Privacy Policy
This policy describes how the app actually behaves. When the behaviour changes, this document changes.
1. Principle
LL3 carries conversation content end-to-end encrypted. Content keys are created and kept on your devices. LL3 servers have no technical means to read messages, attachments, or the audio and video of calls, and nobody on the operator side, administrators included, has such access. We do not sell any data and do not share it for advertising.
2. What the server processes
| Data | Purpose | Retention |
|---|---|---|
| Account identifier (derived from your public key) and device identifiers | Device registration, delivery, revocation | Until account deletion; the device entry remains in the key log as “revoked” (see §6) |
| Public keys and prekeys of devices | Letting other users start conversations with you | Until device revocation or account deletion (prekeys are then deleted) |
| Encrypted message envelopes and encrypted attachments in delivery queues | Delivery to the recipient | Until acknowledged, at most until the envelope expires; on account deletion the queues are deleted |
| Phone number alias (if you add one): a keyed hash of the number plus the number in a form readable only by you | Discoverability by people who know your number | Until you unlink the number or delete the account (the row is then deleted) |
| Notification addresses (APNs tokens) bound to queues | Waking the app for a new message or call | Until notifications are disabled or the queue is deleted |
| Abuse reports: reporting account and device, reported identifier, reason from a closed list, optional note by the reporter, time, handling state | Responding to spam, impersonation, harassment | Kept, as evidence in disputes about blocking an account (§6) |
| Service event log (registration, revocation, account deletion, report received), chained by hashes | Security and accountability of operations | Kept (§6) |
An abuse report never contains message text, photos, files or keys. Before sending, the app shows exactly the fields that will be transmitted.
3. What the server does not have
Plaintext of messages and attachments, the content of voice and video calls, your address book, your LL3 contact list, or your conversation history. The delivery server does not know who owns a queue: it knows the queue identifier and its access token.
4. Diagnostics
The diagnostic trace is written only locally on the device and only after being explicitly enabled. It is never sent automatically. It contains technical events (call stages, queue states), not content. You may copy it and hand it to support yourself; that is your decision.
5. Your actions in the app
- Blocking a contact works locally and without the server: new messages and calls from the blocked account are not stored on your device.
- Reporting abuse: Contacts → menu → “Report abuse”. Only the metadata described in §2 is sent.
- Unlinking the number: Settings → Phone number.
- Deleting the account: Settings → Account → “Delete account” (§6).
6. Account deletion and what remains
Deleting the account in the app, after confirmation, performs on the server in one operation: revocation of every device of the account, deletion of prekeys, deletion of the phone alias with any open verifications, deletion of pairing offers, and a record that the account was deleted, so that nobody can re-create an account under the same identifier. The app then deletes its own delivery queues (with pending envelopes and notification addresses) and wipes local data. There is no recovery.
What remains, deliberately and openly:
- an entry for each device in the public key log (public key and index only), marked as revoked. The log is append-only, and removing an entry would prevent other users from verifying that the revocation happened;
- event log entries (account identifier, event type, time). A hash chain with a gap stops being evidence;
- abuse reports concerning you or filed by you, with handling state, without conversation content;
- messages already delivered to other people, on their devices, beyond the server’s reach.
7. Recipients and location
The data in §2 is processed only by LL3 servers. We do not pass it to third parties, except for delivering notifications through the Apple Push Notification service (Apple receives a device token and a wake-up signal, not content). There is no tracking, no advertising analytics and no sale of data.
8. Contact and data controller
Privacy and support contact: contact@ll3.io (see also Support).
The data controller’s details (name, address) will be published here once the company’s legal details are confirmed.