Qevio Privacy Policy
The short version
Qevio is built so that we cannot read what you say or share. Your messages, the photos and videos you send, voice notes, files, calls, stories, your about line and birthday, and your group names and photos are end-to-end encrypted on your phone before they leave it. Only the people you talk to can decrypt them. Not Qevio, not our hosting provider, not Google, not anyone else.
The only things we can read about you are:
- your phone number, which we verify with a one-time code when you sign up;
- the real name you give for your account, which we keep to verify accounts, prevent abuse and help you if you contact us;
- your profile photo, if you set one. Qevio's safety team can see your profile photo to remove illegal or sexual content.
Your profile photo setting (Everyone, My contacts or Nobody) decides which other people can see your photo. It does not hide the photo from Qevio's safety team. Only members of that team can open it, in our admin tool, and every time they do is recorded. When you reinstall Qevio and sign in with your number, your new phone gets your name and this photo back from us to show them again (your about line comes back only from your own backup). If you don't want us to see a picture of you, don't set a profile photo: it is optional.
What we keep, and for how long
| What | Can Qevio read it? | How long we keep it |
|---|---|---|
| Your phone number (verified by code) | Yes | Until you delete your account |
| When you joined; your devices (model, encryption public keys, last active) | Yes | Until you remove the device or delete your account |
| The real name on your account (given at sign-up) | Yes, to verify accounts, prevent abuse and for support | Until you delete your account |
| Your profile photo (a copy without location or other hidden data) | Yes. Qevio's safety team can see it to remove illegal or sexual content. Stored encrypted on our server | While it is your profile photo. Deleted when you change or remove it, when we remove it, or when you delete your account. If someone reported it, we keep it until we have dealt with the report. If the law requires us to keep it for the authorities (for example a sexual image of a child), we keep it until the case ends |
| If we remove your profile photo: a fingerprint (hash) of the picture, never the picture itself | Yes, so the same picture can't be used again (by anyone if it was sexual, violent, hateful or illegal; otherwise on your account) | Until we lift the removal; for a sexual, violent, hateful or illegal picture also after you delete your account |
| Your about line; group names and photos | No (encrypted) | While you use them |
| Your birthday, if you add it (day and month, never the year; from version 1.3.2) | No (encrypted). Only the people you allow in Privacy → Birthday can read it, for their reminders | Until you remove it or delete your account |
| Your reminders and medicines (from version 1.3.2) | No. They are kept only on your phone and in your end-to-end encrypted chats backup | Until you delete them |
| Your privacy settings (for example "last seen: my contacts") | Yes, to apply them | Until you delete your account |
| Which Qevio accounts you added as contacts | Account ids only. Never the names you saved | Until you remove them or delete your account |
| Messages | No (encrypted) | Only until delivered to the recipients' phones (at most 30 days) |
| Photos, videos, voice notes and files you send in chats | No (encrypted) | Only until downloaded by the recipients' phones (at most 7 days) |
| Stories | No (encrypted). Who viewed one is kept as routing metadata and shown only to its author | 24 or 48 hours, as you choose when posting |
| Call records (who called whom, when, audio or video, duration) | Yes. Never the call itself | 7 days |
| One-time sign-up codes | Stored only as a keyed one-way hash | A few minutes |
| How your sign-up code was delivered (WhatsApp, SMS or phone call, and whether WhatsApp delivery failed) | Yes, to deliver codes and prevent abuse | Up to 1 hour (code calls: see the next row) |
| Code calls to your number (the number and the time of each call) | Yes, to limit how many code calls a number can get | 24 hours, also after you delete your account, so the daily call limit cannot be reset |
| Connection logs (account, device, IP address, time) and traffic metadata (who sent to which conversation, when, size, message/media/call). Never content | Yes, encrypted at rest | 90 days, for security, abuse prevention and lawful requests from authorities, then deleted automatically |
Your chat history and media are stored only on your phone. If you turn on backups, an encrypted copy goes to your own Google Drive, locked with a password or recovery key that only you know. We never receive it and cannot open it.
Things you send to Qevio on purpose
Some things you choose to send to us, not to the people you talk to. We can read these, and we use them only for the reason you sent them:
- Support requests (Report an issue, New idea, Other, in the app or on qevio.app): what you write, the screenshots you add (we remove their place and camera details), and, for an issue, your phone model, system version and Qevio version, which you see before sending. Never an IMEI or another device number. Choose Anonymous and our team sees neither your name nor your number; we keep the link to your account only to send you our reply. A request from the website without signing in keeps the e-mail address you give. Deleted with your account, or 180 days after it is solved.
