Privacy Policy
OSChat — One-to-one encrypted chat, no sign-up (Android · iOS)
| Effective | 2026-10-27 |
| Last updated | 2026-10-30 |
The Korean version is the authoritative text. Where the two differ in interpretation, the Korean version governs. This policy covers both the Android app and the iOS app (iPhone and iPad); where they differ, each is described separately.
Summary
There is no sign-up, and the app never asks for your name, phone number, email address, or contacts. You connect with someone by scanning a QR code or opening an invite link.
Messages, files, and profile names and photos are encrypted on the sending device and can be decrypted only on the receiving device (end-to-end encryption). The relay server that carries messages between the two is run by the developer, but all it ever receives is ciphertext it cannot open — so the developer cannot read your messages either. The one exception is the developer-run demo contact “OSChat Demo”, and only if you choose to connect to it (section 6).
An AI bot that you connect yourself (optional) is different again: what you send to it goes straight to the AI service you chose, which reads it and replies. It does not pass through the developer’s server (section 7).
Delivering messages does require the server to handle some technical data: the ciphertext it holds until the recipient collects it, the identifiers of the queues that act as mailboxes, push tokens used to announce new messages, and the IP addresses that connect to it. Section 3 lists what is kept and for how long. There is no advertising, and the developer uses no analytics; the Google libraries in the Android app do send diagnostic data to Google (section 5).
1. Who operates this app
| Company | OSAN SOFT (오산전산) |
| Representative | Dongmin Song |
| Business Registration No. | 671-17-02657 |
| Privacy officer | Dongmin Song (Representative) |
| Contact | vigvadvoodoo@gmail.com |
2. What is never collected
- Accounts. There is no sign-up. On first launch the app creates an identity key on the device, and that key never leaves it
- Name, phone number, email address. The app does not ask for them. The name you enter in the app is sent, encrypted, only to the people you connect with — never to the server
- Your device’s contacts. The app does not read them. The address book inside the app holds only the people you have connected with in OSChat, and stays on the device
- Location. Never requested. When you send a photo, the app re-saves it, which removes metadata such as where it was taken
- Advertising identifiers. There is no advertising SDK
- Usage statistics, analytics. The developer receives none. However, the Google libraries included in the Android app (ML Kit and Firebase) send diagnostic and usage-analytics data to Google (see section 5). This does not apply to the iOS app
- Crash reports. The app does not send any automatically
- The contents of messages, files, and profiles. See section 3.2
3. What the relay server handles
Messages pass through a relay server run by the developer (chat.neoescape.com, located in the Republic of Korea).
The server acts only as a mailbox that holds ciphertext until the recipient collects it; it does not interpret what it receives.
3.1 What is handled and how long it is kept
| Data | Purpose | Retention |
|---|---|---|
| Encrypted messages | Held until the recipient collects them | Deleted as soon as the recipient’s app confirms receipt. Deleted after 30 days even if never collected |
| Encrypted files | Held until the recipient downloads them | Deleted as soon as the recipient has downloaded and verified the file. Deleted after 7 days even if never downloaded |
| Queue identifiers and token hashes | To address the mailbox (queue) a message goes into, and to make sure only its owner can take messages out | Deleted when you disconnect or cancel an invite. A queue nobody has collected from for 90 days is also deleted |
| Push token, platform (FCM/APNs), APNs environment (development or release) | To wake the device when a new message arrives | Until that queue is deleted. Deleted immediately if the push service reports the token is no longer valid |
| Times and sizes of messages, files, and queues | To apply the retention periods above and manage storage | Deleted together with the message, file, or queue |
| IP address (rate limiting) | To limit excessive requests | Processed in the server’s memory only and never written down. Discarded automatically once requests stop |
| IP address (access log) | Time of access, IP address, request type, and result | 90 days (section 3.3) |
| IP address (web server log) | Operational diagnostics | At most 14 days (section 3.3) |
- A separate queue is created for each contact. Queue identifiers and tokens are random values and are not linked to a name, phone number, or device details. The server stores only a hash of each token, never the token itself.
- If you do not allow notifications, no push token is registered with the server. If you withdraw the permission after a token has been registered, the registration remains until it is removed under the retention rules above; in the meantime the device simply does not show notifications.
- Every 10 minutes the server finds and deletes messages, files, and queues that have passed their retention period.
