Privacy Policy

Pénombre is designed to collect as little as possible, rather than to collect and then protect. There's no account, no phone number, no email, no password. This document describes precisely what exists anyway, and why.

On install, the app generates a cryptographic key pair directly on your device. This key pair — your identity within Pénombre — is never transmitted to any server. Only your public key, which you choose to share with the people you add as contacts, ever leaves your device.

Your 32-word recovery phrase is never stored anywhere by Pénombre. If you lose it, your identity cannot be restored by anyone, including us.

Every message, photo, and call is end-to-end encrypted on your device before it's sent. The relay server that routes your messages to their recipient only ever sees encrypted envelopes and the metadata strictly needed for delivery (the recipient's public key and a timestamp). It cannot read the content of your conversations.

If a recipient is offline, their encrypted message is queued on the relay for at most 24 hours, then deleted — delivered or not.

Messages stored on your device are encrypted at rest.

Pénombre uses Expo's push notification service to alert you of an incoming message when the app is closed. These notifications never contain your message content — only a signal that an encrypted message is waiting.

If you configure a business profile in AI mode, messages received from customers assigned to that profile are sent to a server function we operate, which forwards them to a third-party AI provider to generate a reply. This feature is off by default and only applies to conversations where you've explicitly enabled it. Content sent to the AI provider is not retained by Pénombre beyond the time needed to generate the reply.

If you import a WhatsApp or Telegram export, the file is parsed entirely on your device. Nothing is uploaded to a server during this process.

We don't sell any data. We don't run advertising trackers or third-party analytics inside the app. We don't maintain a central directory of accounts or numbers, since there is neither an account nor a number.

If this policy changes in a meaningful way, the update date above will change accordingly. We encourage you to check back periodically.

For any question about this policy, write to us at the address listed on our support page.