Privacy Policy
1. Introduction
QCloak is a messaging application with quantum-resistant, post-quantum end-to-end encryption. This policy describes what data we process, for what purposes, and for how long, in accordance with Regulation (EU) 2016/679 (GDPR).
The core principle: the content of your communications is encrypted on your device and can only be read by the recipient. The service provider is not technically able to read it.
2. Data we process
2.1 Data provided during registration
| Data | Purpose | Legal basis |
|---|---|---|
| Phone number | Account identification, sending the OTP code | Performance of a contract (Art. 6.1.b GDPR) |
| Registration code (redeem code) | Authorization to access the organization's domain | Performance of a contract |
| Nickname | Identification between users | Performance of a contract |
| Profile picture (optional) | Personalization | Consent (Art. 6.1.a GDPR) |
For sign-ins via Microsoft Entra ID, we receive the email address and display name from the identity provider.
2.2 Technical data generated by use
| Data | Purpose | Retention |
|---|---|---|
| Cryptographic public keys | Allow other users to encrypt messages to you | Until account deletion |
| Push notification token (FCM) | Notification delivery | Until logout or account deletion |
| Online status and last seen | Presence functionality | Latest value, overwritten |
| Organization domain | Segregation between organizations | Until account deletion |
| Encrypted messages and attachments | Delivery | See §4 |
2.3 Data we do NOT process
- We do not read message content. Text, images, videos, audio, and documents are end-to-end encrypted. The server only stores encrypted text, which cannot be decrypted without the private key held on the recipient's device.
- We do not store private keys. They are generated exclusively on the device and are never transmitted.
- We do not collect analytics, profiling, or advertising data. The app does not integrate any advertising tracking SDK.
- We do not sell or share data with third parties for marketing purposes.
3. Encryption
Message content is protected with AES-256-GCM. The encryption key for each message is in turn protected by the key-exchange scheme configured by the organization, which may include post-quantum algorithms (ML-KEM-768, FIPS 203 standard) combined with classical algorithms (RSA-3072 or ECDH P-521).
Private keys are stored:
- on Android, in the Android Keystore (with hardware backing where available);
- on iOS, in the Keychain (with Secure Enclave on supported devices);
- on browsers, encrypted with a local key in
localStorage.
The local message archive is encrypted with SQLCipher on mobile devices.
4. Message retention
Encrypted messages pass through our servers only for as long as needed for delivery.
- If the organization has enabled the "delete after read" option, the message is removed from the server as soon as the recipient receives it (for groups, once all members have received it). Attached files are also deleted.
- Otherwise, the message remains on the server marked as delivered, until the account is deleted or the user removes it.
The local copy on your device remains until you delete it or uninstall the application.
5. Recipients and transfers
Data is processed through the following providers (data processors under Art. 28 GDPR):
| Provider | Service | Location |
|---|---|---|
| Back4App | Application hosting and database | USA |
| Google (Firebase Cloud Messaging) | Push notifications | EU / USA |
| SMSTools | Sending OTP codes via SMS | EU |
| Microsoft (Entra ID) | Enterprise authentication, where enabled | EU / USA |
Push notifications contain only the sender's name and a generic indication ("new message"): the content is never included in the payload.
For transfers outside the EU, the Standard Contractual Clauses approved by the European Commission apply.
In on-premise deployments, all components can be hosted on the organization's own infrastructure, without third-party providers.
6. Reports and moderation
If you report a user or a message, we record: your identity as the reporter, the reported user, the reason and — if you report a specific message — the metadata and encrypted text of that message. Because the content is encrypted, the moderator cannot read it unless you provide a decrypted copy. Legal basis: legitimate interest in the security of the service (Art. 6.1.f GDPR).
7. Multiple devices
Your account can be linked to multiple devices at the same time. Each device generates and holds its own independent cryptographic key pair: if one device is compromised or removed, the keys of the other devices linked to the same account are not affected.
8. Your rights
You can exercise, at any time, the rights provided for in Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, and objection. Write to info@quantum2pi.com.
Account deletion: you can delete your account yourself from the app, under Profile → Permanently delete my account. This removes the profile, sent and received messages, attachments, and keys. This action is irreversible.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
9. Minors
The service is not intended for individuals under 18 years of age.
10. Changes
Any updates will be published in this section along with the relevant date. Material changes will be communicated within the application.