ArchChat Privacy Policy

Last updated: October 13, 2026 (version 26.1)

1. Who we are

ArchChat is a messaging application developed and operated independently. We run our own server: messages, media and account data are stored there, not with third-party services (exceptions in section 5).

2. What data we collect

Account

• Username, tag, password (stored only as a hash, never in plain text), display name, profile picture, banner and status message.
• Email and, optionally, a recovery email — used only to verify the account and recover your password/username. We do not ask for a phone number.
• Account creation date and the last time you were online.

Content you send

• Text messages, photos, videos, audio, files (including a résumé, if you attach one to a job application), stickers, GIFs, polls, stories and reactions.
• Form responses, participation in raffles/cards and team records (schedules, attendance, medical leave) — only inside the groups where those tools are used.

Location

• Only when you choose to use it: when you send your location in a chat, share live location (15 minutes, 1 hour or 8 hours, your choice; you can stop earlier) or trigger SOS, which sends your location to the emergency contacts you registered.
• We do not collect background location unless you turned on one of these features.
• Marketplace listings and job posts use only the city/state you type, not GPS.

Professional profile and Marketplace (optional)

• Business name, category, description, address, hours, link, and the product listings and job posts you publish. This information is public inside the app.
• Web page (optional, off by default): if you turn it on, this same data, your picture/banner, listings and job posts appear on a public web page that search engines like Google can find. Turning it off removes the page immediately.

Other data you provide

• Pix key (optional, see section 7), SOS emergency contacts, saved quick replies, cosmetic items, plan and coins (simulated — the app does not process any payment).

Technical data

• Notification token (Firebase), delivery/read status, which groups/channels you belong to.
• IP address, used only at connection time to limit abuse (e.g. login attempts).
• App error reports (error message, app version and your user ID), so we can fix bugs.

What we do NOT collect: your phone's contact list, background location without your action, data from other apps, advertising identifiers.

3. Device permissions

Each permission is requested only when you use the related feature:

• Camera and microphone: taking photos, recording video/audio and voice/video calls.
• Photos and media: picking photos and videos from your gallery to send.
• Location: sending location, live location and SOS (see section 2).
• Notifications: alerting you about new messages and calls. Incoming calls may open full screen, like a regular phone call.
• Biometrics: unlocking the app with fingerprint/face. Biometrics are checked by Android itself — ArchChat never receives or stores your fingerprint or face.

4. How we use this data

Only to make the app work: delivering messages and calls, keeping history, authenticating login, recovering accounts, showing your profile to people you talk to, moderating reports and fixing bugs.

We do not sell, rent or share your data for advertising. There are no ads in ArchChat and no marketing tracking.

5. Third-party services

Some external services are used only for specific features:

• Firebase Cloud Messaging (Google): delivers notifications. To show a preview in the notification, the alert passes through Google with the device token, the sender's name and the message text (or media type). Google only carries this alert and does not use it for advertising.
• Giphy: GIF search. Searches go through our server; when you pick a GIF, the app downloads the image directly from Giphy.
• Email provider (Gmail/SMTP): sending verification and recovery codes.
• Google Play: installing and updating the app.

Voice/video calls go through our own call server, not third parties.

6. Where data is stored and for how long

• Messages and media stay on the server until you (or the group admin) delete them.
• Disappearing messages (when enabled) are deleted automatically after the configured time.
• Stories expire automatically (except the ones you save to highlights).
• Job posts expire on their set date; listings stay until you remove them.
• Technical server backups are kept for up to 14 days and then deleted.
• Error reports are used only to find and fix bugs.

7. Pix key

The Pix key you save is only a shortcut to send it as text in a chat. ArchChat does not process any payment — the transaction happens at your bank.

8. Security

• All communication between the app and the server uses HTTPS/WSS (encrypted).
• Messages and media are encrypted at rest on the server (AES-256-GCM). This is not end-to-end encryption: the server holds the key and can decrypt when needed, for example to review a report.
• Passwords and recovery codes are stored only as hashes.

No system is 100% secure; never share your password with anyone.

9. Reports and moderation

Reports of messages or users are stored with who reported, the reason and the reported content, for manual review.

10. Your rights

• Delete your account: directly in the app, under Settings → Delete account. Deletion is immediate. What gets deleted is described on the "Account and data deletion" page.
• Access and correct your data: name, photo, email, status and other profile data can be viewed and changed at any time in the app.
• Block and report anyone, at any time.
• Revoke permissions in Android settings whenever you want.
• For any request about your data (including under Brazil's LGPD), use the contact email shown on the app's Google Play page.

11. Children

ArchChat is not intended for children under 13. Parents and guardians remain responsible for supervising use.

12. Changes to this policy

We may update this policy as the app evolves. Relevant changes will be announced inside the app, and the date at the top of this page will be updated.