Privacy Policy
What Pollis collects, what it cannot see by design, and what happens when you leave. Last updated 3 October 2026.
Who runs Pollis
Pollis is operated by Daniel Kral, an individual developer, not a company. It is an open preview of a proof-of-concept service. For anything in this policy, contact dankral01@gmail.com.
What is collected
Pollis collects the minimum an account-based messenger needs, and uses it only to run the app, never for advertising, profiling or tracking.
| Data | Why | Visible to the operator? |
|---|---|---|
| Email address | The sole sign-in identifier. Signing in emails you a six-digit one-time code; that email is delivered by Resend, which sees the address and the code in plain text for the duration of the send. | Yes, in the clear. |
| Username and optional display name | Your account handle (directory-searchable, so people can find you) and an optional profile name. | Yes, in the clear. |
| Account and device identifiers | App-generated IDs plus a device name such as "macOS desktop", so you can see and revoke your own devices. It names the system, never your computer's hostname. | Yes, in the clear. |
| Membership and activity metadata | Which groups and DMs your account is in, blocks, and conversation activity timestamps — the routing data delivery requires. | Yes, in the clear. With sealed sender, stored message rows do not record who sent what. |
| Reports you file | If you report someone: your account, theirs, the reason you picked and, for a message, which conversation and message. Never the message itself, which we cannot read. Used only to act on abusive accounts, and deleted when either account is deleted. | Yes, in the clear (IDs and the reason only). |
| Push token | So a content-free notification can wake your phone. See the push section below. | Yes. |
| Messages, attachments, reactions | Your actual conversations. | Ciphertext only. Encrypted on your device under MLS before anything leaves it. |
| Avatars and group icons | Profile and group images. | Yes. They are not encrypted and are public to anyone with the URL. Don't put anything sensitive in an avatar. |
Your IP address is not stored or logged by any of our servers. For rate limiting it is held in memory only as a one-way keyed hash, for the length of the rate-limit window, and does not survive a server restart. The network edge (Cloudflare) sees it in transit, as any edge does, and that provider's account administrators can view client IPs in its security dashboards.
Your device PIN never leaves your device; it locks the local keystore. The local message database on your device is encrypted at rest.
What is not collected
No location, no contacts, no calendar, no photo-library scanning, no health or financial data, no browsing or search history, no advertising identifiers. There is no analytics, telemetry, crash-reporting or advertising SDK in the apps, which you can check in the source code. Nothing is sold or shared with third parties for advertising or marketing. No tracking, in Apple's sense of the word or anyone else's.
Push notifications are content-free
A push notification carries fixed text ("New message") and an opaque handle that only your app can resolve to a conversation. No message content, no sender, no preview. Pushes go through Expo's push service to Apple (APNs) or Google (FCM); those providers see the token and that your device had activity at some time, never what was said or in which conversation.
Who else touches the data
A few infrastructure providers process data on Pollis's behalf: the database host (Turso), the edge and storage host (Cloudflare), the login-email sender (Resend), the push relay (Expo, then APNs/FCM), and a leased server for realtime media. None of them can read message content. The subprocessors page lists each one, what it can see, and where it runs.
How long things are kept
Encrypted message envelopes are kept on the server until every current member device has fetched them, then deleted. There is no time limit, because dropping undelivered mail is worse than storing it. The one bound: a device that has not checked in for 12 months stops holding messages back, and resumes as soon as it checks in again. Messages you delete are removed from the server immediately. Account and directory metadata lasts for the life of the account. Call signalling is not written to any database.
Every category, its retention period, what deleting your account removes, and what the permanent transparency ledger keeps are on the retention page.
Your data, your rights
See it: everything the server holds about you in the clear (email, username, display name, devices, memberships) is visible and editable in the app's settings.
Delete it: account deletion is built into the app (Settings → Security → Delete account). It rotates the encryption keys of every conversation you were in so your old key material is useless going forward, purges your account row, devices, key packages, memberships, reactions, and pending envelopes from the server, and wipes the local database and keystore on your device. You can also request deletion by emailing dankral01@gmail.com from your account's address.
Messages already delivered to other people live in their devices' local encrypted databases, which we cannot reach.
The public transparency log is append-only. It records your account's key history and fingerprints of group-membership changes (identifiers and timestamps, never content) so that key-substitution attacks can be detected. Entries are never rewritten, including after account deletion. The trade-off is documented on the transparency page.
Children
Pollis is not directed at children under 13, and you may not create an account if you are under the minimum age required for your jurisdiction.
Changes
If this policy changes, the new version is posted at this address with an updated date, and the edit history is public in the repository.