Privacy Policy

Last updated: September 2026. This policy explains what data the Shield app and service process and why. The data controller is the company listed at the bottom of this page.

What we store

• Account: username, password (stored only as a salted hash), optional display name, profile photo and language.
• Messages, photos and videos in chats: end-to-end encrypted on your iPhone before sending (X25519, ChaCha20-Poly1305, Ed25519 signatures). Our servers store and deliver only encrypted data and cannot read it. Encryption keys never leave your device. Messages sent before end-to-end encryption was introduced remain stored encrypted in transit only.
• Stories and profile photos: visible only to people you share a chat with (stories) and are stored on our servers without end-to-end encryption. Stories are deleted automatically after 24 hours.
• Delivery and read status: which messages were delivered and read, to show checkmarks.
• Group archive (optional): photos, documents, notes and links that group members add to a group's archive are end-to-end encrypted on their devices, including titles, tags and text recognized on images. Our servers store only encrypted data; search runs on your device.
• Groups: group names, announcements and invite links are stored on our servers so that members can see them; they are not end-to-end encrypted. When you @mention someone, the app tells our servers only who was mentioned (so they get a notification), never the message text.
• Call history: who called whom, when, whether the call was answered and how long it lasted — to show your call history. The content of calls is end-to-end encrypted and never reaches our servers. Deleting a chat removes its call history for you.
• Mood status (optional): a short status you set (for example «On vacation») is stored on our servers for 24 hours and shown to people you chat with. Reminders, contact nicknames and folded chats are stored only on your device.
• Online status: whether you are online and when you were last seen, shown only to people you chat with. You can hide it in the app settings.
• Email (optional): if you add an email, we use it only to send verification and password-reset codes and, if you allow it, to let people who already have your email in their contacts find you. Other users never see your email. Contact matching uses SHA-256 fingerprints of the email addresses in your address book; we do not store your contacts.
• Purchases: if you buy extra storage in the App Store, we store the Apple transaction identifier, the product and its expiry date to give you the storage you paid for. Payment details are handled by Apple and never reach us.
• Device tokens: push notification tokens so we can notify you about messages and calls.
• Access log: IP addresses and times of sign-ins and connections, kept for 90 days and then deleted automatically — to protect your account and to respond to valid legal requests.
• Contact names you give people (in Shield or in your iPhone Contacts) stay on your phone only — the server never receives them; your phone shows them in notifications itself.
• Devices (sessions): device model, the first half of the IP address and time of each sign-in — shown to you in «Devices» and used to warn you about sign-ins from new devices; deleted when you end the session.
• Stories are encrypted on your phone: the server stores only an unreadable photo; the caption and the key go only to the devices of people you chat with. Stories are deleted after 24 hours.
• Call history (who called whom and when) is deleted after 30 days.
• Call diagnostics: technical call data without content or IP addresses (connection path, delay, reconnections), kept for 7 days — to fix call quality problems.
• Public channels: posts in channels are visible to subscribers and are not end-to-end encrypted.

What we do not do

• We do not sell your data, show ads, or share your data with advertisers.
• Translation is performed on your iPhone by Apple's built-in translation; message text is not sent to us or to third parties for translation.
• Voice and video calls are encrypted end-to-end by WebRTC (DTLS-SRTP). Relay servers forward encrypted packets and cannot listen to calls.

Where data is stored

Servers are located in the European Union (Germany). Encrypted backups are stored for 7 days and cannot be read without our encryption key. Call relay (TURN) servers may be located in other countries to improve connectivity; they process only encrypted call traffic. Users in Russia may connect through an entry server located in Russia, which forwards the already encrypted connection to our servers in Germany without decrypting it and stores nothing.

Retention and deletion

Your data is kept while your account exists. You can delete your profile photo and stories at any time. You can delete your account at any time in the app (You → Delete account); your profile, keys, stories and channels are deleted immediately.

Legal requests

We respond to valid requests from competent authorities under EU and Spanish law. We can provide only the data listed above; the content of end-to-end encrypted chats and calls is not available to us. See information for law enforcement.

Your rights (GDPR)

You have the right to access, rectify, delete and port your data, to restrict or object to processing, and to lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es). Contact us at the address below to exercise these rights.

Children

Shield is not intended for children under 14.