The shortest honest privacy policy we could write.

Status: draft, not yet effective. Applies to: the avano.app website and the Avano messenger application (pre-release). Operating entity: to be confirmed — see the imprint, which is also incomplete for the same reason.

The short version

Avano is built to know as little about you as possible. You do not create an account. You do not give us a phone number, an email address or a name in order to use the messenger. We run no analytics and no advertising, and we do not sell data — there is essentially nothing that could be sold.

The one exception is email you send us at [email protected]: it is kept in our mailbox, with your address on it. The early-access form on this website is not connected yet and stores nothing; it asks you to write to us instead.

What the messenger collects

• No account and no identifiers. Your identity is a key generated on your device from a recovery phrase, and it is never transmitted to us. We hold no phone number, email, name or username for you, and there is no accounts table in our infrastructure — not an empty one, none.
• No contact list and no social graph. Your contacts and groups live on your phone; if you set up recovery helpers, each holds your contact list sealed, with one share of the key to it. One helper alone cannot read it; any two of them together can, even without your words, so choose people who would not. On recovery day each sends it back sealed under a key only your words can make, so someone who intercepts the links cannot read it. Our relay has no contacts table, no group membership, and no sender field in its protocol at all.
• No IP address from messaging. Messaging travels over a Tor client built into the app, to a relay published only as an onion service. Your address does not reach us — this is not a retention choice, it is a structural one. The one exception is a call; see the calls entry below.
• Message contents. Sealed end-to-end on your device before they leave it. We never hold a key that opens one.
• In transit. Undelivered messages wait in the relay's memory as sealed, identical-size blocks under random codes, with a time-to-live, and are never written to a disk. Their arrival time is held coarsened to the hour so that expiry can work. Files, photos and voice or video notes are held the same way, sealed, for up to seven days after they are sent (less under a disappearing timer), whether or not they have been fetched.
• On your device. Your messages and contacts are stored encrypted and can be locked behind a passphrase. We never receive it. Messages stay on the phone; the contact list leaves it only sealed, in the recovery packets you give your helpers or to a new phone you move to. What a seized device does still yield is described honestly on the threat model — we would rather tell you than have you assume.
• What the app touches on your phone, and only when you use it. The camera, only while you have opened it to take a photo, record a video note, scan a pairing or safety-number code, or (on Android) make a video call. Your approximate location, only when you tap to share it: it is sent once, as a sealed message to that contact or group, and never to us. Files and photos you attach: photos and videos are cleaned on your device before they are sent (location, camera details and other metadata blocks are removed), and one that cannot be cleaned is refused rather than sent. A video still carries the date and time it was recorded, and a HEIF photo keeps its colour profile; other files are sent exactly as they are. A photo you set for one contact goes to that contact alone. The vault keeps documents encrypted on the phone and on no server. Opening a document, or a file someone sent you, hands a decrypted copy to the app you open it with, which may keep its own record of it; Avano deletes its own temporary copy when it locks or when you delete the item. If you share a vault item with a contact, it travels to that contact as a sealed message, like any attachment, and lands in their vault; nothing of it reaches us. None of this leaves your device except as a sealed message to the person you chose.
• Calls. One-to-one voice calls, and on Android one-to-one video calls. Because call media is UDP it cannot ride Tor: it goes to a call relay over the clear internet, and that relay sees both callers' IP addresses and the call's start, stop and duration — never its contents, which are end-to-end encrypted. A video call's picture travels the same call relay under the same rule and the same warning before every call, at a fixed rate for the whole call, so its size does not follow what the camera sees. On iPhone, video calls are not built yet: an iPhone answers a video call with sound only. The microphone is captured only while a call is up or while you hold the button to record a voice note, or while you record a video note (on iPhone, while the video-note camera is open), and the app asks for it the first time you do either.
• No push service in the message path. No push provider carries your messages on any platform, so no third party is told that a message arrived for your device. The arrival notification you see is raised locally by the app, off a wakeup over our relay, through Tor, and its whole text is the app's name.

