Privacy policy

What we do not ask for, what the server actually sees, how long it keeps it, who else is involved, and how to delete it.

Last updated: 9 October 2026

This page is written to be checked, not to be believed. Every sentence describes what the software does, not what we intend: where we say «the server cannot», it is because it does not have the keys, not because we decided not to look. It covers the Claspet apps for iPhone, Mac and Android, the api.claspet.com server and this website. The Italian version is the original; this translation is provided for convenience.

Who processes the data

The data controller is Interfibra S.r.l., Contrada San Giovanni in Golfo 207/E, 86100 Campobasso (CB), Italy. For questions and to exercise your rights, write to claspet@interfibra.it; phone +39 335 736 7638. We have not appointed a data protection officer: given our size and the kind of data we process, the law does not require one, and the same mailbox answers.

What you need to open an account

A display name that you choose and that can be a nickname; a username drawn at random by the app (three groups of four characters, for example kbdf.7x2m.9qrt); a random identifier generated by the app; your device's public keys. Nothing else.

• No phone number.
• No email address.
• No surname, no date of birth, no ID document.
• No access to your address book: the app neither asks for it nor reads it, so the list of people you know never leaves your phone.

There is no search by name and no user directory. People get in touch through an invitation, a code to scan or nine digits read aloud: whoever has not received one of these from you cannot find you.

What the server cannot read

The text of messages, photos, videos, files, voice messages, shared locations, polls, group names and the list of group members. Audio and video calls are end-to-end encrypted.

The keys that open all of this are created on the device and do not leave it. There is no copy on the server, there is no key of ours that opens your conversations, and we cannot add one without your phone noticing: that is what the transparency log described below is for.

What the server knows

This is the part most privacy policies leave out.

• That an account exists with that username and those public keys, since when, and which devices are linked to it.
• Your display name. It travels inside the public key packages your phone leaves on the server so that others can start a conversation with you or add you to a group: the server can read it, and hands it to whoever requests those packages for your account. People who receive an invitation or a group link from you see it too.
• When one of your devices is connected, and from which network address.
• That messages are waiting for a given recipient, their size (rounded to bands) and when they arrived.
• Who sent it, when the message travels over the direct connection. Claspet has two delivery routes. On the sealed one the sender is encrypted and the server does not see it. On the other, the connection the app keeps open while it is in the foreground, the sender is written in clear on the envelope, which stays queued until the recipient confirms it, and for thirty days at most.
• Encrypted attachments, which to the server are meaningless blocks of bytes. Their owner is recorded with a derived code, not with your account.
• The tokens Apple and Google use to wake up your app (see «Push notifications»).
• The reports you send or receive (see «When you report someone»).
• If you turn on recovery, an encrypted deposit of your identity (see «Recovery»).

The network address is used to limit abuse, for example to stop someone from opening thousands of accounts. The messaging service keeps it in memory and does not write it to its database; like on any website, however, it ends up in the web server's technical log, which is rotated and kept for no more than fourteen days. Since 5 September 2026 the machine's system log no longer records when a device connects and disconnects: those lines are switched on only to track down a fault, and then switched off again.

Push notifications go through Apple and Google

To let you know something arrived while the app is closed, the server sends a notification through your phone's system service.

• iPhone: through Apple (APNs). The notification contains a fixed text, «New message» (in Italian), and a random identifier of the queued message, used to avoid showing the same notification twice. It does not contain the message or the sender's name: the real text is decrypted on the phone. Calls use the same service in its form for calls (VoIP).
• Android: through Google (Firebase Cloud Messaging), since 28 September 2026. The notification contains a single word, «sveglia» (wake up), and nothing else: no message, sender or account identifier. The Android app contains Google's library that receives these notifications and which, in order to work, registers the installation with Google; it requires Google Play services. It does not contain Google Analytics, Crashlytics or any other analytics tool.

Apple and Google therefore see that there is a notification for a given device and when. That is true for any app that sends notifications and we cannot avoid it; all we can do, and we do it, is put nothing inside.

Calls

A call first tries to connect the two devices directly: in that case each one sees the other's network address, as in any direct call over the internet. If the direct route does not open, the call goes through one of our relays (TURN), on the same machine as the server, which sees the network addresses of both sides but not the content, which stays encrypted. The relay logs errors only.

Things that happen on your phone

• Voice message transcription: done only on the device, with the system's speech recognition in on-device mode. The audio goes neither to us nor anywhere else.
• Link previews: when you send a link, your phone downloads the preview from the website, which therefore sees your network address as if you opened it; the recipient does not contact the website.
• Location: on iPhone you can send your location, once, as an encrypted message. Maps are Apple's, which receives the area being displayed in order to draw it. The app does not track your location over time, and the Android app does not ask for location permission.
• Camera and microphone: on iPhone the camera is used only to scan codes; the microphone for voice messages and calls. Only when you use them. You pick the photos and files to send one by one, without giving the app access to your library.
• Backups: on iPhone, the app's automatic backup is encrypted and goes into the phone's backup (iCloud too, if you use it); the key that opens it stays on the phone and does not go to iCloud. On Android the app does not make copies in Google's cloud.

When you report someone

You can report a contact from the app. The report reaches us with the identifier of your account and of the reported one, the reason you write and, only if you choose so, the last messages you received from that person (never your own), up to twenty. Those messages leave the encryption: we read them in clear, and that is the only way we can check what happened. We use them only to handle the report and, where the law requires it, to pass them on to the authorities.

