Privacy Policy

•••, Ijbruglaan 1495, 1087 KM Amsterdam, The Netherlands. Contact for privacy matters: [email protected]. Company details are in our imprint.

Your messages, voice messages, files, reactions and notes are end-to-end encrypted on your device. We cannot read them. We show no advertising, we do not sell personal data, and we use no analytics or tracking tools.

Account data: display name, username, optional “about me” text, avatar colour, optional profile photo, language setting, and either a password (we store only a salted scrypt hash) or your mobile number if you sign up with it. Purpose: creating and running your account. Legal basis: contract, Art. 6(1)(b) GDPR.

Profile data (name, username, profile photo, “about me”, online status) is visible to other Petra users. Read receipts and “typing” status are shared with the people you chat with; you can switch read receipts off per chat.

Messages, voice messages, files and reactions: they reach our server only as encrypted packages and are stored so they can be delivered to the recipients and to your other devices, until a self-destruct timer or you delete them. We cannot decrypt them. Legal basis: contract, Art. 6(1)(b) GDPR.

Metadata the server necessarily sees: chat ID, sender and recipient account IDs, time, package size, public keys of devices and whether a user is online. Purpose: routing and delivery, preventing abuse. Legal basis: contract, Art. 6(1)(b), and legitimate interest in a secure service, Art. 6(1)(f) GDPR.

Sessions: a sign-in cookie lets you stay signed in for up to 30 days; only its hash is stored on the server. Legal basis: contract, Art. 6(1)(b) GDPR.

Notifications (optional): if you turn them on, we store your device's push address and your language to send a content-free alert such as “New message”. Message text is never part of a notification. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time in the app or in your device settings.

Technical logs: our web server records technical data such as IP address, time and requested page. Sign-in and code requests are rate-limited per IP address (kept in memory only). Purpose: security and stability. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

Petra uses only what is strictly necessary to provide the service you request: a sign-in cookie (name “petra_session”, HttpOnly, SameSite=Strict, up to 30 days), local storage on your device for your language choice, and secure storage on your device for your encryption keys. Because these are strictly necessary, no consent banner is required (Art. 5(3) ePrivacy Directive). We use no advertising or analytics cookies and no third-party trackers.

Hosting: Hetzner Online GmbH, Nuremberg, Germany (EU), as our processor under a data processing agreement (Art. 28 GDPR).

SMS: if you confirm or add your mobile number, the number is passed to our SMS provider (our processor, GatewayAPI, Denmark/EU) solely to deliver your one-time code.

E-mail (optional): if you add an address we store it until you remove it or delete your account, only to reset a forgotten password. We send the code through Resend (our processor), which sees the address and the code.

Push services: Notifications are delivered through Apple (APNs), Google (FCM) or your browser vendor. They see that an alert is sent to a device, never message content.

Voice-to-text (optional): if you switch on live transcripts for voice messages in a browser such as Chrome, the browser vendor may process the audio for speech recognition. Leave it off if you do not want that.

We do not sell personal data and do not share it for advertising purposes.

Our servers are in Germany. Push services of Apple and Google may process the technical push address in the USA. Resend (e-mail delivery) is a US company; it only receives the address and the one-time code. Transfers rely on the EU–US Data Privacy Framework or EU standard contractual clauses. Alerts contain no message content.

Account data: until you delete your account. Messages and files: until you or a self-destruct timer delete them, or your account is deleted. Push addresses: until you turn notifications off, sign out or the address becomes invalid. Technical logs: only as long as needed for security and operation. Sessions end after 30 days or when you sign out.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7(3)). Write to [email protected]. Until account deletion is available inside the app, request it at the same address; we respond without undue delay and within one month.

You can lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work. Our lead authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), autoriteitpersoonsgegevens.nl.

Providing account data is necessary to use Petra; without it we cannot offer the service. Push notifications and live transcripts are optional. We do not make decisions based solely on automated processing and do not profile you.

Petra is not directed at children under 16. If you believe a child has created an account, contact us and we will delete it.

Because content is end-to-end encrypted, we cannot read it. To report illegal content or an account, write to [email protected]. We act on valid notices as required by law, for example by restricting the reported account.

Key backup: when you create your account, your device wraps your private key with a recovery code that only you see and stores the result on our server as an opaque block. We cannot open it. Without the code your old chats cannot be restored. Purpose: restoring chats on a new device (Art. 6(1)(b) GDPR).

Settings and language are stored with your personal preferences, end-to-end encrypted to your own devices, so they survive a reinstall. We cannot read them.

Petra Plus: we store whether your account has Plus (type, end date, source) and which voucher codes you redeemed (Art. 6(1)(b)). Purchases through the App Store or Google Play are processed by Apple or Google; we receive only the status. Purchases on our website will be processed by our payment provider as a processor; we will name it here before it starts.

Moderation and safety: for abuse prevention we can note flags and suspend accounts. We store the reason, date and the acting administrator in a log (Art. 6(1)(f), our interest in a safe service). A suspension ends your sessions. We send service notices (maintenance, safety, account) as plain text; they are not part of any chat.

Two-factor sign-in (optional): if you switch it on, we store the secret of your authenticator app and hashes of your ten recovery codes until you switch it off or delete your account (Art. 6(1)(b) and (f) GDPR, account security).

Device identifier: the app creates a random ID for your device and sends only a hash of it when you sign in or register. We keep the hash with your account to keep permanently suspended devices out (Art. 6(1)(f) GDPR, protection of other users). It is deleted with your account; a lifted suspension frees the device.

Profile links (optional): the user names and the website you add are visible to other Petra users. We check them with our own rules only; no third-party service is asked. Messages planned for later are kept on your device only.

Finding friends (optional): you can choose an address-book file (.vcf or .csv) in the app. It is read on your device; only encrypted check values (SHA-256 hashes) of e-mail addresses and numbers are sent to our server, compared with the confirmed addresses of people who allow being found, and not stored. Names and the file never leave your device. You can switch off being found in the settings (Art. 6(1)(b) and (f) GDPR; you are responsible for having the right to use the contacts you check, for example as a private person).

Support: your requests and our replies are stored linked to your account until they are resolved, and removed when you delete your account (Art. 6(1)(b) GDPR). We no longer use e-mail for support.

Public profile page: at getpetra.io/@name we show anyone with the link your display name, your description and the blue check, nothing else. The page is blocked for search engines, and you can switch it off in the settings (Art. 6(1)(b) GDPR).

Blue check: if you request it, we store your details and proof link until the request is decided, and afterwards for the 60 days that must pass between two requests. The decision is stored with your account (Art. 6(1)(b) GDPR). The check is free and cannot be bought.

Documents: PDFs and other files are deleted from our server after 3 days unless you saved them on your device. Photos, videos and voice notes stay until you or a timer delete them. Your own stickers are kept only on your device.

Blocking: your block list is stored on our server so that messages from people you block are not delivered; it is removed with your account.

Reporting a person: you choose the reason, an optional note and up to five text messages to share; never files or photos. The reported person is not told who reported them. We keep a report only as long as needed to handle it and to protect others (Art. 6(1)(f) GDPR; reports involving minors also because of our duty to protect children).

Deleting your account removes your account, public key, key backup, e-mail address, support requests, block list, push registrations, entitlement and notice history. Messages you sent stay encrypted with your contacts unless they delete them.

We update this policy when the service changes, for example when new features process additional data. The date above shows the latest version.