What the website collects

• Email you send us, if you choose to. The early-access form is not connected yet: an address typed into it reaches our website host in the request, is not stored, and the form asks you to write to us instead. Mail to [email protected] is delivered by Cloudflare's email routing to our mailbox, where your address and what you wrote are kept. We use them to answer you and, if you asked, to send you builds, and nothing else is collected with them. The basis is your consent, which you can withdraw at any time by writing to us. We have not yet set a fixed retention period; until we do, we delete your mail when you ask.
• No cookies, no analytics, no advertising, no third-party requests of any kind. Every asset on this site is served from this origin, fonts included. There is no consent banner because there is nothing to consent to. The detail →
• Hosting records. Our website host may keep transient technical records to deliver the service and prevent abuse. We do not use them to profile anyone and we do not hold a copy. The website is served by Cloudflare; those records are governed by Cloudflare's data processing addendum and its EU-U.S. Data Privacy Framework certification. We have not verified a retention period, so we do not state one.

Third parties

• Hosting providers. The website and the relays run on commercial infrastructure. A message-relay host cannot see message contents or user identities; a call-relay host does see callers' IP addresses while a call is up. What such a host can do under legal compulsion is set out plainly on our law-enforcement policy, because the alternative is letting the good news be over-read.
• A bridge or a proxy you configure. In a censored network you can point Avano on Android at a Tor bridge, or at a proxy your phone already runs. The operator of that bridge or proxy sees that your phone speaks Tor and which entry it connects to, never a message, a queue or who it is for. A Snowflake bridge also contacts the broker, the front domain and the STUN servers named in its line, and each of them sees your address. A bridge line a contact sends you is offered on the bridge screen and applied only when you save it there.
• The Tor network carries messaging traffic and is operated by independent relays we neither run nor control.
• Nobody else. No analytics vendor, no advertising network, no data broker, no push provider, no crash reporter. On Android the app also switches off the usage metrics the system's WebView component, which draws its screens, could otherwise send Google; if you allowed your phone to send Google diagnostics, a crash of that component may still be reported by Android itself.

Your rights, and where they hit a wall

Depending on where you live you may have rights to access, correct, export or delete data held about you. For email you have sent us, exercising them is simple: write to us.

For the messenger, we want to be straight about something a normal policy would smooth over. We cannot fulfil an access or erasure request for your messages or your identity, and it is not because we are refusing. Nothing in our messaging systems links a person to a message or a contact; the exceptions are the call relay, which holds both callers' IP addresses in memory while a call rings or runs and for up to about a minute after it ends (the server's kernel keeps its own short-lived record of the same connection), and our mailbox, which holds the email people send us. We could not find your data if you asked, we could not confirm you are a user, and we could not verify your identity in order to try — there is no identity on our side to verify against. The remedy that does work is in your hands: erasing your identity in the app destroys everything Avano stores on the phone (it cannot reach what other apps hold: a file you opened elsewhere, or, on Android, the system's record of when an Avano notification appeared), and undelivered mail expires on its own.

This is Article 11 of the GDPR: a controller that cannot identify you is not obliged to acquire information in order to identify you, and Articles 15 to 20 do not apply. If you can supply information that lets us identify you, for example an email address you have written to us from, those rights apply to that data normally. You also have the right to complain to a data-protection authority: the one where you live or work, or, once the operating company is registered, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

How this should be worded to be both accurate and legally sound is one of the open questions for counsel.

Children

Avano is not directed at children and we do not knowingly collect data from them. We collect no age-identifying information of any kind, which means we cannot determine any user's age and could not enforce a limit if we wanted to. Stated as a fact rather than as a policy, because a policy we cannot enforce is not a policy.

Legal requests

Because we hold so little, a legal request can only ever produce what our systems actually contain. That, category by category, is set out in our law-enforcement request policy. To date we have received none. Requests are counted in the transparency report on the proof page, category by category, as far as the law lets us: an order Estonian law requires us to keep confidential is counted only when we may count it, and is never described. Today every count is zero.

Changes

Avano is pre-release and this policy will change as the product and the infrastructure mature. Material changes will appear here with a date, and — once this document exists in a reviewed form — a proper effective date.

Contact

Privacy questions and deletion requests: [email protected]. Security issues: the same address, listed deliberately in our /.well-known/security.txt so there is one door.