When a report arrives the server sends us an email at claspet@interfibra.it saying who reported whom, when and the reason. The attached messages are not in the email: they can only be read on the server.

Reports currently have no automatic deletion and are not deleted together with the account: we keep them as long as they are needed to handle the case and to defend ourselves against claims. You can ask us to delete the ones you made by writing to claspet@interfibra.it. Blocking a contact, on the other hand, stays on your phone only: the server does not know whom you blocked.

Recovery (optional)

If you turn it on, the app gives you a re-entry sheet with a code and a phrase, for you to keep. The server holds an encrypted deposit containing only your identity (the device keys, the username), not your messages or contacts. The key that opens it can only be obtained with the phrase and with the answer of three «custodians», three separate servers that cannot open it on their own: custode1.claspet.com on the server machine at Hetzner, and custode2 and custode3 on two machines run by Interfibra. Each custodian keeps an anonymous code, a key of its own and how many attempts were made, and sees the network address and time of whoever tries to get back in. All three machines are administered by us: it is a protection against someone trying to guess the phrase, not against whoever runs the service.

How long

• Messages not yet delivered: thirty days at most. Once delivered and confirmed, they leave the queue immediately.
• Encrypted attachments: until the recipient has downloaded them, and in any case no more than thirty days. People with more than one linked device are an exception: there the attachment waits for the deadline, because the other device must be able to open it too.
• Codes to link a device and dictated nine digits: a few minutes.
• Web server technical log: up to fourteen days.
• Server backups: the database is copied twice a day and each copy is kept for about seven days, on the server and on an Interfibra computer. A deleted account can therefore remain in those copies for up to seven days, until they are replaced.
• Account, public keys, display name: until you delete the account.
• Reports: see above.

Whom we share data with

There is no advertising, no profiling, no analytics inside the app, and we sell nothing to anyone. The only providers involved are:

• Hetzner Online GmbH (Germany), which hosts the server, the call relay, the first custodian and this website;
• Apple, for notifications on iPhone and Mac, maps and app distribution;
• Google, for notifications on Android and distribution of the Android app.

Apple and Google may process notification data in the United States as well; the transfer relies on the safeguards provided by the European regulation (the EU-US Data Privacy Framework, to which both companies adhere, and standard contractual clauses). We hand data to an authority only when the law requires it, and we can only hand over what exists: the list above, and nothing more.

Legal basis

• Running the service you asked for (account, delivery, notifications, recovery): performance of a contract, Article 6(1)(b) GDPR.
• Protecting the service and people from abuse (limits per network address, technical logs, handling of reports, backups): legitimate interest, Article 6(1)(f).
• Answering requests from authorities: legal obligation, Article 6(1)(c).

Deleting your account

In the app: Settings, Account section, «Delete account…», then type the confirmation word, because it cannot be undone.

Deleting removes from the server the account, the public keys, the key packages with the display name, the device list, the notification tokens, the queued messages, the attachments and the recovery deposit. On the phone it deletes the local archive and the keys. If the network does not answer, the app stops and deletes nothing locally: better to try again than to end up with an empty phone and a live account.

What remains: the username with its public key and the date, in a list of names that can no longer be assigned and in the transparency log below, so that nobody else can take your name and pose as you; reports; on the separate custodians, the anonymous code of the recovery enrolment, which opens nothing without the deposit; backups, for seven days at most. We cannot remove messages you already sent from the phones of the people who received them: those copies are theirs, not ours.

The transparency log

There is a public, append-only log that associates each username with the public key announced at a given time. It exists to prevent us from secretly replacing someone's key with another one in order to read their messages. The app checks it for every new contact and checks again that the history of that name is consistent with what it saw before: a key replaced in secret makes it stop.

What it does not do yet. The app contains an auditor's key and verifies its signatures: if the root signed by the auditor and the one served by the server differ, sending stops. But today the auditor runs on the same machine as the server, with a separate user and keys: a real defence against a service that goes wrong or is compromised on its own, not against whoever administers the machine. We would notice a server that changes its mind, or one that tells different stories to different people; we would not notice someone who controls the whole machine and lies consistently from the start to a newly installed device. Until the auditor is hosted by a third party, that is the actual guarantee.

That log cannot be rewritten: if entries could be removed, it would no longer prove anything. It contains no messages, contacts, network addresses or anything else revealing whom you talked to.

Your rights

You can ask us to access your data, correct it, delete it, restrict its processing, receive it in a readable format, or object to processing based on legitimate interest, by writing to claspet@interfibra.it. We answer within one month. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the country where you live.

To be honest: for most data we cannot help you, because we do not have it. We cannot hand you your messages, because we cannot read them; we cannot tell you whom you talked to, because we do not know. To show that an account is yours we will ask you to write to us from the app («Settings», «Report a problem») or to give us the username: we have no other way to recognise you. Deletion you do yourself in the app, immediately.

Children

Claspet is for people aged at least thirteen, or the higher age that the law of your country requires to use an online service on your own; below that age the consent of a parent is needed (see the Terms of Use). The app does not ask your age, because it asks for nothing: if we find an account belonging to a younger person without that consent, we close it.

If this policy changes

The date at the top says when the latest version was written. If something substantial changes, and in particular if the server starts knowing something it does not know today, we will say so inside the app, which will ask you to read it again, and not only here.