Privacy Policy for Us
Last updated: 7 August 2026
Us is a private app for two people. This policy describes exactly what the app
stores, what it cannot see, and what you can do about it. It is written to be
read, not to cover anyone legally.
The short version
Your messages, your daily ritual answers, and anything else you write to each
other are end-to-end encrypted on your phone before they are sent. The server
stores them as ciphertext. We cannot read them. Not because of a policy, but
because the keys never leave your devices.
What is stored on the server
- Your email address and name. Used to sign you in and to show your partner
who they are paired with.
- Your password, stored only as a salted hash. It cannot be reversed.
- Encrypted message and ritual content. Unreadable ciphertext. See below.
- Public keys published by your device so your partner can start an encrypted
session. Public halves only; private keys never leave your phone.
- Which two accounts form a couple, and invite codes, which expire after 48
hours.
- Timestamps of when messages were sent, and which device sent them. Needed
to deliver messages in order.
- A push notification token, if you allow notifications, so the server knows
where to send them.
What is never stored
- The content of your messages or ritual answers in readable form.
- Your private encryption keys.
- Your location.
- Your contacts.
- Your photos or files.
- Advertising or tracking identifiers.
The app requests only three Android permissions: network access, network state,
and vibration for haptic feedback. Camera, microphone, location, contacts and
storage are explicitly blocked.
About the encryption
Us uses the Signal protocol design: X3DH for setting up a session and a Double
Ratchet for messages, built on X25519, Ed25519, HKDF-SHA256 and
XChaCha20-Poly1305.
Practically, this means:
- Each message is encrypted with a key used once and then destroyed. Someone who
obtained a later key still could not read earlier messages.
- The server relays ciphertext it cannot decrypt.
- If you lose your phone, you lose your message history. There is no key
backup and no way for us to recover it, because we never had the keys.
Notifications
Notification payloads are deliberately content free. They say "New message" and
nothing else. This matters because the notification service and Apple or Google
can see the payload in transit, even though they cannot see the message itself.
The app fetches and decrypts the real content on your phone after you tap.
Who else sees anything
- Amazon Web Services hosts the server and database, in the Mumbai region.
- Expo delivers push notifications, and sees the content-free payload and
your push token.
- Apple and Google deliver notifications to your device.
There is no analytics, no advertising, and no third party receives your data for
their own purposes. Nothing is sold.
Deleting your data
Ask, and the account and everything attached to it is deleted: profile, couple
membership, stored ciphertext, keys and push tokens. Deleting an account removes
its half of the couple.
Contact: pataderushikesh@gmail.com
Children
Us is not intended for anyone under 13 and is not directed at children.
Changes
If this policy changes in a way that affects what is collected, the date at the
top changes and the app will say so.