Terms & Conditions

📄 TalkWe Privacy Policy

Thank you for using TalkWe (“we,” “our,” “us”).
This Privacy Policy explains how we collect, store, protect, and handle your information when you use TalkWe.

TalkWe is a secure messaging platform designed to let users communicate using end-to-end encryption (E2EE). To support infrastructure and development costs, the app may display advertisements.

Aim

Our goal is to provide a secure communication platform while collecting as little personal data as possible. Privacy in TalkWe is built by design, not by assumption. We do not read, store, or sell user conversations. We collect only what is necessary to operate the service and keep it reliable and sustainable.

1. Purpose

TalkWe is designed for secure personal communication and ongoing development and learning. Limited commercial activity (such as advertising) may occur to support hosting and infrastructure costs.

The main purpose of TalkWe is to:

Provide secure 1-on-1 and group messaging
Offer encrypted media sharing
Allow customizable public profiles and group images
Prioritise user privacy and data minimisation

About the Project & Future Features

TalkWe is an independent experimental project built and maintained by a single developer. It was created to fulfill a personal need for a messaging app that prioritises privacy, simplicity, and data minimisation, without sharing user data.

While TalkWe is not open-source, development is user-driven. From time to time, users may be invited to share feedback or suggest features they would like to see in future updates. This helps guide the direction of the app while keeping privacy as the core principle.

TalkWe is continuously evolving. Features may change, improve, or be refined over time as the app grows and real-world usage helps shape better decisions.

If you’d like to know more about the project, share ideas, or discuss potential features, you’re welcome to reach out directly to the creator:
📧 bhavykhanna.work@gmail.com

2. Data We Collect

We collect only the minimum information required for the app to function:

Email address for login and recovery
Display name
Date of birth (DOB) for age verification
Automatically generated UUID (internal user identifier)
Profile image (unencrypted and publicly visible, if provided)
Status message (public, if provided)

We do NOT collect:

Contact lists
Precise location data
Readable message content
Browsing history
Tracking IP addresses
Hardware identifiers beyond Firebase default requirements

3. Public vs. Private Data

Public Data (Not Encrypted)

Visible to other users:

Profile image
Group profile image
Display name / username
Status message
Group name and description

Important: Profile and group images are stored unencrypted to allow public visibility. Do not upload sensitive personal images.

Private Data (End-to-End Encrypted)

Protected using E2EE:

One-on-one messages
Group messages
Shared chat images
Session and group encryption keys
Your identity keys

Only chat participants can decrypt this data.

4. User Consent

By sending messages or media through TalkWe, you consent to:

End-to-end encrypted processing of that content
Secure delivery to intended recipients

If you do not agree, please avoid using messaging features.

5. Encryption and Message Security

TalkWe uses end-to-end encryption (E2EE) built on the open Signal Protocol (the same protocol family used by Signal and WhatsApp), so that only intended recipients can read messages. TalkWe does not have access to readable messages, media, encryption keys, or backups.

User Encryption Keys

Each device holds a long-term identity key pair (a public key and a private key), generated on the device.
Private keys are securely stored in the Android Keystore.
Private keys never leave the device, TalkWe cannot access or export them.
Each user also publishes short-lived public “pre-keys” that let others start an encrypted session; these contain no private information.

Backup PassKey (Account & Identity Recovery)

Users may optionally create a Backup PassKey (a zero-knowledge recovery code held only by the user) to assist with recovering their identity when switching devices.
The PassKey is not stored by TalkWe in readable form and is not tied to your login, so we cannot use it to access your account or data.
The PassKey exists only for recovery purposes and does not bypass encryption or security rules.
The PassKey may be retained while the account remains active and can be replaced with a new PassKey by the user.
The PassKey cannot restore chats by itself; it unlocks your identity so an encrypted backup can be restored.
Users are responsible for safeguarding their PassKey.
TalkWe cannot access the PassKey, and it cannot be used to log into the account directly.

1-on-1 Chats

Sessions are established using X3DH key agreement with added post-quantum protection (PQXDH, using CRYSTALS-Kyber / Kyber-1024) to guard against future quantum attacks.
Messages are then protected by the Double Ratchet, which provides forward secrecy: every message uses a fresh key, so past messages stay safe even if a later key is exposed.
Messages are encrypted and authenticated on the device before transmission.

Group Chats

Group messages are end-to-end encrypted using Sender Keys: each member encrypts once for the group, and only group members can decrypt.
When a member leaves, the group re-keys so the removed member can no longer read new messages.

Media Encryption

Each shared image or file is encrypted with its own random key, delivered only through the encrypted channel.
Only people in the chat can open shared media.

Server Role

TalkWe servers act only as a secure relay
Messages are temporarily held only for delivery
Messages are deleted once delivered to all participants
Undelivered messages are force-deleted after 5 days if a user remains inactive

This prevents long-term storage and avoids delivering outdated messages.

Backup Encryption

Backups contain your already-encrypted chats
Backups are additionally encrypted with a strong key sealed to your own identity, so they can only be restored by you
Backup files remain unreadable without your keys

Even if accessed externally, backups cannot be read.

