Privacy Policy

The essentials

• No account. No phone number, no email address, no address book. A username is all it takes.
• Your messages are end-to-end encrypted. Neither the phones that relay them, nor our servers, nor we can read them.
• No ads, no trackers, no audience measurement. Droplet contains no tools of that kind.
• Without the internet, no server is involved. Phones talk to each other directly, over Bluetooth and Wi‑Fi.
• With the internet, a few servers help find someone, hold a message until it can be delivered, and set up a call. They are named one by one below.

A policy that says “we collect nothing” and stops there doesn’t tell the whole story. What follows explains each exception.

Who is responsible

The app and this site are published by Droplet, an independent project. For any question about this document or your data, write to contact@dropletmesh.app.

Droplet has no data protection officer: the law only requires one beyond a certain scale of processing. The address above is the single point of contact.

What stays on your phone

Your identity is a key pair created on your phone the first time you open the app. The private key never leaves it; it is stored in Android’s key vault (Keystore).

Your messages, contacts, groups, photos and settings are saved in the app’s private storage, which other apps cannot access. They are not encrypted a second time on the phone: protect it with a passcode or fingerprint, and lock your sensitive chats.

The error log is a local file. It is never sent on its own: you decide whether to send it to us, after seeing what it contains.

Depending on your phone’s settings, Android backup may copy app data to your Google account. That copy is Google’s responsibility, not Droplet’s.

What goes through our servers

Droplet’s internet features are on by default; you can turn them off in settings. They rely on three servers, hosted by Railway:

The directory

It lets people find you by your username and wakes up your phone when a message arrives. As long as internet features are on, the app registers your username, your public ID, your public key, your Tor address and a notification token there, then renews this registration every ten minutes. The directory also keeps the public keys that allow an encrypted conversation to be started with you.

When Tor is on, these exchanges go through Tor and the directory doesn’t see your IP address. Otherwise, it sees it, like any web server.

The directory is also used for: the invitation links you share; searching for usernames; reports (the reported ID and the reason chosen); and, if you turn them on, online backup and online mode (described below).

The mailbox

It holds a message for someone who can’t be reached, until they come back. It receives the sender’s ID, the recipient’s ID and the encrypted message, which it cannot open. Photos and videos go through it in pieces, also encrypted. A message is deleted as soon as it is picked up; if it never is, it disappears on its own.

Call connection

It is used to set up a call or a voice room. It sees the IDs of both devices and their network addresses while connecting them. No voice and no images go through it.

Services from other companies

Some features go through services we don’t run. Here is every one of them.

By default, the assistant runs on your phone: nothing you say to it leaves the device. It only goes through Groq if you add a Groq key yourself, which is kept in your phone’s key vault.

What relaying phones see

Without a network, a message hops from Droplet phone to Droplet phone. These phones carry a sealed envelope: they cannot read what’s inside.

To route the envelope, however, they do see: the sender’s and recipient’s (or group’s) ID, the time it was sent, the number of hops already made, the message type and size, and its lifetime if it is disappearing.

Three things are public by nature and readable by phones in range: the statuses you share with “Everyone”, messages broadcast to everyone, and the “I’m safe” signal from the emergency screen, along with your approximate location if you choose to include it.

What you choose to turn on

• Online mode (off by default) tells the directory you’re online, every two minutes while the app is open, and turns on translation and link previews.
• Online backup (off by default) sends a copy of your data to the directory every day, encrypted with a password only you know. Without that password, the copy is unreadable, including to us.
• Backup to a file creates an encrypted file that you can store wherever you like. It doesn’t go through any server.
• Droplet announcements: up to twice a day, the app downloads a short announcements file, signed so it can’t be tampered with. It sends nothing other than the request itself.

What Droplet never asks for

• Your phone number
• Your email address
• Your address book
• Your location, unless you send it yourself
• Advertising or tracking data
• Usage statistics

Droplet makes no automated decisions about you and builds no profile.

Permissions, and why

Each permission can be denied or revoked in Android settings. Droplet keeps working without it; only the feature that depends on it stops.

How long

• On your phone: until you delete a message or a chat, the disappearing message expires, or you uninstall the app.
• In the mailbox: until the message is delivered, or expires.
• In the directory: as long as your phone keeps checking in. A registration that is no longer renewed eventually disappears.
• Online backup: the latest copy, as long as backup stays turned on.
• Call connection and call relays: nothing is kept after the call.

Where these servers are

Railway, Cloudflare, Google and Groq are American companies; their machines may be located outside the European Union. What reaches them is kept to the strict minimum, and messages remain encrypted there.

Your rights

Depending on the law that applies to you (the GDPR in Europe, for example), you can access your data, correct it, delete it, restrict its use, object to its processing and take it elsewhere.

Since there is no account, almost everything is done from your phone:

• Take your data with you: Settings › Back up my identity, including message history if you wish.
• Leave the directory: turn off internet features in settings. Your registration is no longer renewed and disappears.
• Erase everything from your phone: uninstall the app.
• Immediately delete an online backup or a registration: write to us at contact@dropletmesh.app.

If our response doesn’t satisfy you, you can file a complaint with the data protection authority in your country.

Children

Droplet is not intended for children under 13. It doesn’t ask anyone’s age, since it doesn’t ask anyone for anything.

This site

This site uses no cookies, no trackers and no audience measurement tools, and its fonts are hosted with it. The only thing it remembers, in your browser, is the color you chose. Like any site, its host receives your IP address when you open it.

If this policy changes

The date of the last update appears at the top of this page. A change that would alter what our servers see would be announced in the app, not slipped quietly into an update.