Privacy policy

Headmates is an app for plural systems. This policy describes exactly what the app and its relay service do with information.

The short version

• There are no accounts. You never give us a name, email address or password.
• Everything you create is stored on your own device, in an encrypted database.
• When you connect with a friend, what you share with them is encrypted on your device and can only be read on theirs. Our relay passes it along without being able to read it.
• We do not show adverts, sell data, or use analytics.

What stays on your device

Members and custom fronts, groups, custom fields, front history, system chat, member mail, journal, polls, friend connections and friend messages are stored only on your device. The database is encrypted with a key held in the device's hardware-backed keystore. The app turns off Android's cloud backup for its data, so this database is never copied to Google Drive.

A member's inbox can be given a PIN. Messages for that member are then encrypted a second time, and the PIN is never stored. If the PIN is forgotten, those messages cannot be recovered by anyone.

What is shared with friends

Nothing is shared until you add a friend. Each member decides which members of each friend's system can see them: all of them, none, or only some. New members start hidden unless you change that in the app's settings. A member of theirs who can see one of your members receives that member's name, pronouns, role, colour, picture, description, and any custom fields you marked as shared, and can message them. A member hidden from everyone in a friend's system is never sent to that friend.

Which of their members can see which of yours is enforced by their app, not by encryption. Their whole system shares one device, and that device receives everything shared with any of their members, so anyone in their system with access to the phone or its data could see members shared with any one of them, and who can see whom.

If you turn on front sharing for a friend, each of their members sees who is fronting only among the members they can see. Fronting never makes a member visible to anyone.

Some things make a member visible to more of a friend's members:

• Writing to one of their members who can't see you makes you visible to that member. The app asks first.
• Sending a notice to a friend's whole system makes you visible to all of their members. The app warns you, unless you chose not to be warned again for that friend.

Friends keep their own copy of what you shared with them. Hiding a member or removing a friend stops anything further being sent; it cannot delete what is already on their device.

"Seen" receipts are off unless you turn them on for a friend. A receipt never says which member read a message, but a message written to one member that shows as seen tells the sender that member read it.

Your system can mute notices from one of a friend's members by majority vote. Muted notices still arrive, without a notification. The friend is not told.

Group chats

A group chat can include members of several systems, including systems that aren't friends with each other. Inside a group, everyone in it sees every other participant's name, pronouns and colour, whatever their visibility outside the group, and everyone sees everything said there after they joined. Someone can only be invited by a participant who can see them, and each person decides for themselves whether to join.

Each group has its own encryption key, created on the device that starts it and passed only to the people invited. An invitation travels over the inviter's existing encrypted connection; after that, each system in the group has its own mailbox on the relay for the group. The relay sees these mailboxes the same way as any other: random identifiers and encrypted data, never the group's name, members or messages.

Everyone in a group keeps their own copy of what was said while they were in it. Leaving a group stops anything further reaching you; it cannot delete the copies others already have. A member whose inbox has a PIN has their copy encrypted under that PIN; the others' copies are unaffected.

What the relay service can and cannot see

Devices exchange data through a relay service at relay.headmates.app, run on Cloudflare.

The relay cannot see: any of your content, your system's or members' names, who a message is for, or who your friends are. All of that is encrypted before it leaves your device, with keys that exist only on your device and your friend's.

The relay can see, and stores for as long as needed to deliver it:

• Random mailbox identifiers. They are not linked to any identity.
• Encrypted data waiting to be collected, and its approximate size. Sizes are padded to fixed steps.
• When data arrives and is collected.
• The IP address of a device while it is connected. The relay uses it only to limit abuse and does not log it. Cloudflare, which hosts the relay, handles IP addresses as part of carrying the traffic.
• If push notifications are set up: an anonymous push token for your device, which is the same across your mailboxes.

Encrypted data is deleted from the relay once your device has collected it, and after 30 days if it never is. A mailbox that has not been used by its owner for 90 days is deleted. Invite mailboxes are deleted after one day.

Push notifications

If push notifications are set up, the relay asks Google's Firebase Cloud Messaging to wake your device when something arrives. That wake-up contains no content. Google can see that a wake-up was sent to your device and when. The notification you see is created on your device after decryption.

Importing and backups

Importing from another app reads the file on your device; nothing is uploaded. If you choose to download member pictures from links in a PluralKit export, your device contacts the websites those pictures are stored on, which reveals your IP address to them.

A backup file is encrypted with a passphrase you choose. It contains everything on the device, including your friend connections. Keep it safe: anyone with the file and the passphrase can read it.

Deleting your data

Uninstalling the app deletes everything on your device. Removing a friend deletes your mailbox for them from the relay. There is no server-side profile to delete, because we do not hold one.

Children

The app is not directed at children under 13.

Contacting us

If you email support@headmates.app, we receive your email address and whatever you write. Our mail is hosted by Proton Mail, which stores it encrypted so that Proton cannot read it once it has arrived. Unless you also use Proton Mail or send with PGP, your message is protected by standard encryption while it travels but is not end-to-end encrypted, so please don't include anything about your system that you wouldn't want sent by ordinary email. We use your message only to reply to you, never add you to a mailing list, and delete our correspondence once it's no longer needed.

Changes and contact

Changes to this policy will be published at this address. Questions: support@headmates.app.