Privacy Policy

Effective date: October 7, 2026

↑ 中文版

1. What CamoChat is

CamoChat is an end-to-end encrypted private messaging tool. A message you write in CamoChat is encrypted into a block of ciphertext, which you send into any chat app yourself via the system share sheet or copy and paste; only the person you have paired with can turn it back into readable text. CamoChat also comes with a "Decrypt with CamoChat" action extension, so you can select ciphertext in other apps and decrypt it right there. CamoChat itself does not carry text messages — it sets up no communication channel of any kind for text. Voice, photos and videos are the only exception: their ciphertext is relayed through our storage (see Section 5). This policy explains how CamoChat handles data related to you.

2. What data we handle

• Device keys and identity: long-term keys are generated locally on your device the first time you open the app. When you pair, your public key material is handed directly to the other person in-band (through the invite code / QR code you share), without passing through any server. Your private keys always stay in your device's secure storage (Keychain / Keystore), and we cannot read them.
• Encrypted text messages: the text you write is end-to-end encrypted on your device and encoded as a block of ciphertext text, which you send yourself through the chat app you use — it is not uploaded to any server or cloud storage. We neither hold the decryption keys nor ever handle this ciphertext, so we cannot read any of it.
• Encrypted voice, photos and videos: a voice message, photo or video you send is first encrypted on your device with a randomly generated key that is different for every file, and then the ciphertext is uploaded to our storage relay (see Section 5). That key is placed only inside the end-to-end encrypted text message, which you send to the other person through your chat app; it is never sent to our servers. So we only ever handle ciphertext and cannot read its contents.
• Pairing metadata: the invite code, pairing nonces, public handshake material and similar data are used to set up a secure session between two devices, and are passed in-band between you and the other person the whole way, without any server. None of this contains message plaintext or reveals your identity.
• Text you actively share or select: CamoChat reads only text you send into it through the system share menu, or ciphertext you actively select and hand to the "Decrypt with CamoChat" action extension; it never reads any other text field or app content. This content is processed only locally on your device, and is never uploaded or retained.

3. What we do not collect or read

• We do not read the identity of the host app you are using, your screen, or who you are talking to.
• We do not upload or request your system contacts — you add contacts yourself by pairing.
• We do not collect location, do not use advertising identifiers, and do not track you across apps.
• We do not ask for a phone number, an email address or any account sign-up.

4. Permissions

• Camera: used to scan the other person's QR code when pairing face to face, and to take photos or videos you choose to send. The scanning viewfinder is not saved or uploaded; photos or videos you choose to send are relayed only as ciphertext through our storage (see Section 5).
• Microphone: used only while you press and hold "Hold to talk" to record a voice message. The recording is encrypted on your device before it is uploaded; the server receives only ciphertext.
• Network: used for three things only — uploading and downloading encrypted voice, photos and videos; reading a public, signed configuration file; and downloading the installer (Android direct-download version only). Text messages and pairing do not use the network.

5. Data storage and retention

Text messages pass through no server and use no cloud storage — the text ciphertext stays in the chat app you used, inside the messages you sent, and we hold no copy of it. Your keys, contacts and conversation history are stored only on your own device, and you manage and delete them yourself.

The storage relay for voice, photos and videos is the only server CamoChat uses, and it runs on Amazon Web Services (AWS). All it receives and retains is:

• The encrypted file (ciphertext), plus its size in bytes and its type (voice / photo / video — just a category number that says nothing about the content);
• The upload time;
• As with any website or CDN, the IP address making the request passes through AWS CloudFront and AWS WAF; your IP is used only temporarily, when WAF limits upload frequency per IP to prevent abuse, and is never written to disk.

What it never receives: any decryption key, the file plaintext, an account (CamoChat has no accounts), your address book or contacts, or who you are chatting with. The relay keeps no access logs — CloudFront access logging and WAF logging are both switched off, and the signing function has no permission to write logs; your IP is used only temporarily for WAF's per-IP rate limiting and is never written to disk.

How long it is kept: after 24 hours the app shows the item to you as "expired"; the cloud storage deletes it automatically under a lifecycle rule (1 day), and because the storage service runs these deletions in daily batches, actual deletion happens within about 1–2 days. We do not offer extended storage — CamoChat is not a cloud drive.

Public source code: the full source code of the relay server is public on this site's source page, so anyone can check exactly what it does.

Configuration file and installer: both the iOS and Android versions read a public, signed configuration file, fetched from this site's addresses, with a GitHub-hosted address (GitHub Pages) as a fallback. Only the Android direct-download version downloads an installer, and only after you agree to an update; it is downloaded from this site's addresses or from the releases page on GitHub (GitHub Releases). These requests carry no account, device identifier or other personal information. Our own servers keep no access logs (see above); the GitHub-hosted addresses are operated by GitHub and are subject to GitHub's own privacy policy. Text messages still never go over the network.

6. Data sharing

We do not sell your data or use it for advertising. Text messages pass through no server, so neither we nor any third party ever come into contact with them. The ciphertext of voice, photos and videos goes through the storage relay provided by AWS (see Section 5); AWS only hosts this ciphertext as infrastructure and likewise has no access to the decryption keys. If required by law, the most we can hand over is ciphertext that has not yet expired and been deleted, along with the size, type and upload time listed above — without the keys, this ciphertext cannot be turned back into content. We never hold text messages, so we have none to provide.

7. Your rights

You can delete a paired contact, rotate your device keys or uninstall the app at any time to stop the related data from being processed. Uninstalling removes the private keys and conversation history stored locally on your device.

8. Children's privacy

CamoChat is not directed at children under 13 and does not knowingly collect their personal information.

9. Changes to this policy

If this policy is updated, we will change the effective date at the top of this page. Significant changes will be announced in the app or on our website.

10. Contact us

If you have any questions about this privacy policy, please open an issue on GitHub.