Privacy policy

Who we are

rChat is developed and published by PDG Global Limited, a company in Hong Kong (“PDG”, “we”), Level 23, 99 Hennessy Road, Wanchai, Hong Kong. The rChat iOS app and the relay software are open source under AGPL-3.0-or-later.

For questions about this policy or your privacy, write to [email protected]. If you write to us, we use your message and address only to reply.

What PDG collects through the app: nothing

The app sends nothing to PDG.

• No accounts with PDG. Your identity is a set of keys made on your phone. There is no sign-up, and no phone number or email address is needed.
• No analytics, no advertising identifiers, no tracking and no crash-reporting service. The app contains no third-party analytics, advertising or crash-reporting code.
• The app connects only to the relay you join with its invite.
• Your keys are generated on your phone and never sent to PDG or to the relay. Your identity key is kept in the iOS Keychain, on this device only. Where the phone has a Secure Enclave, a separate device key is created and kept there.
• Messages, photos, files and voice messages are stored encrypted on your phone, and rChat’s databases and media are excluded from device backups.

Apple handles App Store downloads under its own privacy policy. If you choose in iOS settings to share analytics with app developers, Apple may pass us the crash reports it collects; rChat adds no crash reporting of its own.

What a relay sees

rChat delivers messages through a relay: a server that passes encrypted messages between phones. Anyone can run one. The relay you use is run by whoever gave you its invite: you, your organisation or someone you trust. That operator is responsible for their relay. PDG does not run relays for the public; the relays PDG runs are for its own staff only.

A relay holds no keys and cannot read your messages, photos, files or voice messages: they pass through it end-to-end encrypted. While it runs, it does see some connection metadata:

• the IP address you connect from, and when you connect;
• which accounts are connected (an account is known to the relay by its public key);
• which two accounts have a conversation open, held in memory while the conversation is open. Once both have been gone about 10 minutes, nothing it keeps names the pair;
• when two people first connect, or after one of them gets a new phone or changes keys, which account is trying to reach which, for up to ten minutes;
• the timing, direction and rough size of the encrypted packets it carries (every message is padded to a size bucket).

Messages for someone who is offline are held encrypted, in the relay’s memory by default, for at most 72 hours, and deleted once delivered. They are filed under the recipient; the sender’s identity is inside the encryption.

The relay keeps no lasting record of who talks to whom and writes no identifiers to its logs. Someone watching a relay while it runs can still see two accounts connect to each other at the same moment. rChat reduces what a relay learns; it does not remove it.

This describes the relay software in its default configuration. An operator can change some settings, for example keep held messages on disk (still encrypted) or add IP addresses to debug logs while diagnosing a problem. For questions about a particular relay, ask its operator.

Device permissions, and why

rChat asks for a permission only when a feature needs it. You can change each one at any time in iOS Settings.

• Camera: to scan QR codes, your contacts’ codes and relay invites. The camera is used only to read codes; no pictures are taken or kept.
• Microphone: to record the voice messages you choose to send.
• Photos, add-only: to save a photo you choose to your library. rChat asks for add-only access, so it cannot see your other photos. To send a photo, you pick it in the system photo picker, which gives rChat only the photos you pick.
• Notifications: to alert you to new messages. Alerts are made on your phone by rChat itself; there is no notification server and nothing is sent to Apple. By default an alert shows the sender’s name only. You can choose to show nothing, or the name and the start of the message; in that case iOS keeps the text in its list of notifications until you open the chat or clear the alert. Message requests always show only “New message request”.
• Background App Refresh: lets rChat check for messages from time to time while it’s closed, when iOS allows it. A check connects to your relay, collects waiting messages and disconnects; to the relay it looks like an ordinary short connection. Alerts can come minutes or hours after a message.
• Local network: only if your relay is on your local network.

Disappearing messages

You can set a timer on a conversation. When it runs out, each phone deletes the message, its photo, file or voice message, and any notification for it.

Deletion has limits:

• Each phone deletes the message the next time rChat runs on it: while it is open, at launch, or during a background check.
• The other person can take a screenshot, photograph the screen or save a copy. Copies saved to Photos or Files are not deleted.
• Copies waiting at the relay for an offline contact are encrypted and expire within 72 hours.
• Moving a phone’s clock back delays deletion on that phone.

This website

r-chat.net is a static website. It sets no cookies, runs no analytics or tracking scripts, and loads no fonts or scripts from other sites.

It is hosted on Cloudflare Pages. Like any web host, Cloudflare processes standard request data, such as IP addresses, to serve and protect the site, under Cloudflare’s privacy policy. Downloads and the install script come from assets.r-chat.net (Cloudflare R2), likewise.

Children

rChat is not intended for anyone under 18, which matches its App Store age rating.

Requests for data

PDG holds no messages, keys, contacts or accounts of rChat users, so if PDG is asked for them, there is nothing to hand over. Messages are end-to-end encrypted, and the keys stay on users’ phones.

Questions or requests about a particular relay are for its operator. PDG does not run relays for the public, so it holds nothing about you to provide.

Changes to this policy

If this policy changes, we will publish the new version on this page with a new effective date.