3.2 What the server cannot see
- Message contents and the files you send. They are encrypted on the sending device, and the keys that open them exist only on the two devices in the conversation.
- Profile names and photos. They reach the people you connect with only inside encrypted messages.
- Names or phone numbers of who you talk to. All the server knows is random queue identifiers.
3.3 What the server can know
End-to-end encryption hides contents, but it cannot hide everything about delivery. We state it plainly.
- The IP address and time of each request. For every request the server logs the time, IP address, request type (method and path pattern), and result. It does not log queue identifiers, tokens, file identifiers, or message contents. Taking into account the three-month retention for access records under Korean law (Protection of Communications Secrets Act), this log is kept for 90 days and then deleted. The web server in front of it (nginx) also records the time, IP address, request method, result, and response size for operational diagnostics; this record does not include the request path (the part that contains queue identifiers) either. It is rotated daily and kept for at most 14 days before deletion.
- The size and timing of ciphertext. Messages are padded to fixed-size blocks before encryption, so their size reveals little about their content, but the server can see when and how many messages travel.
- Queues that belong to the same device. A device registers the same push token on all of its queues, so the server can tell which queues belong to one device.
4. What is stored on your device
The following is stored on your device. Messages and profiles you send to a contact are encrypted whenever they leave it.
| Data | Android | iOS |
|---|---|---|
| Identity key (private key) | On-device database, full encryption (SQLCipher) | Keychain (this device only) |
| Per-conversation encryption keys, queue tokens | Same as above | Database in private storage shared only by the app and its notification extension (App Group; other apps cannot access it), iOS Data Protection |
| Messages, contacts, your name and photo, names and photos sent by contacts | Same as above | Same as above |
| Nicknames and photos you set for a contact | Same as above. Never sent to the contact | Same as above. Never sent to the contact |
| Files sent and received | App’s private storage, kept encrypted. The key is in the database above | The same private storage (App Group), iOS Data Protection |
| Push token, app settings (language etc.) | App’s private settings file | App’s private settings |
| AI bot settings (name, photo, address, model, instructions), conversations with bots and their summaries (section 7) | The database above | A separate database only the app opens, iOS Data Protection “Complete” (unreadable while the device is locked) |
| API keys for AI services (section 7) | The database above | Keychain (this device only) |
Android. The key that opens the database is encrypted with AES-256-GCM using an Android Keystore key. On devices with
a TEE or StrongBox, that key never leaves the hardware. A received file is decrypted only when you open it in another
app, into the app’s private cache, and that copy is cleared every time the app starts. Android auto backup and
device-to-device transfer are disabled (android:allowBackup="false", and the extraction rules exclude all app data).
iOS. The identity key is stored in the keychain as “this device only”: it is not synced to iCloud Keychain and is not moved to another device through a backup. The database and files are stored with the iOS Data Protection class “until first user authentication” (so that new-message notifications can be decrypted while the screen is locked), and are excluded from iCloud and computer backups.
There is no backup. Neither platform backs up conversations or keys, so if you lose the device or delete the app, your conversations and connections cannot be restored. The developer has no copy either.
Notifications. A new-message notification is created on the device after the device itself has fetched and decrypted the message. On the lock screen only the sender and a new-message notice are shown, never the content: Android shows the count (for example “3 new messages”), and iOS shows “New message” (on iOS, when the system’s Show Previews setting is at its default, “When Unlocked”).
5. Push notifications — processors and transfers abroad
When a new message arrives, the server asks the operating system’s push service to wake the recipient’s device. This request contains no message content, no sender, and no queue identifier. On receiving the signal, the device fetches the ciphertext from the server itself and decrypts it.
| Recipient | Country | What is passed on | Purpose | Retention |
|---|---|---|---|---|
| Google LLC (Firebase Cloud Messaging) | United States and other countries where Google has servers | The Android device’s push token, and a wake-up signal with no content ({"sc":"1"}) | Telling an Android device that a new message has arrived | Per Google’s policy |
| Apple Inc. (Apple Push Notification service) | United States and other countries where Apple has servers | The iPhone or iPad’s push token, and a content-free notification request that only points to a fixed phrase (“New message”) | Telling an iOS device that a new message has arrived | Per Apple’s policy |
- When and how. Each time a new message reaches the server, over an encrypted connection (HTTPS).
