SKAM Privacy Policy

Effective October 27, 2026. Version 2026-10-27. Updated November 4, 2026: a report on an account includes the last 10 messages of your chat with it.

This policy explains what data the SKAM messenger for Android (package world.skam.messenger on Google Play, ru.evgeniy.messenger when installed from the website) and the server app.skammessenger.com process, why, for how long, and how to delete it.

1. Who is responsible

Service operator: Foshchan Yevheniy, Chișinău, Moldova.

Privacy and deletion questions: skammessenger@gmail.com.

2. Summary

• No phone number or email is needed to sign up. Your account is a key pair created on your phone.
• Messages, calls, photos, voice messages, files, profile photos and group names are end-to-end encrypted. The server relays and temporarily stores only encrypted data and cannot read it. The only exception is a report you send about an account (see "Reports about other accounts" below).
• The server can see your profile name, your optional @handle, technical identifiers and who you are connected with. It needs these to deliver messages.
• Ads appear only when you choose to watch a rewarded video to open an avatar frame. They come from Google AdMob, are not personalised, and the app does not use the advertising ID. There are no third-party analytics SDKs. We do not sell data.
• The wallet is self-custody: wallet keys and the wallet phrase stay on your phone and never reach our server.

3. What is end-to-end encrypted

End-to-end encryption means only the devices of the sender and the recipients have the keys to decrypt. We do not.

• Text of direct and group messages, reactions, replies and edits.
• Photos, voice messages, GIFs and files. Each file is encrypted on the phone, and its key travels inside an encrypted message.
• Voice calls (WebRTC with DTLS-SRTP between the participants).
• Your profile photo and contact card. The photo is seen by the people you choose in Privacy → Profile photo (Everyone, My contacts or Everyone except…; "everyone" means your contacts and the people you have a chat with). Wallet addresses for gifts in the card go to your contacts only.
• Names and photos of v2 groups. The server sees only their hash.
• The text of push notifications (who is writing or calling). It is sealed with a key of the specific phone.
• Your own copy of your contact list and call log. It is encrypted with your account key.

Direct messages use the Olm protocol (vodozemac library). Groups use group keys that are distributed to members over encrypted channels. Cryptographic operations use the libsodium library.

4. What the server stores

The server stores the following.

• Account public key (your SKAM identifier). Kept until you delete the account.
• Profile name (up to 40 characters). Stored in plain form, not encrypted. Anyone who knows your @handle or key can see it. Kept until you change it or delete the account.
• @handle (optional). Public: people can find you by it. Kept until you remove it or delete the account.
• Device keys. Public keys and certificates of your phones, and one-time keys used to start encrypted conversations. Used one-time keys are deleted after 14 days; the rest are kept until the device is replaced or the account is deleted. Device keys and certificates contain no phone model or name.
• Connections. Whom you added as contacts (to deliver profile photos and apply your "who can message me" rules), whom you blocked, which groups you belong to, and who their administrators are. Group memberships are kept as the group's signed history.
• Queued messages. An encrypted message stays on the server until the recipient's device confirms it has stored it. Then its content is erased. An undelivered message is deleted after 7 days. Technical message identifiers (no content, no recipient) are kept until the sender's account is deleted, to prevent replays.
• Encrypted attachments. Deleted 24 hours after upload. Exceptions: the last two profile photos and the last two photos of a group. They stay (encrypted) until replaced or until the account or the group is deleted.
• Privacy settings. Who may message you and send you photos and voice messages.
• Push token for Firebase Cloud Messaging and the phone's public key used to seal notifications. Kept while notifications are on for that phone, or until the account is deleted.
• Consent record. Version of the documents you accepted and the time.
• Reports about other accounts. If you report an account in the app: your key, that account's key, the reason, the text you typed and the last 10 messages of your chat with that account (their text, author and time; a photo, voice message or file is only named, never attached). The report form says this before you send it. Only the SKAM administration reads reports. Kept for 90 days.
• Suspensions by the SKAM administration. The account, the time and the reason. Kept until the suspension is lifted.
• Problem and error reports. A report goes when you tap "Report a problem" (you see the full text before sending) or, only if you agreed after registration, automatically when the app hits an error or crashes. A report holds the SKAM version, the Android version and phone model, screen size and time zone, whether there was a connection or a call, and a technical log of the app with the trace of a crash; keys are replaced by short fingerprints, and message texts, names, contacts, photos, phrases and codes are not collected. You can withdraw the consent in Settings → Help. Kept for 30 days.
• Deletion requests from the website. Account ID or @handle and the reply email. Kept for up to 90 days.
• Avatar frames. The frame you wear (public, like your name), the frames you opened and how (a purchase or videos), the Google Play order ID of each purchase, and how many videos you watched for a frame not opened yet. One-time video tickets are deleted after a day, AdMob transaction IDs after 30 days; the rest is kept until you delete the account.

