Privacy Policy
eteyo is a messaging app that works over Bluetooth mesh and through independent relays. It has no accounts and no central message server. This page explains, in plain language, what the app does with information.
The short version
- You do not need an account, phone number or email address to use eteyo.
- We run no messaging backend. Private messages are end-to-end encrypted; public messages are readable by their recipients and relays, and we can read content you choose to send in a report.
- There are no ads, no analytics and no tracking.
- Your private identity keys and local conversation history are stored on your device. Public identifiers and messages are shared as described below.
- Messages sent over the internet travel through independent relays that we do not run.
Who is responsible
eteyo is developed by Kagan Yaldizkaya. Questions about this policy: support@eteyo.com.
What is stored on your device
- Your nickname, favorites, blocked people, hidden words and settings.
- Your cryptographic identity keys, in the iOS Keychain.
- Chat history. It is temporary: it is held by the app on your device and is not stored in an eteyo account.
- An encrypted delivery queue for private messages that could not be delivered yet, for up to 24 hours.
- Recent public mesh messages and encrypted envelopes for other people, which your phone may carry for a short time (up to six hours and 24 hours) so nearby networks can reconnect.
Settings → Message storage shows these limits inside the app.
Bluetooth mesh
eteyo uses Bluetooth to find and talk to other devices nearby that speak the same protocol: eteyo, and the open-source bitchat app it is built on. Devices within radio range can tell that such an app is active and can see the nickname you chose, and people using bitchat can exchange messages with you. The Bluetooth radio link itself does not use the internet or Tor. When mesh bridging is enabled, the app signs an additional public copy that can reach the internet through this device or a nearby bridge. Radio-only messages are not automatically bridged by this protocol; recipients can still copy or forward anything they can read.
Location
Location access is optional. eteyo can use your current location to suggest place channels, such as your city. Raw coordinates are not included in messages. A place channel is identified by a geohash code: participants and relays can see that code. A fine-grained channel can identify a small, potentially precise area; choosing a channel can reveal that area even without granting location permission.
To show a readable place name, the app supplies the location being named to Apple’s reverse-geocoding service. The current implementation does not round the coordinates before this request. It goes to Apple directly, not through Tor, and is skipped when internet delivery is switched off. Apple’s privacy policy applies to it.
Internet delivery, relays and Tor
Messages in place channels, and private messages to people who are not nearby, are delivered through Nostr relays: independent servers that we do not run. eteyo and bitchat share the same protocol and relays, so people using bitchat can send you messages and read place channels too.
- Private messages are end-to-end encrypted. Relays can still see delivery details such as timing, size and the public identifiers used for delivery.
- Place-channel messages are public. Anyone in the channel, and every relay carrying it, can read them.
- Relays decide how long they keep data. We cannot delete anything from a relay or from another person’s device.
- Tor. By default eteyo connects to relays through Tor, which hides your IP address from them. Tor does not hide message timing or size. If Tor cannot connect, internet delivery pauses instead of connecting directly. If you turn Tor off, relays can see your IP address.
- Relay list. The app downloads a list of public relays from a file in the bitchat project's repository on GitHub. With Tor on, that request goes through Tor.
You can stop this device’s internet delivery, or turn Tor off, in Settings. Turning internet delivery off does not prevent a previously authorized bridge copy from being carried through another device, or recipients from copying public messages.
Notifications
Notifications are created on your device. eteyo does not use Apple’s push notification service or any notification server. By default, notification previews are hidden.
Optional QR verification
If you choose Scan verification QR in a nearby contact’s details, eteyo asks for camera access to read their verification code. The camera is not needed for messaging. Scanner images are not saved or sent. This text-only release does not support taking or sending photos and does not request microphone or photo-library access.
Reports
If you report a message or a person, the app prepares an email on your device containing the reason, an optional note, the messages you select, the reported person’s nickname and public identifier, the conversation or place-channel context when available, and the app version. You see the exact text before sending. The email goes from your own email account, so we receive your email address with the report.
We use reports to review them, to improve the app’s safety tools and to meet legal obligations, and keep them no longer than needed. Where the law requires it, or where someone may be in danger, we may share a report with the authorities.
What we do not collect
eteyo does not collect your contacts, advertising identifiers, analytics or location history, and it contains no advertising or analytics software. If you install through TestFlight, Apple may share crash reports and feedback you choose to send with us under Apple’s own policies.
Your choices
- Internet delivery and Use Tor switch relay features and Tor on or off.
- Hide message previews keeps message text and sender names out of notifications.
- Hidden words hides messages from other people that contain words you choose, and keeps them out of notifications. The list stays on your device and is not sent to anyone.
- Clear chat history removes conversations from your device.
- Emergency wipe also removes identity keys, saved places and preferences.
- Block and Report are available on every message and profile.
Deleting the app removes its data from your device, but items in the iOS Keychain can outlast an app deletion. Use Emergency wipe first if you want your identity keys gone too. None of these can erase copies held by other people or by independent relays.
Security
Private Bluetooth chats use end-to-end encryption with the Noise protocol. Private relay delivery uses a different, bitchat-specific encrypted envelope; it is not NIP-17. Compromise of a recipient’s static relay identity key can expose previously recorded relay messages. No system is perfectly secure. When identity matters, verify a contact in person by comparing security codes or scanning their QR code.
Children
eteyo is not directed at children. Use it only if you meet the minimum age shown for eteyo in the App Store and where you live.
Your rights
We hold no user accounts and cannot decrypt private messages in transit. Public content and reports you send can nevertheless contain personal information. For reports we have received, you can ask us to access, correct or delete the personal information we hold about you, and you can complain to your local data protection authority. We cannot delete copies held by independent relays or other people. Where data protection law requires a legal basis, we rely on our legitimate interest in keeping eteyo safe, and on legal obligations.
Changes
If this policy changes in a way that matters, we will update the date above and, where appropriate, tell you in the app.