This policy describes how Markero Chat collects, uses, stores, and protects your information. By using the service, you agree to the practices described here and to our Terms of Service. Markero is the data controller for the account and service metadata described below. You can contact us at [email protected].
1. Information We Collect
1.1 Account Information
- Username — a public identifier you choose, visible to other users.
- Password hash — cryptographically hashed with Argon2. We never store your plaintext password.
- PGP public key — used by other users to encrypt messages sent to you.
- Encrypted PGP private key — encrypted with a client-only key-wrap secret. We do not hold the plaintext private key or the plaintext key-wrap secret, so we cannot use or decrypt the encrypted key without your password.
- Login TOTP secret — your two-factor authentication secret, encrypted server-side and used only to verify login codes. It is separate from the private-key wrapping secret.
- Recovery codes — cryptographically hashed one-time codes for account recovery.
1.2 Messages and Communications
- Encrypted message bodies — direct messages and group messages are encrypted end-to-end with OpenPGP (Curve25519) before transmission. Private-channel posts use a per-channel AES-256 key that is wrapped to each member with OpenPGP. We store only ciphertext.
- Encrypted files — photos, voice messages, and documents are encrypted before upload and stored under opaque names. File size, MIME type and an optional original filename are stored as metadata so the file can be displayed to the recipient.
- Message metadata — timestamps, sender and recipient identifiers, group membership, read receipts, and delivery status are stored as necessary for the service to function.
- Private channels — channel posts and files are encrypted end-to-end with a channel key. We store channel names, descriptions, avatars, member and admin lists, invite metadata (creator, expiry, join counts), message timestamps and delivery information. Channel keys are stored only as ciphertext wrapped to member public keys; we cannot decrypt them.
1.3 Usage Data
- Online status — your last-seen timestamp is visible to users you communicate with.
- Typing indicators — relayed transiently and not retained.
- Call metadata — duration, timestamps, and status (ringing, answered, missed) for voice calls.
- Session and network data — clearnet sessions store the IP address and user agent, plus creation and last-seen timestamps. Onion sessions store the string “tor” instead of an IP. Rate-limit counters use keyed hashes rather than raw IP addresses. Session records expire after 7 days, or 3 days of inactivity.
- Profile photo — if you choose to upload one.
- Notification tokens — Firebase Cloud Messaging or Web Push endpoint if you enable notifications.
- Link previews — generated transiently when you request a preview and kept in memory only; not written to the database.
- Premium order record — if you buy Premium (badge, larger uploads, more storage and higher channel limits): order id, plan, amount, coin, and payment status, linked to your account. No card details or identity documents are involved.
- Payment processing — crypto payments are handled by NOWPayments; we only receive the order status and transaction reference.
1.4 Information We Do NOT Collect
- Your real name, email address, or phone number.
- Your physical address or precise location data. We do process IP addresses as described above; we do not use them to build location profiles.
- Contact book or address book information.
- Device identifiers (IMEI, MAC address).
- Browsing history or cross-site advertising profiles.
- Advertising identifiers or interest profiles.
- Decrypted message or file content.
Public marketing pages may use a cookieless, aggregate visitor counter; it is not used to profile you. We do not use IP addresses for advertising, profiling or cross-site tracking.
2. How We Use Your Information
- To provide the service — deliver messages, manage group chats, facilitate voice calls, and maintain your account.
- To enforce security — authenticate users, prevent abuse, and block unauthorized access.
- To process push notifications — deliver real-time message and call notifications.
- To maintain and improve — diagnose technical issues and monitor server performance.
We do not use your data for advertising, profiling, training machine learning models, or selling to third parties.
Where the GDPR applies, our legal bases are: performance of our contract with you (providing messaging, groups, private channels, calls and storage); our legitimate interests in security, abuse prevention and service reliability; compliance with legal obligations; and your consent for optional features such as push notifications, which you can withdraw at any time.
3. Data Sharing and Disclosure
We do not sell, rent, or share your personal information with third parties. Limited disclosure may occur in these circumstances:
- GIPHY — GIF search queries are sent to GIPHY's API. Their privacy policy applies to those queries.
- NOWPayments — optional Premium purchases are processed by NOWPayments. We share the order reference and amount with them; they return the payment status. No account data or message content is involved.