- How to refuse. If you do not allow notifications, no push token is registered with the server, so nothing is transferred. New messages then arrive when you open the app.
- Each company’s handling is governed by its own policy — Google: https://policies.google.com/privacy , Apple: https://www.apple.com/legal/privacy/
Google libraries in the Android app
The Android app uses the Firebase Cloud Messaging library to receive push notifications and the Google ML Kit barcode scanning library to read invite QR codes. QR recognition happens on the device, and camera images do not leave it. These libraries do, however, send the following directly from the app to Google. It does not pass through the developer’s server, and the developer does not receive it.
| Library | Sent to Google | Purpose |
|---|---|---|
| Google ML Kit (QR scanning) | Device information (manufacturer, model, OS version etc.), app information (package name, app version), a per-installation identifier, performance metrics | Google’s diagnostics and usage analytics |
| Firebase Cloud Messaging | FCM token, Firebase installation ID | Delivering push messages |
ML Kit’s transmission is handled by Firebase’s transport module (datatransport). Details are governed by Google’s official disclosure (https://developers.google.com/ml-kit/android-data-disclosure) and Google’s privacy policy. Firebase Analytics is not included, and collection is switched off in case another library pulls it in.
None of this applies to the iOS app. It contains no third-party libraries, and it reads QR codes with Apple’s VisionKit (on-device recognition).
Beyond the above, the developer does not sell or share your information with third parties.
6. Invite links and QR codes
An invite QR code or link contains what another person needs to connect to you (server address, queue identifier, sending token, public keys). It does not contain your name or phone number.
- An invite can be used once. If it is not used within 7 days, the app discards it and deletes its queue on the server.
- If you send the link through another messenger or by email, that service’s operator can see the link. For this reason we recommend scanning the QR code in person and comparing the safety number on both screens after connecting.
The demo contact “OSChat Demo”
So that the app can be tried out, the developer runs a chat contact of its own (since 2026-10-27). Get an invite at
https://chat.neoescape.com/demo, connect, and “OSChat Demo” replies. This contact is not like a conversation
between ordinary users.
- Messages you send to the demo contact are received and read by a program (bot) run by the developer. In end-to-end encryption the bot is the recipient, so the bot decrypts the messages on the developer’s server. It uses what it receives only to reply, echoing your text back.
- The bot keeps no content. Photos and files it receives are verified and deleted at once, and the copy on the server is deleted too. Its message history is erased after about 1 hour. The bot’s log records only events such as connecting and disconnecting — never message contents, file names, or IP addresses.
- If you disconnect, or nothing is exchanged for 30 days, the state of that conversation is deleted.
- The
/demopage uses IP addresses in memory only, to count invites per IP address (10 per hour), and discards entries older than an hour at the next request. They are not recorded. - If you do not want this, do not connect. The demo contact becomes a contact only when you take an invite and connect yourself; the app never connects to it automatically. Please do not send anything personal.
7. Connecting an AI bot (optional)
If you want, you can connect an AI service you use (for example Anthropic Claude, OpenAI ChatGPT, Google Gemini, or an AI server you run yourself) as if it were a contact (from version 1.1.0). It works only after you enter the address and key yourself; if you never connect one, none of the transfers below happen.
- Chats with an AI bot are not end-to-end encrypted chats. The app sends what you write to the bot directly (over HTTPS) to the AI service address you entered, and that service reads it and produces the reply. The app says so on the screen where you connect a bot.
- Nothing passes through the developer’s server. The developer never receives your bot conversations, the address you entered, or your API key. There is no processing or sharing arrangement between the developer and the AI service; you send the data yourself to the service you chose.
- What is sent. Your instructions (if any), a summary of earlier conversation, the recent messages, the model name, and your API key for authentication (in a request header). When a conversation gets long, older parts are sent to the same AI service to be summarized so the context carries on. Loading the list of available models also sends your API key to that service.
- How that service handles it. How long the service keeps conversations and whether it uses them for training are governed by that AI service’s own policy. Check it before connecting, and take care with personal information.
- On your device. Bot settings, conversations and summaries, the photo you set for a bot, and API keys are stored only on the device (section 4) and excluded from backups. The name and photo you give a bot are never sent anywhere.