5. IP addresses, logs and backups

The application server does not write IP addresses to its logs. It uses your IP address only in memory: to limit new accounts (at most 20 per hour from one address) and the number of connections. These counters reset within an hour.

Caddy reverse proxy: no request log is kept and IP addresses are not recorded; service error messages go to the server's system log without IP addresses. Call relay server (TURN): no session log is kept and IP addresses are not recorded. The server firewall records the addresses of blocked connection attempts to closed ports; these records are kept for up to 5 weeks.

Before each server update, a snapshot of the database is made. Snapshots are kept for 30 days and then deleted. Data of a deleted account may remain in such snapshots until they are deleted.

The server is hosted by DigitalOcean, LLC; server in Frankfurt (Germany).

6. Calls

When a direct connection is possible, the call goes directly between the phones. The other person's device then technically receives your IP address. Otherwise the call goes through our relay server (TURN), which only passes encrypted audio. To learn its public address, your phone contacts Google's public STUN servers (stun.l.google.com); Google sees the phone's IP address. Call setup signals pass through our server encrypted.

7. Push notifications

To wake the app, the server sends a notification through Google Firebase Cloud Messaging. It contains only the event type and an encrypted block; the sender's name and the text are sealed for your phone. Google processes the device token and the Firebase installation ID to deliver it (Firebase privacy). You can turn notifications off in the app or in Android settings.

8. Wallet

• The wallet is self-custody. Keys and the recovery phrase are created on your phone, stored there encrypted, and never kept by our service. We cannot recover your wallet, or reverse or block a transfer.
• To show balances and prices and to send transfers, the app connects directly to public blockchain services: TronGrid (api.trongrid.io), PublicNode (ethereum-rpc.publicnode.com), Blockstream (blockstream.info), mempool.space and CoinGecko (api.coingecko.com, prices only). These services see your phone's IP address and the public wallet addresses requested. Our server does not receive this data.
• Blockchain transactions are public and irreversible. They cannot be deleted, including when you delete your account.
• A gift to a contact is an ordinary blockchain transfer. Its record exists only in your encrypted conversation; no information about it reaches our server.
• Incoming-funds monitoring (if you turn it on) checks your public addresses through the same services every 15 minutes and shows a notification.
• Connecting an external wallet (Trust Wallet, MetaMask and others) uses WalletConnect, run by Reown. The session content is encrypted between the apps, but according to Reown's policy its infrastructure may process the IP address, country and region, a random client ID, protocol metadata and wallet addresses (Reown privacy policy). Reown telemetry is turned off in SKAM.

9. Avatar frames: purchases and rewarded videos

Premium avatar frames can be bought once or opened by watching rewarded videos. Both are optional.

• Purchases go through Google Play Billing. Google processes the payment under its own terms; no card or payment details reach us. To check a purchase, our server asks Google for its status, product and order ID and for two values the app attaches to it: a one-way hash of your account and the name of the frame. We keep the order ID, the frame and the time, to confirm the purchase and handle refunds.
• Rewarded videos are served by Google AdMob. The ad SDK starts only when you tap the video button. Google then receives your IP address, information about the device and the app (including the app set ID) and how you interact with the ad, to serve and measure the ad and to prevent fraud (how Google uses information from apps that use its services). The ads are not personalised and the app does not request the advertising ID. Where the law requires it (for example in the EEA, the UK and Switzerland) the app first shows Google's consent form. When a video is watched to the end, AdMob tells our server, with the one-way hash of your account and a one-time ticket; we count the videos watched for each frame.