- Cloudflare — edge delivery, security and, on public clearnet pages only, cookieless aggregate analytics. It processes request metadata such as IP address and user agent to deliver and protect the site. It is not used on the onion service.
- Cloud infrastructure — our hosting provider has access to raw server data but is contractually prohibited from accessing it.
- Legal compliance — we may disclose information if required by a valid legal order. Due to zero-access encryption, we cannot provide decrypted message content from stored data.
4. Data Retention and Deletion
- Messages and files are stored until you delete them.
- Account deletion removes your direct messages, group messages, files, group memberships, and personal data within 24 hours. Private-channel posts and files published by a channel owner or admin are retained as part of the channel record; if that account is deleted, the channel is locked and the posts are attributed to a removed admin. Other members can leave the channel, and the channel can be deleted by its owner or staff.
- Application request logs are minimized, exclude client IP addresses, request paths, user agents and referers, and are retained for up to 3 days for security and operations. Markero access logging is disabled. Logs do not contain message bodies, passwords or private keys.
- Database backups are retained for 7 days.
- Session cookies expire after 7 days, with a 3-day idle limit; active use refreshes the window.
5. Data Security
- End-to-end encryption with PGP (Curve25519).
- Optional two-factor authentication (TOTP) available for all accounts and strongly recommended. You can skip it at signup and enable it later in settings. TOTP protects sign-in; it does not encrypt or unlock the private key.
- Passwords hashed with Argon2id.
- IP-based rate limiting with keyed counters against brute-force attacks. Clearnet session records store IP address and user agent; onion sessions store “tor” instead of an IP.
- Session cookies are Secure, HttpOnly, and use server-side tokens.
- Strict Content Security Policy headers.
6. Your Rights
Depending on your jurisdiction, you may have the right to access, rectify, delete, restrict, object to, or export your personal data. You can manage most of this directly from the application settings, including deleting your account and its associated data.
EU/EEA and UK (GDPR): you have the right to access your data, correct inaccurate data, erase data, restrict or object to processing, receive a portable copy, and withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority.
California (CCPA/CPRA): you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights. We do not sell personal information and do not share it for cross-context behavioural advertising. You may use an authorised agent to submit a request where the law allows.
To exercise a right that is not available in the app, contact [email protected]. We may need to verify your identity and will respond within the time required by applicable law (generally 30 days). Because Markero does not require an email address, verification may involve confirming control of the account.
7. International Data Transfers
Our servers are located in the European Union. Where personal data is transferred outside the EU/EEA, we rely on applicable adequacy decisions, standard contractual clauses, or another lawful transfer mechanism. You can contact us for more information about the safeguards used.
8. Children's Privacy
The service is not intended for children under 16, or under the age of digital consent in their country if higher, and in any event not under 13. We do not knowingly collect personal information from children below those ages. If you believe a child has created an account, contact [email protected] so we can investigate and delete it. US users should note that the Service is not directed to children under 13 under COPPA.
9. Cookies and Local Storage
- Session cookies — essential for authentication. Strictly necessary.
- Browser storage — the decrypted private key is kept in the current tab's session storage. To keep you signed in for up to 3 days of inactivity, an encrypted copy is stored in local storage using a non-extractable device key kept in IndexedDB; the plaintext key is never written to local storage. The remembered copy is cleared on logout, session expiry, or account deletion. Drafts use session storage; preferences use local storage. Plaintext messages are kept in memory, not persisted. This data never leaves your device unless you send a message.
- Channel keys — private-channel keys are stored locally, encrypted with the same non-extractable device key used for the remembered private key. Invite links carry the channel key in the URL fragment; the fragment is never sent to our servers, but anyone who has the full link can use it until it expires or is revoked.
- No tracking cookies, analytics cookies, or advertising cookies are used.
- The public marketing pages (landing, blog, changelog, security) may use a cookieless, privacy-first visitor counter to understand which pages are useful. It sets no cookies, does not fingerprint your device, and does not track you across other websites.
10. Changes to This Policy
Material changes will be communicated through the service at least 7 days before they take effect. Your continued use after changes become effective constitutes acceptance.
11. Contact
For privacy-related inquiries: [email protected]
You also have the right to lodge a complaint with your local data protection supervisory authority.