🔒 Encryption Disclaimer

While TalkWe uses end-to-end encryption and industry-standard cryptographic practices, no system can be guaranteed to be completely secure. TalkWe is not liable for any loss, exposure, or compromise of data, whether encrypted or unencrypted, resulting from factors beyond our reasonable control, including but not limited to:

Device compromise, malware, or unauthorized access
Loss or theft of a user’s device
Weak device security or operating system vulnerabilities
User actions, misconfiguration, or failure to maintain backups
Third-party infrastructure or service failures

End-to-end encryption ensures TalkWe cannot read user data, however users remain responsible for securing their devices, Passkeys, and backup files.

6. Local Chat Storage

Once delivered, a message is decrypted a single time and stored in an encrypted local database on your device (SQLCipher, 256-bit), with the database key protected by the Android Keystore.
Servers are used only to relay encrypted messages.

7. Local Backup & Restore

Encrypted Local Backups

Users can manually create encrypted backups in the app.
Backups are encrypted ZIP files; users choose the storage location.
Backups are not automatic.
Backup files are fully encrypted and cannot be read by anyone without the private key.

Media Backup (Optional)

Media can be included in backups, increasing size.
Excluding media means it will not be restored.

Restoring on a New Device

Users must manually transfer the backup file.
During setup, the app prompts the user to select the backup.
If the user has a Backup PassKey, it can unlock the private key to decrypt the backup.
Without the private key, backup files remain unreadable, even if someone has the file.

8. Device Switching & App Uninstallation

Switching to a New Device

1. Create a local backup (media optional).

2. Optionally generate a Backup PassKey to retain access to your private key.

3. Log in on the new device, provide the PassKey (if created), and restore the backup file.

Chats and data are restored only if both the backup file and private key are available. The PassKey alone cannot restore chats.

Uninstalling the App Without Backup

All local chats are permanently lost.
Encryption keys stored on the device are removed.
Backup files cannot be read without the private key.
Even if a Backup PassKey exists, chats cannot be restored without the backup file.

9. Account Deletion & Data Retention

Users may permanently delete their account at any time through in-app settings or via support if access is lost.

After deletion:

Profile and authentication data are removed
Local data remains on the user’s device unless deleted by the user
User-associated moderation records are deleted
A UUID and public encryption keys may be retained solely to preserve chat integrity for other users

Abuse Prevention & Security Retention

To protect the platform from spam, abuse, and ban evasion, TalkWe may retain limited anonymized security data, such as:

A non-reversible hashed device-related security identifier

This data:

Is not a raw device identifier
Cannot identify an individual user
Is not linked to any account, messages, or personal data
Cannot be used for tracking, advertising, or analytics
Exists solely for security and abuse-prevention purposes

To protect users and the platform, TalkWe may restrict, suspend, or permanently ban accounts involved in abuse, harassment, spam, or repeated policy violations.

Deleted accounts cannot be recovered.

10. Advertising

TalkWe may display ads from trusted third-party providers (e.g., Google AdMob).
User data is not sold
Encrypted content is never shared
Ad providers may collect limited anonymous data under their own policies

11. No AI Training

User data is not used to train AI models
Messages and media are never analyzed
No data is shared with AI systems

12A. Reporting & Moderation

Reporting Abuse

Users may report chats or users for abuse, harassment, spam, or policy violations.
When a report is submitted, the last five (5) messages, including media, are sent to TalkWe in readable form for manual review.
Only reported messages are shared; no additional chat history is accessed.
Reported content is used solely for moderation purposes.

By submitting a report, users consent to this limited disclosure.

Moderation Actions

If a violation is confirmed, TalkWe may:

Issue warnings
Restrict features
Suspend accounts
Permanently ban users in severe or repeated cases

12B. Blocking Users (Upcoming Feature)

TalkWe plans to introduce a blocking feature in a future update.
Users will be able to block others from contacting or interacting with them.
Blocking is user-controlled and does not notify the blocked user.
Blocking does not automatically report the blocked user.

13. Children’s Privacy

TalkWe is not intended for children under 13.
Accounts identified as underage will be deleted.

14. Limitation of Liability

TalkWe is provided “as-is” and “as available.” While we take reasonable technical and organizational measures to protect user data using end-to-end encryption, TalkWe does not guarantee absolute security.

We are not responsible for data loss, exposure, or compromise caused by:

Device loss, theft, or compromise
Malware or unauthorized access
Loss of encryption keys, Passkeys, or backup files
User inactivity or failure to create backups
App uninstallation without backup
Operating system or third-party service vulnerabilities
Network interruptions or service downtime

Responsibility for securing devices, credentials, and backups rests with the user.

15. Changes to This Policy

We may update this Privacy Policy periodically.
Significant changes will be communicated within the app.

16. Contact

📧 support@talkwe.in
📱 In-app support (when available)

Account Deletion

You can request account and data deletion from the official deletion page:

TalkWe Account & Data Deletion

← Back to home