Privacy policy
What is visible, and to whom
Effective 9 September 2026, replacing the 7 September version. Latchat remains unreleased. This document outlines exactly how the app functions today, and we will update it whenever the code changes.
The short version.
We do not use accounts, phone numbers, or email addresses in any system we operate. Your message content is end-to-end encrypted, meaning our server simply cannot read it.
However, our server can see who talks to whom, when, and how frequently. That metadata is significant, which is why every detail of it is openly documented below.
1. There are no accounts
Latchat never asks for a phone number, email address, name, or password. There is simply no database column for them anywhere in our infrastructure.
Your identity is a cryptographic key pair generated locally the very first time you open the app. The private half of this key never leaves your device. The only way a server identifies you is by the public half, which is a random string of numbers that holds no connection to your real-world identity unless someone else explicitly makes one.
2. What is stored on your phone
Your messages, group keys, and identity are stored locally on your device and are fully encrypted. None of this data is ever uploaded in a readable format, and we do not maintain server backups. If you lose your phone, your chat history is permanently lost with it.
Exactly what this protects, and what it does not. The encryption key securing these files lives permanently inside Android's own keystore. This ensures your files cannot be extracted via backups, by physically removing the storage hardware, or by rogue apps. However, it is not a replacement for your lock screen. It protects absolutely nothing if someone is physically holding your unlocked phone.
We deliberately configured this key to work without requiring an unlocked screen. We did this because emergency alarms still need to function even if the owner never bothered to set a device passcode.
3. Location data
Latchat can share a single snapshot of your location with your group, but only when you explicitly press the button for it. We request location permissions at that exact moment, not during installation.
One tap, one coordinate. There is no background tracking, no breadcrumb trail, and no persistent listening. The app grabs a single GPS coordinate, waits at most twenty seconds, transmits it, and immediately shuts off the tracker.
That coordinate is precise. It has to be, because sending an inaccurate location during an emergency routes people to the wrong place. The location travels as a standard encrypted message, readable only by members of your group. The relay just sees another sealed envelope; it only knows its size and timestamp.
A location point expires two hours after it is sent, because outdated coordinates are worse than none at all. Furthermore, locations are never automatically forwarded to other groups, even if your group is bridged. Continuous live location sharing is a completely different feature, and this app does not have it.
4. What the relay server sees
We operate a single relay server. Its only purpose is to hold messages while the recipient's phone is asleep or offline. It acts purely as a carrier for sealed envelopes and holds zero decryption keys.
| Group address | A derivative of the group key that rotates automatically whenever the group's membership changes. |
|---|---|
| Public keys | The public key of every device that connects to a specific group address. |
| Message ids | A random number generated per message to prevent duplicate deliveries. |
| Sizes | The byte size of each encrypted payload. |
| Timing | The exact timestamps of when a message was sent and when it was collected. |
| Push token | One Google push token per member who has transmitted one. See section 5. |
Consequently, the server observes a clear pattern: who communicates with whom, when, and how frequently. This constitutes a social graph and an activity log, and we call it that because that is exactly what it is.
What it cannot see: your message content, group names, member names, photos, voice memos, locations, or any files you transmit. All payload data is end-to-end encrypted. The keys live exclusively on the devices within the group, never on our server.
There is one exception regarding visibility: emergency messages are tagged as urgent on the outside of the envelope so they can be prioritized by the network. The server knows an alarm was triggered, but it does not know what the alarm said.
5. Notifications and what Google sees
To wake a sleeping phone, Latchat uses Firebase Cloud Messaging, which is Google's push notification service. On Android, there is no alternative: waking a dormant phone strictly requires the platform's OS-level push service.
What Google sees: That Latchat is installed on your device, your device's unique push registration token, and the exact timestamp of every notification sent to you.
What Google does not see: The push payloads are entirely empty. They act merely as a doorbell. There is zero message content, no group names, no routing addresses, and no sender information included in the push.
This push token is the only piece of data from the list in Section 4 that is shared with a third party. A token uniquely identifies one app installation on one specific device, meaning Google can correlate it with everything else they know about your phone. We only write this token into that specific member's database row, overwrite it immediately when a new one is generated so no history is kept, and never copy it into our logs, the message store, or the push payload itself.
Firebase Cloud Messaging aside, there are absolutely no other Firebase components in this app. We do not use Analytics, Crashlytics, or Performance Monitoring.
6. Data retention periods
| Messages at the server | Dropped if undelivered within 24 hours, and purged the next time that group is active. |
|---|---|
| A member's seat | Marked for release after 48 hours of total silence with no pending mail, and the database row is deleted the next time that group is active. |
| Push token | Deleted alongside the member's row. We keep no historical logs: new tokens simply overwrite old ones. |
| Group address | Rotates automatically upon any membership change, permanently abandoning the old address. |
The phrase "the next time that group is active" carries a lot of weight in that table, so let us clarify it. A group's storage maintenance only triggers when a member actually connects to it, or when a group-specific timer fires. We do not run background sweeps on dormant groups because waking them up costs more server resources than it saves.
This means a completely abandoned group will retain its list of public keys, along with any attached push tokens, until someone eventually reconnects. While its messages will have long passed their 24-hour expiration limit and can never be delivered, those database rows will technically remain sitting in storage.
7. Deleting your data
You cannot close your account because you do not have one. Simply uninstall the app, and your identity, keys, and local messages are destroyed with it. If you abandon a group, your seat at the relay and its associated push token are automatically released the next time that group activates following a 48-hour absence.
Any messages that have already been delivered to someone else's phone remain on their phone. We cannot remotely delete them from another device. No messaging app actually can.
8. This website
The home page utilizes Google Tag Manager. As of 9 September 2026, the landing page at latch.chat loads a single script from Google's servers. Consequently, Google receives your IP address, browser type, the specific page you are viewing, and your referring URL. Depending on our active tag configuration, cookies may also be set.
This tracking applies to the home page only. The invitation page /j, the technical page /how, and this privacy policy load absolutely nothing from external servers. Furthermore, /j executes no scripts whatsoever. We enforce this strictly via browser security headers sent alongside every page, meaning it is guaranteed by your browser rather than just a promise from us.
None of this tracking exists inside the app. The Latchat Android app does not load Tag Manager, analytics, or crash reporters. Section 4 exclusively covers the single Google service we rely on for push notifications.
Aside from the homepage script, this website uses zero third-party fonts, images, or external scripts.
When you open an invitation link, everything after the # is intentionally never transmitted to our servers. This is a fundamental rule of how web browsers handle URL fragments, not a proprietary feature we built. It is the exact reason encrypted invitations can safely travel via links.
During installation, Android verifies that latch.chat genuinely belongs to Latchat. This cryptographic check is performed by Google's servers, not your phone, meaning our website never sees your device during the install process.
9. Who runs this
Latchat is developed by an independent engineer, not a corporation. Both the relay and this website are hosted on Cloudflare. Because Cloudflare handles the raw network connections, they inherently see the incoming IP addresses, just like any network provider. We do not inject any additional tracking of our own on top of this infrastructure.
10. What we do not do
- We do not sell data. We have nothing valuable to sell and no buyers to sell it to.
- We serve zero advertisements, and we build no profiles to target them.
- The app contains no analytics SDKs, trackers, or crash reporting tools.
- We never ask for access to your device's contacts.
- We do not read your messages, and technically we cannot.
11. Changes
If our practices change, this page will be updated to reflect them, and the effective date at the top will change accordingly. If a modification affects what the server can see, the app will explicitly notify you as well.