Privacy in the app

1. Who is responsible

The controller for the processing of data in the app “Silvra – Gruppen & Vereine” (Android, package name net.silvra.messenger) and on its server app.silvra.net is:

Silvra
Email: info@silvra.net

Silvra is a non-commercial project, see the legal notice. The website silvra.net has its own privacy policy.

2. The essentials

• You sign in with your email address. You do not need a phone number.
• In encrypted chats, only the members can read messages and attachments. Our server stores them only in encrypted form.
• Our server still sees some things: who writes to whom and when, profile and group pictures, group names, polls, events and reactions. Sections 4 and 5 say exactly what.
• No advertising, no tracking, no analytics or crash reporting services, no selling of data.
• Our server is in Germany. Google (push notifications), Resend (emails with the sign-in code) and Cloudflare (relaying calls) work on our behalf.
• You can view and export your data in the app and delete your account there at any time.

3. Account and sign-in

For your account we store your email address and your display name. Optional: a profile picture, profile text, status and a phone number. Others can see a phone number in your profile, and anyone who has it in their address book can find you through contact search (section 8). We also store the language of the app so that notifications reach you in your language.

To sign in, we email you a six-digit code. It is valid for ten minutes. We store it only as a check value (hash) and delete the entry, email address included, after one day.

The legal basis is the contract for using Silvra (Art. 6(1)(b) GDPR).

4. Messages and attachments

Silvra encrypts chats with the open standard MLS (Messaging Layer Security, RFC 9420). The keys are created on your device and never leave it. In an encrypted chat, our server stores messages, pictures, videos, voice messages, files and shared locations only in encrypted form. It cannot read them.

As long as encryption is not yet set up in a chat, for example because the other side has not yet published keys or setting it up failed, messages go to our server unencrypted. The app shows this in the chat. The server can read these contents, and the search in the app searches them there.

For chats to work, the server sees for every message who sent it to which chat and when, what kind it is (text, picture, file and so on), what it replies to, whether it was edited, forwarded, pinned or deleted, and how far each member has read. For calls it adds a note with the type and length of the call to the chat.

Messages stay on the server until they are deleted: by you for everyone (we then empty the content), with the chat or group, for disappearing messages when the set time runs out (within 15 minutes after that), or with your account.

Legal basis: Art. 6(1)(b) GDPR.

5. What is not end-to-end encrypted

Our server can read the following, in encrypted chats too:

• your profile: display name, profile picture, profile text, status and, if given, phone number;
• groups: name, description, picture, members, roles and settings;
• polls and votes, events and responses;
• reactions to messages;
• when you were last online. Others see this only as long as you do not turn it off in the privacy settings;
• posts, comments and reactions in the “Aktuelles” (news) section.

Link previews: when you send a link, our server fetches the linked page to show a title and picture for the preview. It learns the address in doing so, from encrypted chats too. The linked website sees our server’s address, not yours.

6. Push notifications

So that messages and calls reach you while the app is closed, Silvra uses Firebase Cloud Messaging by Google (Google Ireland Limited, Ireland). For this we store a push token, an identifier Firebase assigns to your installation of the app. Every notification passes through Google, with the name of the sender or the group as its heading. As text, encrypted chats show only that there is a new message; unencrypted chats show the beginning of the message (up to 100 characters).

Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection (Art. 45 GDPR).

We keep the list of notifications in the app for 90 days. You can turn push notifications off in your phone’s settings. Legal basis: Art. 6(1)(b) GDPR.

7. Calls

Voice and video calls are encrypted (DTLS-SRTP), with classical methods. Our server arranges the connection and learns in doing so who calls whom and when. Where possible, the devices connect directly. The other side then sees your device’s IP address.

If no direct connection is possible, a relay service by Cloudflare (Cloudflare, Inc., USA) forwards the encrypted data. Cloudflare sees the IP addresses but not the content. Cloudflare is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR.

8. Finding contacts (optional)

Only when you start the contact search does the app read the phone numbers in your address book, turn them into check values (SHA-256) on the device and send only these to our server. The server compares them with the numbers in other people’s profiles and sends you the matches. It does not store the check values. They are not anonymous, though: phone numbers can be worked out from such check values with some effort.

