Privacy Policy

Last Updated: July 4, 2026

Our Philosophy

Chatit is built on the principle of "private-by-design". We are a "zero-knowledge" platform, meaning we are architected to have no access to your message content. Privacy isn't an option; it's the foundation upon which this application is built.

Our messaging application uses state-of-the-art end-to-end encryption (E2EE). Your messages are encrypted on your device and can only be decrypted by your intended recipient. Neither we, nor anyone else, can read these messages.

This same end-to-end encryption (E2EE) principle applies to our Audio and Video Calls. The call's media stream is encrypted directly between you and the person you're calling. Your private conversations remain private, always.

Data Controller

The controller of the data processed through the Chatit application and website is INNOVATEX DESIGN SRL, registered in Romania, Cluj, Dej, Strada 1 Mai no. 41, Company ID (CUI) 48509212. You can contact us anytime at contact@chatit.ro for any privacy matter.

What Information We Collect (And Why)

We collect the absolute minimum information required for the app to function. We never ask for your real name, email address, or phone number.

1. Information Stored on Our Servers

  • Account Data: When you create an identity, we store your `userId` (a random identifier) and your `publicKey` (your public signing key) on our server. We need your public key to verify the authenticity of messages you send (to prevent spam or identity spoofing).
  • Nickname (Optional): If you choose to set a public "nickname", it will be stored on our server and visible to other users you contact.
  • Push Notification Tokens: To notify you when you receive a new message and the app is closed, we store a `pushToken` provided by Google (Firebase Cloud Messaging) or Apple (APN). This token is anonymous and is not linked to your personal identity, only to your app installation on your device.
  • Pending Messages: If you send a message to a user who is offline, our server will temporarily store that message in its encrypted form. The message is deleted from the server immediately after the user comes online and the message is delivered. We can never read these messages.
  • Call Signaling: Our server relays temporary, encrypted connection signals between users to help establish an end-to-end encrypted call. We do not log or store any information about these signals.

2. Information Stored Only on Your Device

The following data is generated and stored exclusively on your device. We have no access to it, and deleting the app will permanently remove it (unless you have a manual backup).

  • Mnemonic Phrase and Private Keys: Your complete identity (your 12-word mnemonic phrase, your private signing key, and your private encryption key) is stored in `SecureStore` (an encrypted area of your phone). This data never leaves your device.
  • Application PIN Code: If you set a PIN, it is stored locally in `SecureStore` to lock access to the app.
  • Contact List and Messages: The contacts you add and your entire conversation history are stored locally on your device in an encrypted format. Messages are only decrypted live (in-memory) when you open a conversation. This provides an extra layer of security, protecting your data even if your device's storage is physically accessed.

How We Use Information

We use the collected information (public keys, push tokens) strictly to:

  • Authenticate users and verify message integrity.
  • Route encrypted messages between users.
  • Relay connection signals to establish end-to-end encrypted audio and video calls.
  • Send push notifications when you are offline.
  • Allow the contact list functionality (sharing of nicknames and public keys).

Information Sharing

We do not sell, rent, or share your information with third parties for marketing purposes. The only third parties we interact with are essential service providers for push notifications:

  • Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): We send them your `pushToken` and a generic notification (e.g., "New Message") to deliver the alert to your device.

International Data Transfers

To deliver push notifications we use Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), which may process your `pushToken` on servers located outside the European Economic Area, including in the United States. These transfers rely on the European Commission's Standard Contractual Clauses and these providers' own compliance frameworks. We only send them an anonymous token and a generic notification — never your message content, which is end-to-end encrypted.

Data Deletion

You have full control over your data. You can delete all data associated with your account at any time from within the app by navigating to Settings {'>'} App Data {'>'} Delete All Data. This action will delete your `userId`, `publicKey`, `nickname`, and `pushToken` from our server, and will delete all local data (including your identity and messages) from your device. This action is irreversible.

Minimum Age

Chatit is intended for people who are at least 16 years old. We do not knowingly collect data from anyone under 16. If we learn that we have processed data of someone below this age without the consent of the holder of parental responsibility, we will delete it.

Your Rights (GDPR)

As a data subject under Regulation (EU) 2016/679 (GDPR), you have the following rights:

  • Access: to know what data we hold about you.
  • Rectification: to correct inaccurate data (for example, your nickname).
  • Erasure: to delete your data (the 'right to be forgotten'), directly in the app, at Settings → App Data → Delete All Data.
  • Restriction and objection: to limit or object to certain processing.
  • Portability: to receive your data in a structured, commonly used format.

You can exercise these rights by contacting us at contact@chatit.ro. You also have the right to lodge a complaint with the Romanian supervisory authority — the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

Cookies (For the Website)

Our website, `chatit.ro`, uses strictly necessary cookies for basic functionality and our own privacy-respecting, first-party analytics (synux.ro) — with no tracking cookies, no personal data, and nothing shared with third parties. We do not use advertising cookies.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page. You are advised to review this page periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, you can contact us at: contact@chatit.ro