Legal · data inventory
Everything that exists, and where.
A privacy policy tells you our intentions. This tells you the inventory. Every category of data that exists anywhere in this system is below, including the many where the honest entry is none — because “we don't collect that” is only meaningful next to the list of things we could have.
01 — Your identity and account
There is no account, so this section is short.
Phone numberNever collectedNot required, not requested, not storable. There is no field for one.
Email address (for the app)Never collectedThe messenger asks for no email. The website's early-access form is separate and is covered below.
Name, username or handleNever collectedYou may set a display name; it lives on your device and is shown to contacts you have paired with. It is never uploaded to us.
Account recordDoes not existThere is no accounts table anywhere in our infrastructure. Not empty — absent. Nothing records that you exist, when you first used Avano, or when you last connected.
Your identity keyOn your device onlyDerived on the phone from a recovery phrase you hold. Never transmitted to us. We could not produce it, and nor could we recognise it if somebody showed it to us.
Payment or billing identityNone todayThere is nothing to pay for. If a paid tier ever exists it is designed to settle without linking a payment to a user, and it will get its own entry here before it ships, not after.
02 — Your messages and contacts
On your phone. Nowhere else.
Message contentsYour device onlySealed end-to-end before they leave and sealed again at rest. We never hold a key that opens one. A relay carries them as opaque fixed-size blocks.
Your contact listYour device onlyNever uploaded to us and never synchronised to any server; if you set up recovery helpers, each holds a sealed copy, as described below. There is no contacts table on any server of ours. On the phone, the names you gave contacts are stored under a keyed blind index, not in the clear; what a seized device still shows, such as how many contacts you have, is listed on the limits page.
Group membershipYour device onlyNo membership list exists on any server. A relay can nevertheless infer which addresses belong to one group by watching arrival times over a period — stated on limits, because it is a real leak even though we do not store the data.
Files and photos you sendTransiently, sealedSplit into identical padded pieces under unrelated random names, each with its own key and expiry, held in relay memory, sealed, for up to seven days whether or not they have been collected (less under a disappearing timer). The relay cannot read the size, the type or the destination from any one piece, though it can estimate a file's size from a burst of pieces. Location and camera tags are stripped from photos and videos before they leave your device; other files go exactly as they are.
The cameraYour device onlyOpened only when you open it: a photo, a video note, a pairing code, a video call. Nothing it sees leaves the phone except the photo or note you chose to send, sealed like any file.
Your locationYour device only, until you share itRead only when you tap to share it, and only approximately. Sent once, as a sealed message to that contact. We never receive it and there is no history of it on our side.
Voice notes and video notesYour device onlyVoice notes are recorded into memory while you hold the button; video notes into memory on Android, and on iPhone into a protected temporary file deleted as soon as it is read. Either is then sent like a file: sealed, padded, and through the relay as opaque pieces.
The vaultYour device onlyDocuments you put in the vault are encrypted on the phone under the vault's own passphrase and leave it only if you share an item with a contact, which sends it sealed as a file the contact can save into their own vault. There is no vault on any server.
Undelivered messagesRelay memory, time-limitedA sealed block waits in memory until the recipient collects it or its time-to-live expires. Its arrival time is held coarsened to the hour, which exists so an expiry can work at all and is real state we would rather you knew about.
Message backupsDo not existNo cloud copy, no export, no restore of messages. A lost phone is lost messages. Your identity and contact list are the exception: your 24 words restore your identity, the recovery helpers you chose can return your contact list, and “Move to a new phone” carries them to a new handset while you still have the old one. Neither goes through us.
03 — At the relay
What the server in the middle actually has.
This is the part a legal request would reach, so it is the part worth reading slowly.
Your IP address (messaging)Never receivedThe message relay is reachable only as a Tor onion service and binds to loopback. Connections arrive from inside the Tor network. Your address does not reach us and is therefore not something we discard — it never arrives. A voice call is the exception; see the row below.
Your IP address (during a call)Seen by the call relay, during a callCall media cannot ride Tor, so it goes to a call relay over the clear internet. That relay sees both callers' IP addresses and the call's timing while the call rings or runs and for up to about a minute after — never its contents, which are end-to-end encrypted, and nothing is written to disk. Video calls, offered on Android, take the same path at a fixed rate. The microphone is captured only while a call is up or while you record a voice or video note, and the app warns you before every call.
Sender identity on a messageNot in the protocolA deposit carries no sender field of any kind. It is not anonymised or hashed; the field does not exist. There is nothing to authenticate and nothing to log.
