Last updated: May 2026

This policy explains what data Ephemeral collects, why, and what happens to it. We have tried to keep it short and honest.

Who is responsible

The data controller for Ephemeral is Simone Ricci, reachable at [email protected].

What we collect

To provide the service, we store a minimum set of data:

• Your email address and a hashed version of your password, used to identify your account.
• A record of which conversations you have started (who you have exchanged messages with).
• Your public encryption key, used to encrypt messages sent to you. Your private key never leaves your device.
• When a message cannot be delivered instantly (because the recipient is offline), the encrypted message is held temporarily — for up to 48 hours — and deleted once delivered or expired.

We do not store message content in readable form. We do not track your activity, behaviour, or usage patterns.

Why we collect it

All data listed above is collected solely to provide the messaging service. The legal basis is the performance of the contract between you and us (Art. 6(1)(b) GDPR).

Who we share it with

We use two external services to operate Ephemeral:

• Fly.io — hosts the application and database. Servers are located in Frankfurt, Germany. Fly.io is a US-registered company and may be subject to US law.
• Mailjet — sends account verification and password reset emails. Mailjet is an EU-based provider and processes only your email address for this purpose.

We do not sell, share, or otherwise disclose your data to any other party.

How long we keep it

Your data is kept for as long as your account exists. Deleting your account permanently removes all data we hold about you — your profile, your conversation records, and any messages waiting to be delivered.

Standard infrastructure logs (IP addresses, connection timestamps) may be retained briefly by Fly.io as part of normal operations. These are outside our direct control.

Your rights

Under GDPR you have the right to access, correct, or delete your data, and to object to or restrict its processing. You can delete all data we hold about you directly from the app via Profile → Delete account.

For any other request, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority.

Changes

If we change this policy in a meaningful way, we will update the date at the top of this page. Continued use of the app after changes are posted constitutes acceptance.