WSMsg by White Sun. Last updated: [CONFIRM date].
Draft for legal review. Not yet reviewed by a lawyer. Remove this notice only after review. Items marked [CONFIRM] need a decision by White Sun.
WSMsg is operated by White Sun [CONFIRM legal entity name, registered address]. Contact for privacy questions: privacy@whitesun.mv [CONFIRM address exists].
| Data | Why | How long |
|---|---|---|
| Account record: random WSMsg ID, public keys, creation date, settings such as who may message you | To run your account | Until you delete the account; a bare record is kept up to 30 days after deletion, then purged |
| Phone records: platform (iOS, Android, Huawei), app and OS version, the day you were last seen, an encrypted device name | To deliver messages to the right phone and to protect your account | Until the phone is removed or the account deleted |
| Push address from Apple, Google or Huawei, encrypted on our server | To wake your phone when a message arrives. The notification itself contains no message content or sender | Until you sign out, turn off notifications or delete the account |
| Undelivered encrypted messages | To deliver them when your phone is online | Deleted when your phone confirms receipt, and at most 30 days |
| Encrypted attachments | To let the recipient download them | Up to 30 days from upload |
| Contact requests and invites (invite codes stored only as a hash) | To connect two people | Short-lived; resolved requests are kept for up to 30 days |
| Recovery email, only if you add one: stored encrypted, looked up by a keyed hash | To help you recover your account | Until you remove it or delete the account |
| Reports you send: category, your note, the reported WSMsg ID | To investigate abuse | Up to 12 months after resolution [CONFIRM] |
| Server logs: request times and routes. No message content, no request bodies, authorization headers removed, secret tokens in addresses removed from the web server log | Security and fixing faults | Target 14 days [CONFIRM once log retention is enforced by time] |
| Network address your phone connects from | Rate limiting and abuse prevention | Kept in short-lived counters and in logs for the period above |
| Backups of our database (encrypted) | Disaster recovery | Daily backups for 35 days, monthly for 24 months [CONFIRM]. Deleted data can remain in backups until they expire |
| Administrator audit log | Accountability for our own staff access | 24 months |
Even though content is encrypted, our servers can see that an account exists, when your phone connects, roughly how large encrypted messages are, which account a message is addressed to (the sender is hidden from us for most messages through "sealed sender", but not always), and the network address of your connection. Your internet provider can see that you connect to our servers. We do not claim more protection than this.
Your message history, contacts, safety numbers, downloaded files and keys are stored on your phone in an encrypted database. Blocking someone is done only on your phone and the other person is not told. If you lose your phone and your recovery phrase, we cannot recover your messages or your account keys.
If you report someone, we receive the category and note you write and the WSMsg ID you report. You may also choose to include up to 20 recent messages from that conversation. They are locked on your phone so that only our moderators can open them; the server cannot read them. Files are never included, only their names, types and sizes. We cannot see anything else from your chats. Our moderators use a separate administration system with sign-in by passkey; every action is logged.
We use these service providers to run WSMsg, and they process only the data described here: DigitalOcean (hosting, database, encrypted file storage) [CONFIRM region]; Apple, Google and Huawei (push notification delivery, with no message content); our email provider [CONFIRM] for recovery emails. We do not sell data. We disclose data only if required by law, and we can only hand over what we hold, which is the list above and not message content. [CONFIRM: describe the legal process you will follow and whether you will publish transparency reports.]
[CONFIRM: add the rights and the supervisory authority that apply under Maldivian law, and under other laws if you serve users elsewhere.]
WSMsg is not for children under [CONFIRM age, commonly 13 or 16]. If you believe a child is using it, contact us.
We use end-to-end encryption (the Signal protocol), encryption in transit, encryption of sensitive data at rest, and restricted staff access. No system is perfectly secure. Report security problems to security@whitesun.mv [CONFIRM].
If we change this policy in a way that matters, we will tell you in the app before it takes effect. Previous versions will be kept here [CONFIRM].