Data
Privacy
This page covers the website and the app's server-visible data. It is a plain description, not a compliance certification. BitGab has no SOC 2 report, no ISO 27001 certificate, and no third-party audit.
This site
What bitgab.app collects
The site is static HTML and CSS. There is no account, no form, and no client-side application.
- No cookies. The site sets none.
- No analytics. There is no measurement script, pixel, or third-party tag.
- No client-side JavaScript. Nothing executes in your browser on this site.
- No third-party requests. No web fonts, icon CDNs, remote images, or tracking domains. The only font stack is the one already on your device.
Cloudflare hosts the site and sees the source IP address, TLS SNI, timing, and byte counts for requests it proxies. That is network-level metadata at the hosting layer, not a BitGab analytics system. No setting on this site can remove it; running the server elsewhere moves it.
Email links open your mail client. A message you send to pilot@bitgab.app or security@bitgab.app is handled by your mail provider and the BitGab mailbox.
The app
What the server stores
These are the server-visible fields. The table is the data model, not a promise about intent.
| Data | Detail and retention |
|---|---|
| Random device handle | A 128-bit random ID. It is not a phone number, email address, or hardware ID. It remains while the identity exists. |
| Public keys | Ed25519 and X25519 public keys, plus X3DH pre-key material. Private keys stay on the device. |
| Room membership | Which device is in which room. Retained while the room exists, and never past its expiry. |
| Message events | Sender handle, timing, event type, and ciphertext. Retained for 12 hours. |
| Shared files | Encrypted objects in R2. Retained for 12 hours. |
| Presigned file URLs | Time-limited download links. They expire after 12 hours. |
| Push-routing values | The UnifiedPush distributor endpoint or the FCM token, plus the encrypted wake public key. Retained until push is re-registered. |
| Display name | Optional text the user may type. It defaults to the device model. Do not enter a real name. Retained until the identity is deleted or revoked. |
| IP address | Never written to a log. A transient rate-limit bucket is keyed by IP and deleted when its short window expires; it is not joined to an identity. |
The server cannot read message content, file content, keys, contacts, phone numbers, email, hardware identifiers, or location. Files are encrypted on the device before upload.
Never stored
What is not collected
- Message plaintext, in any form.
- File content. Files are encrypted on the device before upload.
- Decryption keys. They never leave the device.
- Contacts, phone numbers, or email addresses.
- Device hardware identifiers such as IMEI, Android ID, or an advertising ID.
- Location, in any form.
- The client IP address in any log.
Retention
How long it stays
The 12-hour window is the product. It is enforced in more than one place so a single failure does not extend it.
| Message events | 12 hours. The server expires them, and each device deletes its local copy at the same window. |
|---|---|
| Shared files (R2 objects) | 12 hours. An R2 lifecycle rule and a scheduled sweep both enforce deletion. |
| Presigned file URLs | 12 hours. |
| Room membership | Until the room is destroyed, and never past its expiry. |
| Device handle | Until the identity is deleted or revoked. |
| IP address | Never written to a log. |
Update check
The one non-messaging request
The app can ask for a version manifest so it can tell you a newer build exists. The check is deliberately small.
The update check fetches a version manifest. It reveals a version number and an IP address to Cloudflare. It sends nothing else: no message data, no contacts, no location, and no identity handle. It does not install anything; it can only point you to the APK.
This is metadata, not content. It is listed here because a privacy page that hides a network request is not a privacy page.
Deletion
How to exercise deletion
Panic delete
Panic Delete on the identity screen wipes the local database and every Keystore key, clears app preferences, and sends a signed revocation request. The process is killed so a stale keyset cannot be rewritten. The identity cannot be recovered.
Revocation
A signed revocation marks a device revoked and clears its push routing. A revoked device cannot authenticate to the server. Revocation is not a remote wipe: it does not erase data on another phone. A message already delivered to another device remains there until that device's 12-hour window deletes it.
Server-side message events and files expire at 12 hours. Room membership expires with the room. There is no account recovery and no server-side key backup to delete.
Contact
Questions
Privacy questions: pilot@bitgab.app. Security reports: security@bitgab.app. BitGab does not promise response times.