Connection logsNoneThere is no logging on the connection path. No access log, no error log naming a peer, no metrics tied to a connection.
Queue identifiers and their keysIn memory, while liveThe relay must know which slot a block belongs to in order to route it, and holds the key that authorises collection. These are random values not linked by us to any person. Whether that makes them personal data is an open question for counsel and we are not going to answer it ourselves.
Anything written to the diskNothingNo database, no state directory, no spool on the drive. Undelivered mail is checkpointed to memory-backed storage so a crash does not destroy it; those pages are never written to the block device and the machine has no swap. The relay refuses to start against a non-memory-backed directory rather than warning about it.
A copy of the relay's memoryObtainable by the hostStated because the row above is easy to over-read. The company that owns the physical machine can be compelled to image its memory without our knowledge. That image would contain live queue identifiers, their keys, undelivered blocks and the relay's own identity key. In-memory operation defeats a disk warrant. It does not defeat the machine underneath.
04 — This website
What avano.app collects when you read it.
CookiesNoneThe site sets no cookies of any kind — not analytics, not preference, not session. There is no consent banner because there is nothing to consent to. The detail →
AnalyticsNoneNo analytics service, no tag manager, no pixel, no session recorder, no heat mapping.
Third-party requestsNoneEvery asset — stylesheets, scripts, fonts, images — is served from this origin. The fonts were moved off a third-party font service precisely because it handed that company the address and browser of every visitor to a site about not creating records. The page is served with a policy that blocks any request to another host, so a regression would break the page rather than leak quietly.
Email you send usIf you write to usMail to [email protected] is delivered by Cloudflare's email routing to our mailbox, where your address and what you wrote are kept, to answer you and, if you asked, to send you builds. Nothing else is collected with it — no name, no company, no source tracking. The early-access form is not connected yet and stores nothing. Ask us to delete your mail and we will. Retention period: not yet set, and that is one of the questions for counsel rather than an oversight we are hiding.
Hosting logsHeld by our host, not usThe website runs on third-party hosting which may keep transient technical records for security and abuse prevention. We do not use them to profile anyone and we do not have a copy. We cannot currently state the retention period because it is the host's, and saying otherwise would be a claim we have not checked.
Anything linking the site to the appNothingThere is no identifier shared between this website and the messenger. Reading this page and using Avano are unconnected events and there is no mechanism by which we could join them.
05 — Third parties
Who else is involved, and what they can see.
Website hostingSees visitorsThe site is served by a commercial hosting provider, which necessarily sees the connection that fetches these pages. Nothing about the messenger passes through it.
Relay hostingOwns the machineOur relays run on rented virtual machines from commercial providers. The message relay is in Germany; a second message relay for the two-relay split is planned but not currently deployed. A separate call relay carries call media, voice and, on Android, video, and sees callers' IP addresses while a call is up. A host cannot see message contents or user identities; under compulsion it can image the machine — see the memory-image row above.
The Tor networkCarries the trafficIndependent relays we do not operate and do not control carry your connection. This is the point: no single party, including us, sees both who you are and what you are doing. Your use of Tor is subject to how Tor works, which is documented publicly by its own project.
Apple / Google push servicesNot in the message pathNo push provider carries your messages on either platform: no Firebase, no FCM, and no APNs registration or push token today. (A VoIP-push path for call ringing exists in the iOS source but is gated off and registers nothing until it is enabled.) On Android, Avano's arrival notification is raised locally by the app itself, off a wakeup over our relay, so neither Apple nor Google is told that a message arrived for your device or when; on iPhone no alert is raised yet.
App storesNot yetAvano is not in any store today; the build is installed by hand. When it is, the store operator will know who downloaded it, which is a real and unavoidable consequence of that distribution channel and will be stated here at the time.
Advertising, data brokers, analytics vendorsNone, everThere is no advertising in Avano, no data is sold or shared for marketing, and there is essentially nothing that could be sold. This is a structural claim, not a policy one — the data does not exist to be sold.
06 — What this means for a legal request
The list above is the answer to a subpoena.
Compulsion produces what the records contain. Read the inventory again with that in mind: for the messenger there is no account, no identifier, no address, no sender, no contact list, no group list, and nothing on a disk. The most an order could reach is a set of random queue codes and sealed blocks that nobody, including us, can attribute to a person or open.
The exception is the mail people send to [email protected], kept in our mailbox, which would be produced if lawfully ordered. If that matters to you, write from an address that does not name you, or simply wait.