. If you believe a child under 16 has an account, write to support@vili.me.
16. Security
Encryption keys are created and kept on your devices, and the local database is encrypted. Every server component runs with its own credentials and its own store, public endpoints are rate-limited, every request that acts on an account must be signed by one of its devices, and server backups are encrypted. To report a vulnerability, see security.txt or write to security@vili.me.
17. Changes
When this policy changes we publish the new version here with a new effective date. We announce material changes in the app before they take effect.
18. Contact
The operator and all contact addresses are listed in section 1. In short: support@vili.me · abuse: abuse@vili.me · security: security@vili.me