10. Data on your phone

Your message history and your account and wallet keys are stored on the phone, encrypted. You can protect access with a PIN, a pattern or a fingerprint. Android (Google) backup never includes your messages or keys; it may hold only a password-encrypted backup file of the earlier app version, if one is still on the phone. You keep the account recovery phrase and the wallet phrase yourself. We cannot restore them for you.

11. Who receives data

We do not sell or rent data. Ads are shown only in rewarded videos you choose to watch (section 9). Data is processed by:

• DigitalOcean, LLC; server in Frankfurt (Germany): server hosting.
• Google (Firebase Cloud Messaging; STUN): notification delivery and call setup.
• Google (Google Play Billing): only if you buy a frame.
• Google (AdMob): only when you choose to watch a rewarded video.
• Reown (WalletConnect): only if you connect an external wallet.
• TronGrid, PublicNode, Blockstream, mempool.space, CoinGecko: wallet requests sent by your phone itself.
• Other users: people who find you see your name, @handle and avatar frame; the people you chose (your contacts by default) see your profile photo; recipients see your messages.
• Public authorities: only where applicable law requires it. We cannot disclose end-to-end encrypted content because we do not have the keys.

12. Legal bases (EEA and UK users)

• Performance of a contract, that is, providing the service: account, message delivery, calls, notifications, purchases of frames.
• Legitimate interests: security, abuse prevention, handling reports, limiting sign-ups.
• Consent: problem and error reports, notifications, external wallets, and (where the law requires it) the storage and access needed for rewarded videos. You can withdraw consent at any time.
• Legal obligations: answering lawful requests.

The server and the providers may be located outside your country. The server is in the European Union (Frankfurt, Germany). The hosting provider DigitalOcean, LLC (USA) processes data under its Data Processing Agreement, which includes the EU Standard Contractual Clauses. Google (Firebase Cloud Messaging) receives only the notification token and the encrypted notification and processes them under its data processing terms, also with the EU Standard Contractual Clauses.

13. Deleting your account and data

• In the app: Settings → Security → Account management → Delete account. The server immediately deletes your profile, name, handle, queued messages, attachments, photos, notification tokens, connections, device keys, avatar frames with their purchase and video records, problem reports, and reports filed by you or about you, and ends all sessions. Groups you created are closed. Then the keys and message history are erased from the phone. The wallet keys are erased from the phone too, but your funds stay on the blockchain: you can recover them only with the wallet phrase. If the phone also holds a hidden account, it is erased from the phone together with the regular one, with its wallets. The phone deletes its data on the server along with it; if that fails, it can be deleted on request without the app (below).
• Without the app: use the form at https://app.skammessenger.com/account-deletion.html or write to skammessenger@gmail.com. Before deleting, we verify that the account is yours: a public handle or an email address alone is not proof. Never send your password, PIN or recovery phrase. Response time: up to 30 days.
• What remains after deletion: an irreversible hash of the public key (so that a deleted account cannot be reused); entries in the history of v2 groups recording that a member with this key left because of deletion (key and time, no name); copies of messages and files already delivered to other people; blockchain transactions; database snapshots until the period in section 5 ends.

14. Your rights

Depending on where you live, you may ask what data we hold about you, correct it (you can change your name and handle in the app), delete it, restrict or object to processing, receive a copy, withdraw consent, and complain to a supervisory authority. Write to skammessenger@gmail.com. We answer within 30 days. We will ask you to prove that the account is yours.

15. Children

SKAM is intended for users aged 18 and over: it includes a crypto wallet and communication with people users find themselves. We do not knowingly collect children's data. If you learn that a child uses an account, write to skammessenger@gmail.com and we will delete it.

16. Security

Data travels only over encrypted connections (TLS). The server runs as a separate user without extra privileges, and its database and files are not reachable from outside. Message and wallet encryption keys never leave your devices. No system is perfectly secure. Report vulnerabilities to skammessenger@gmail.com.

17. Changes

We will announce material changes in the app and, where needed, ask you to accept the documents again. The current version is always published at https://app.skammessenger.com/privacy.html.

18. Contact

Foshchan Yevheniy, Chișinău, Moldova, skammessenger@gmail.com.