Privacy Policy
What Pollis collects, what it cannot see by design, and what happens when you leave. Last updated 17 August 2026.
Who runs Pollis
Pollis is operated by Daniel Kral, an individual developer — not a company. It is an open preview of a proof-of-concept service. For anything in this policy, contact dankral01@gmail.com.
What is collected
Pollis collects the minimum an account-based messenger needs to function. All of it is used for app functionality only — never for advertising, profiling, or tracking.
| Data | Why | Visible to the operator? |
|---|---|---|
| Email address | The sole sign-in identifier. Signing in emails you a six-digit one-time code; that email is delivered by Resend, which sees the address and the code in plain text for the duration of the send. | Yes, in the clear. |
| Username and optional display name | Your account handle (directory-searchable, so people can find you) and an optional profile name. | Yes, in the clear. |
| Account and device identifiers | App-generated IDs plus an optional device name, so you can see and revoke your own devices. | Yes, in the clear. |
| Membership and activity metadata | Which groups and DMs your account is in, blocks, and conversation activity timestamps — the routing data delivery requires. | Yes, in the clear. Since sealed sender landed, stored message rows no longer record who sent what. |
| Push token | So a content-free notification can wake your phone. See the push section below. | Yes. |
| Messages, attachments, reactions | Your actual conversations. | Ciphertext only. Encrypted on your device under MLS before anything leaves it. |
| Avatars and group icons | Profile and group images. | Yes — these are the exception. They are not encrypted and are public to anyone with the URL. Don't put anything sensitive in an avatar. |
Your IP address is not stored anywhere. It is read in memory for rate-limiting and discarded; it does not survive a server restart. The network edge (Cloudflare) necessarily sees it in transit, as any edge does.
Your device PIN never leaves your device — it locks the local keystore and is not sent to any server. The local message database on your device is encrypted at rest.
What is not collected
No location, no contacts, no calendar, no photo-library scanning, no health or financial data, no browsing or search history, no advertising identifiers. There is no analytics, telemetry, crash-reporting, or advertising SDK in the apps — that is verifiable in the source code, not just stated here. Nothing is sold, and nothing is shared with third parties for advertising or marketing. No tracking, in Apple's sense of the word or anyone else's.
Push notifications are content-free
A push notification carries a fixed string ("New message"), the conversation ID, and whether it is a channel or a DM. No message content, no sender, no preview. Pushes are routed through Expo's push service to Apple (APNs) or Google (FCM); those providers see the token and that your device had activity in some conversation at some time, never what was said.
Who else touches the data
A small set of infrastructure providers process data on Pollis's behalf — the database host (Turso), the edge and storage host (Cloudflare), the login-email sender (Resend), the push relay (Expo, then APNs/FCM), and a leased server for realtime media. None of them can read message content. The subprocessors page lists every one of them, exactly what each can see, and where it runs — including the uncomfortable rows.
How long things are kept
Encrypted message envelopes are kept on the server until every current member device has fetched them, then garbage-collected — retention is a delivery watermark, not a time-to-live, because dropping undelivered mail is worse than storing it. One bound keeps that from meaning "forever": a device that has not checked in for 12 months stops holding messages back, and starts holding them again the moment it reappears. Messages you delete are removed from the server immediately. Account and directory metadata lives for the life of the account. Call signalling is not written to any database.
The full version — every category, its period, what deleting your account removes, and what the permanent transparency ledger keeps anyway — is on the retention page.
Your data, your rights
See it: everything the server holds about you in the clear — email, username, display name, devices, memberships — is visible and editable in the app's settings.
Delete it: account deletion is built into the app (Settings → Security → Delete account). It rotates the encryption keys of every conversation you were in so your old key material is useless going forward, purges your account row, devices, key packages, memberships, reactions, and pending envelopes from the server, and wipes the local database and keystore on your device. You can also request deletion by emailing dankral01@gmail.com from your account's address.
Messages already delivered to other people live in their devices' local encrypted databases. There is no mechanism to reach into someone else's device, and no honest messenger can claim otherwise.
The public transparency log is append-only by design. It records your account's key history and group-membership change fingerprints — identifiers and timestamps, never content — so that key-substitution attacks are detectable. Append-only means entries are never rewritten, including after account deletion. That trade-off is deliberate and documented on the transparency page.
Children
Pollis is not directed at children under 13, and you may not create an account if you are under the minimum age required for your jurisdiction.
Changes
If this policy changes, the new version is posted at this address with an updated date, and the edit history is public in the repository.