- Deleting. Deleting a bot in the app deletes its conversation and API key from the device. Records held by the AI service must be deleted with that service. “Reset context” keeps the history on screen but stops sending earlier messages from the next request on.
8. Permissions
Android
| Permission | Purpose | Required |
|---|---|---|
INTERNET | Communicating with the relay server | Yes |
CAMERA | Scanning invite QR codes | Optional. Without it you can still connect with an invite link |
POST_NOTIFICATIONS | Showing new-message notifications (Android 13+) | Optional. If denied, no push token is registered |
ACCESS_NETWORK_STATE | Detecting when the internet connection is lost to show a notice, and catching up as soon as it is back (also used by the Firebase library) | Automatic |
WAKE_LOCK, com.google.android.c2dm.permission.RECEIVE | Receiving push messages (added by the Firebase library) | Automatic |
com.neoescape.securechat.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION | Internal to the app only: stops other apps from calling the app’s own receivers (added by AndroidX) | Automatic |
Photos are chosen with the system photo picker and other files with the system file picker; the app accesses only the item you pick at that moment. Storage, photo library, contacts, and location permissions are never requested.
iOS
| Permission | Purpose | Required |
|---|---|---|
| Camera | Scanning invite QR codes | Optional. Without it you can still connect with an invite link |
| Notifications | Showing new-message notifications | Optional. If denied, no push token is registered |
| Local network | Reaching an AI bot whose address is on your home or office network (section 7) | Optional. iOS asks only when you connect an AI on your local network |
Photos are chosen with the system photo picker and files with the system file picker; the app accesses only the item you pick. Photo library, contacts, and location permissions are never requested.
9. Retention and deletion
Server. Once the periods in section 3.1 pass, the server deletes the data automatically, by removing the database rows and deleting the files. The developer could never decrypt the ciphertext in the first place, so there is nothing to recover.
Disconnecting. When you disconnect from a contact, the app tells the contact you have disconnected, deletes your queue on the server (including any uncollected messages in it), and deletes that conversation’s encryption keys from the device. You choose whether to delete the conversation history as well.
Uninstalling. Everything stored on the device is deleted with the app. Queues left on the server have no device collecting from them anymore, so they are deleted after 90 days; messages that arrive in the meantime are deleted after 30 days and files after 7 days.
Keychain on iOS. iOS may not remove an app’s keychain items immediately when the app is deleted. These items can be read only on this device, and if you reinstall the app, it erases the leftover identity key on first launch and starts fresh.
10. Your rights
You have the right to access, correct, delete, or restrict the processing of your personal information. Because the service has no accounts and nothing on the server is linked to a name or phone number, the developer has no way to find a particular user’s data. So the app lets you act directly:
- Disconnect from a contact to delete your queue and any uncollected messages on the server immediately.
- Deny notification permission and no new push token registration takes place.
- Delete conversations or contacts in the app, or uninstall the app, to delete what is stored on the device.
For any other request or question, write to the address in section 15.
11. Security measures
- End-to-end encryption. X25519 key agreement and the Double Ratchet give every message a new key; messages and files are encrypted with ChaCha20-Poly1305.
- Encryption in transit. The app talks to the server over HTTPS only.
- Token hashes. The server stores SHA-256 hashes of queue and file tokens instead of the tokens themselves.
- Restricted access. The server’s data and access log can be read and written only by the server program’s own account.
- On-device protection. Data on the device is encrypted or protected by the operating system’s data protection as described in section 4, and excluded from backups.
12. Children
This app is not directed at children under 14. With no sign-up, it does not ask for age and collects no information that would reveal whether a user is a child.
13. Changes
If this policy changes, the “last updated” date above changes with it, and any substantive change is noted in the app’s update description.
14. Remedies
For reports or advice about a privacy violation, you can contact the following Korean authorities.
- Personal Information Infringement Report Center (KISA) — privacy.kisa.or.kr / 118 (in Korea)
- Personal Information Dispute Mediation Committee — www.kopico.go.kr / 1833-6972
- Supreme Prosecutors’ Office, Cyber Investigation — www.spo.go.kr / 1301 (in Korea)
- Korean National Police Agency, Cyber Bureau — ecrm.police.go.kr / 182 (in Korea)
15. Contact
vigvadvoodoo@gmail.com — OSAN SOFT, privacy officer Dongmin Song