- Reports: when you report a message, a person or a group, your phone sends us the message you report and the few before it (for a group, the last 7 days of it on your phone), together with the reason you pick. Your phone locks them before sending; our server unlocks them only when our safety team opens your report, and they are deleted when the case is closed. The decision and its reason are kept for an appeal. Nothing else of your chats is ever sent.
- The community forum: topics and replies you post are read by every signed-in Qevio user and by our team. They show the first name and initial of your account name. Deleted when you delete your account.
- Signing in on qevio.app: your Qevio number, and a code we send as a message from Qevio to your own Qevio app (never by SMS). We keep the code only as a scrambled check for 10 minutes, and a sign-in cookie for up to 30 days (see Cookies).
- Crash and speed reports: when Qevio crashes or is slow, the app may send what failed with the phone model, system version and Qevio version. No account, no phone number, no message and no address is kept with it. Deleted after 30 days.
- Notices from Qevio: our replies to your requests, update reminders and sign-in codes reach your phone as notifications with their own text (written by us, never anything of yours). Kept up to 30 days for the app’s Qevio chat.
- Your app version: the app tells our server which version and build it is and your phone's system version (for example 1.2.9, build 129, Android 16), so we can remind people whose app is out of date and help when something goes wrong on one kind of phone. Kept with your device; deleted when you remove the device or delete your account.
What we don't do
- No advertising, no analytics, no tracking, no selling or sharing of data.
- No reading of your contacts' names. If you allow contact access, your phone sends only the phone numbers to check which ones use Qevio; we don't store that list.
- No access to your messages for us or for anyone who asks us, because we don't have the keys.
Services we use
- Firebase Cloud Messaging (Google): wakes your phone for new messages and calls. The notification contains random ids and, for a short message, that message still end-to-end encrypted, so it shows at once. Google cannot read it: only your phone can decrypt it.
- Twilio and WhatsApp (Meta): deliver your sign-up code by WhatsApp, or by SMS if you don't use WhatsApp. They see your phone number and the code. On Android the code is handed to Qevio automatically; Qevio never reads your other messages. If you tap "Call me instead", Twilio, our telecom provider, calls your number. The call asks you to press two keys it names and only then reads your code, so the code is never left on voicemail. Twilio processes your phone number and the call record. Nothing is recorded. Numbers that belong to no country (for example satellite phones and international +800/+88x numbers) cannot be used to sign up.
- Google Drive (optional, only if you turn on backups): stores your encrypted backup in your own account.
- TURN relay (our server): helps calls connect through strict networks. It forwards encrypted call data it cannot decrypt.
Requests from authorities
We respond only to valid legal process. We can only provide the data in the table above that we can read: your phone number, the name on your account, your current profile photo, when you joined, your devices, your privacy settings, the account ids in your contact list, call records from the last 7 days, records of the sign-up codes sent to your number (at most 24 hours old), and connection/traffic logs within the retention period. We cannot provide message content, media, calls, about lines, group names or group photos, because we cannot decrypt them.
Your choices
- Delete your account: Settings → Account → Delete my account. We delete everything listed above, except the times of code calls to your number, which are deleted by themselves within 24 hours, the fingerprints of sexual, violent, hateful or illegal profile photos we removed, and a profile photo we must keep for the authorities. Encrypted server backups (kept for up to 7 days) and our hosting provider's backups may still contain your data until they expire; connection logs are kept for their legal retention period.
- Control who sees what: Settings → Privacy (last seen, online, profile photo, about, read receipts, groups, stories, silence unknown callers, disappearing messages, blocked contacts). These settings decide what other people see. Qevio's safety team can see your profile photo whatever you choose.
- Profile photo: setting one is optional. Your phone removes hidden data from the picture (such as the place it was taken) before it is uploaded. You can change or remove your photo at any time in Settings → Profile; we then delete our copy. If our safety team removes your photo, the app tells you why, and you can appeal.
- Verify your chats: compare security codes in a contact's info to confirm that no one is intercepting.
Children
Qevio is not intended for children under 13 (or the minimum age for such services in your country, if higher).
Contact
ECOM Global Investment Ltd, 37 Bridgewater Court, Bath Street, Blackburn, Lancashire, BB2 1UJ, United Kingdom · support@qevio.app. You can also complain to the UK Information Commissioner's Office (ico.org.uk).