TL;DR — Zero Data
Fialka is a tool. The developers do not operate any infrastructure, do not store any user data, and cannot access any messages. There is no central server — all communication is peer-to-peer via Tor.
- ✓ No phone number, no email, no account registration
- ✓ No analytics, no telemetry, no tracking
- ✓ No Google services, no Firebase, no cloud APIs
- ✓ All data stored locally, encrypted, on your device only
- ✓ IP address never visible — all traffic via Tor
1. Data Controller
Fialka is an open-source project maintained by independent contributors under the organization FialkaApp on GitHub.
- No company or legal entity operates Fialka as a service
- No central server is operated by the developers — Fialka is fully peer-to-peer
- No user data is collected, processed, or stored by the developers
- Contact: github.com/FialkaApp/Fialka-Android
2. Data We Do NOT Collect
Fialka is designed to minimize data by design and by default. There is no central server, no cloud service, and no analytics.
| Data type | Collected? | Details |
|---|---|---|
| Message content | ❌ Never | End-to-end encrypted (PQXDH + Double Ratchet + AES-256-GCM) |
| Private keys | ❌ Never | Generated and stored exclusively on your device (Android Keystore) |
| Phone number / Email | ❌ Never | Not required — identity is a cryptographic key |
| Location data | ❌ Never | Not collected |
| Usage analytics | ❌ Never | No analytics SDK, no telemetry, no third-party services |
| IP addresses | ❌ Never | All traffic routed through Tor — your device is a Hidden Service |
| Metadata (who talks to whom) | ❌ Never | Peer-to-peer via Tor .onion — no central server sees traffic patterns |
3. Network Architecture — No Central Server
Fialka does not rely on any cloud service, corporate infrastructure, or central relay.
3.1. Tor Hidden Services
- Your device runs a Tor Hidden Service (.onion address derived from your Ed25519 identity)
- Messages are exchanged directly between devices — no relay, no middleman
- Your real IP address is never exposed to anyone
3.2. Fialka Mailbox (Offline Delivery)
When a recipient is offline, encrypted messages may be temporarily stored on a Mailbox node. Mailbox nodes only store encrypted blobs — they cannot read, decrypt, or identify sender/recipient. Messages are deleted after delivery or TTL expiration. The developers do not operate any Mailbox node.
3.3. Push Notifications (Optional)
Uses UnifiedPush protocol with ntfy.sh (open-source, self-hostable). Push payload contains zero message content — only a wake-up signal. Can be completely disabled in app settings.
4. Data Stored Locally on Your Device
The following data is stored exclusively on your device and never transmitted to any server:
- Cryptographic identity (Ed25519 seed → derives all keys)
- Recovery phrase (BIP-39 / 24 words)
- Message history (encrypted with SQLCipher AES-256)
- Contact list, ratchet states, app settings
Protected by: SQLCipher (AES-256), Android Keystore (StrongBox/TEE), EncryptedSharedPreferences, optional PIN + biometric app lock.
5. Third-Party Software Components
| Component | Role | Data involved | Operated by developers? |
|---|---|---|---|
| Tor | Anonymous transport | Encrypted network traffic | No — Tor Project |
| Fialka-Core (Rust) | Cryptographic library | Local computation only | No — bundled library |
| UnifiedPush / ntfy.sh | Optional push wake-up | Wake-up signal (zero content) | No — self-hostable |
No Google services, no Firebase, no cloud APIs, no corporate infrastructure.
6. EU/EEA Users — GDPR
Under GDPR (Regulation 2016/679) and French Law (Loi Informatique et Libertés n° 78-17), EU users have rights to access, rectification, erasure, portability, objection, and restriction.
In practice, since the developers collect zero personal data, operate zero infrastructure, and store nothing server-side, these rights are satisfied by architecture. To delete all your data: simply delete the app.
The CNIL (Commission Nationale de l'Informatique et des Libertés) is the competent supervisory authority in France.
7. Children's Privacy
Fialka is not intended for use by anyone under 16 (or the applicable minimum digital age of consent in your jurisdiction).
COPPA (USA): Fialka is not directed to children under 13. Since Fialka collects no personal data from any user whatsoever (P2P architecture, zero server-side storage), COPPA compliance is satisfied by design.
8. Changes to This Policy
Changes will be published on GitHub and reflected in the "Last updated" date above. Significant changes will be noted in the Changelog.
Contact: github.com/FialkaApp/Fialka-Android
© 2024–2026 FialkaApp Contributors. Licensed under GPLv3.
Fialka is a tool. The developers do not operate any infrastructure, do not store any user data, and cannot access any messages.