Svaya Privacy Policy
Svaya is a messenger for small private groups ("gardens"). It is built so that we, Labham, never receive your messages, your contacts or an account for you, because none of those exist on any server.
What stays on your device
- Your identity is a cryptographic key pair created on your device. The private key stays in your device's secure storage (the iOS Keychain or the Android Keystore). There is no username, password, phone number or email. Svaya shows it to you as 24 recovery words, which bring you back on a new phone; only you hold them. If backup is on, a copy of the key also goes to your own iCloud Keychain (iPhone) or Google's Block Store (Android), which Apple and Google encrypt end to end, so a new phone on the same account can restore without the words. Labham never receives it.
- Your gardens, member lists, messages and photos are stored only on your device.
- Your display name and emoji are stored on your device and shared only with members of your gardens.
Backups
- Backup is on by default and goes only to your own cloud: your iCloud Drive on iPhone, your Google Drive on Android (and on iPhone if you choose). Labham runs no backup storage and never receives a backup.
- Everything is encrypted on your device, before it leaves, with a key derived from your recovery words. Apple and Google store files they can't read: they see only how many there are, their sizes and when they change.
- You choose how often it runs, can turn it off, and can delete messages and photos from your phone, or from your phone and your backup. Deleting removes your copies; members of your gardens keep theirs.
- Deleting your identity also deletes your backup and the key copy in your iCloud Keychain or Block Store.
Joining a garden
- An invite code holds the garden's name, a random garden identifier, the public key of the garden's creator, and the name and public key of the person showing it. It works once and expires after 24 hours.
- Scanning it sends a join request, with your display name, emoji and public key, to the garden's members. A member decides whether to let you in. Until then you receive nothing from the garden.
- The person who created a garden can remove members. A removed member keeps what they already received but can't read anything sent afterwards.
What travels, and who can see it
- Messages and photos are end-to-end encrypted: only members of the garden can read them. They travel between members' devices, and a member's device may pass encrypted messages on to other members of the same garden. Before a photo is sent, it is re-encoded on your device, which removes its location, camera details and capture time.
- Signalling server. To connect, devices exchange connection details through a relay Labham runs on Cloudflare Workers. It sees network (IP) addresses, timing, a garden's random identifier and members' public keys. It never sees message content. It forwards and forgets: it keeps no record of gardens, members or connections.
- Relay server (TURN). When two devices can't connect directly, often when both are on cellular, Cloudflare's TURN service forwards the encrypted data. It can't read it. It sees the two devices' network addresses, timing and data volume.
- Address discovery (STUN). Devices ask Cloudflare's STUN server for their own public network address. It sees your IP address at connection time.
- Notifications. So that you can receive a message while Svaya is closed, the sender's device asks a relay Labham runs on Cloudflare Workers (wake.svaya.app) to wake you. The request carries the already encrypted message and your device's push token. The relay hands both to Apple (APNs) or Google (Firebase Cloud Messaging) for delivery, then forgets them: it stores nothing and keeps no logs. Apple and Google see your push token and that a notification was sent, not what it says. Your device decrypts the message itself. Your push token is shared only with members of your gardens, inside an encrypted message.
- Nearby phones (Bluetooth). When there is no internet, Svaya phones nearby can carry encrypted messages for one another over Bluetooth. A phone that carries a message for a garden it isn't in can't read it.
Labham operates no servers of its own; the services above run on Cloudflare's global network, with request logging turned off.
AI catch-up
Catch-up summaries are generated either on your device (Apple Intelligence on iPhone, Gemini Nano on Android) or on the device of a member of the same garden who offers it (for example, their Mac). The request carries only a time range, never your messages; the member's device summarizes its own copy. The summary is sent only to you. No message is ever sent to a cloud AI service.
Reports
We can't read your messages. If you report one, you email us the message you chose, the sender's public key and the time. That is the only message content we ever see. We reply with how to block the sender, leave the garden, or ask its owner to remove them; we hold no accounts, so we can't suspend anyone. Where the law requires it, we pass a report to the authorities. We delete reports once they're resolved, unless the law requires us to keep them.
What we don't do
No analytics, advertising, tracking, contact upload or sale of data. The iPhone app contains no third-party code besides the open-source WebRTC library; if you turn on Google Drive backup on iPhone, it talks to Google directly with your permission. The Android app also includes Google's Firebase Cloud Messaging, used only to deliver the notifications described above; Google may process the device identifiers it needs for that. It also uses Google Play services to back up to your Google Drive and keep the key copy in Block Store.
Deleting your data
Settings → Delete identity and all data erases your key, gardens, messages and photos from your device, deletes your backup from your iCloud or Google Drive and the key copy kept for restoring, and tells your gardens you left. On Android it also deletes the device's Firebase notification token and installation ID. Because we hold no copy, there is nothing further for us to delete. Messages you already sent remain on other members' devices, as in any messenger.
Children
Svaya is not directed at children under 13, and its terms require users to be 13 or older.
Changes and contact
We'll update this page and the in-app terms if anything here changes. Questions: support@svaya.app