Anyone who turns contact search off in the privacy settings cannot be found this way. Legal basis: for you, Art. 6(1)(b) GDPR; for your contacts’ numbers, our and your legitimate interest in finding people you know on Silvra (Art. 6(1)(f) GDPR).

9. Camera, microphone, photos, location

The app uses the camera, microphone, photos, files and location only when you record or share something, and only with the permission you give it in Android. It sends a location only when you share it in a chat. The app can turn voice messages into text. This happens on your device only.

10. Sessions, security and logs

For every sign-in we create a session with the IP address, device name and times. You see your sessions in the app under Profile → Active devices and can sign out single ones. We delete ended sessions after 30 days.

An audit log records security-relevant events: sign-ins with the device name (without IP address), sign-outs, account deletions and actions by moderators. We delete entries after twelve months.

Our server logs requests with method, path, status and duration, without IP addresses and without search terms. We delete these entries after five weeks. In front of the server is a reverse proxy. It logs access with the IP address, time, path and status so that we can detect attacks and block suspicious addresses for a while. We delete this log after 14 days and the list of blocks after five weeks. Rare error messages from the reverse proxy, for example when the server does not respond, also contain the IP address and the requested address; they are part of the server log and disappear with it after five weeks.

Legal basis: our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

11. Reports and moderation

You can report messages, posts, comments, groups and people. We then store who reported what and when, the reason, your note and a copy of the reported text. For messages from encrypted chats this copy is encrypted; we cannot read it. Silvra’s moderators see reports and can remove content and suspend accounts. Reports are kept even if the reported content or an account is deleted, as long as we need them to resolve the matter and as evidence.

Legal basis: our legitimate interest in protecting users and enforcing the rules (Art. 6(1)(f) GDPR), and where a law requires it, Art. 6(1)(c) GDPR.

12. What we do not do

Silvra shows no advertising, uses no advertising ID and includes no analytics, tracking or crash reporting services. We do not sell data and do not build profiles. Silvra has no servers running artificial intelligence.

13. On your device

Decrypted messages, your keys and settings are stored in the app’s storage on your device. The app takes part neither in the Android backup nor in moving to a new phone. That is why a new device cannot read older messages. With the app lock you protect access with biometrics or the device PIN. Android does the check; the app only learns the result.

14. Who receives data

• Other members: what you send to a chat or group is seen by its members. Others see your profile as you set it in the privacy settings.
• Our server is in Germany and we run it ourselves. No hosting provider is involved.
• Service providers working on our behalf (Art. 28 GDPR): Google for push notifications (section 6), Cloudflare for relaying calls (section 7) and Resend, Inc. (USA) for sending the emails with the sign-in code. Resend sends through servers in Ireland and stores data about sending in the USA. Resend is certified under the EU-US Data Privacy Framework; the contract also contains the European Commission’s standard contractual clauses.
• Authorities receive data only where a law obliges us to provide it.

15. How long we keep data

Account and profile

until you delete the account

Messages and attachments

until they are deleted (section 4)

Sign-in codes

one day

Ended sessions with IP address

30 days after signing out

Notifications in the app

90 days

Audit log

twelve months

Push token

until the device signs out or Google declares it invalid

Server log

five weeks

Reverse proxy log with IP addresses

14 days

List of blocked IP addresses

five weeks

Backups

the seven most recent nightly backups, usually one week

16. Deleting your account

You can delete your account in the app at any time under Profile → Delete account, or by email without the app. What is deleted and what remains is described on the page Delete your account.

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). Much of this works directly in the app under Profile: view my data, export data (as a JSON file) and delete account. For anything else, write to info@silvra.net.

You can also lodge a complaint with a data protection supervisory authority, for example in the country where you live.

18. Children and young people

Silvra is meant for people aged 13 and over. If you are under 16, please talk to your parents before you use Silvra.

19. Security

All connections between the app and the server are encrypted with TLS. Chats add end-to-end encryption with MLS. Its key exchange combines a classical and a post-quantum method (X25519 and ML-KEM-768); signatures are classical. The server can only be reached through the reverse proxy, limits requests and blocks suspicious addresses.

20. Changes

If the app changes so that this policy is no longer accurate, we will update it. The version on this page applies; its date is at the top.