Privacy

What the server does not know

The text of your messages, your files, the audio of your calls. Your encryption keys. Your address book: the app never reads it. Your phone number: nobody asks for one. One exception to the first line, named right here: if you send us a report yourself, the messages you pick travel to the server in the clear and stay for 90 days. There is no other way to look at a report in a messenger that does not read conversations.

What the server does know

The username you chose when you registered, and a token for push notifications. A queue address - 64 random characters that say nothing about you: they travel to the other person inside the invite rather than being computed from your name. While the first version of the app is still in the App Store, an account also has a second, older address computed from the name - it goes away together with that version. When an envelope arrived and when it was collected. Its size. The IP address you connected from, like any server on the internet.

Also stored: your encrypted account backup, public keys for introductions, invite envelopes, encrypted attachments (with a note of who uploaded them), the wake time for a scheduled message, a counter of failed restore attempts, a hash of a deleted account's username - the name stays reserved for 30 days so nobody grabs it straight away - and an app attestation key (App Attest), which lets the server tell the real Tysha from a tampered build. That key belongs to the phone, not to the account, and is forgotten after six months of silence. That list is meant to be complete: anything missing from it is a mistake on this page, and we will fix it.

The server knows who writes to whom. The sender's name is not written on the envelope - it sits inside the ciphertext - but you send with your own token, so the server sees which account an envelope came from and which queue it goes to. To stop spam runs, it keeps the list of queues an account wrote to for one hour and then erases it. One more thing: the first envelope of every conversation carries the sender's public key, so while such an envelope sits unread, the database shows who it came from. Signal hides the sender with a mechanism called Sealed Sender; Tysha does not have it yet, and it is planned. Until then, the line runs here, not where it would sound better.

For calls, the server knows that a call happened and how long it lasted: while a call is on, the phone asks the server every few seconds whether the other side hung up. Also: waking a phone for an incoming call needs a separate notification. You can turn that off in settings - then calls only reach you while the app is open.

By default, audio and video go through our relay so the other person never sees your IP address. The price, named plainly: the relay itself sees the participants' IP addresses, when the call happened and how many bytes passed - but not the audio or the picture, which are encrypted on the phones. In a group call, the same holds for every pair of participants.

How long it is kept

A delivered envelope is erased immediately. An undelivered one lives no longer than thirty days. Files: fourteen days. Invite codes: fifteen minutes unless you chose otherwise. Reports: 90 days. No logs of message content are kept at all. The server's logs contain no IP addresses, no names and no request bodies. The exception is the call relay: its log keeps the IP addresses of people who talked through it; the log is capped at three 10 MB files and overwrites itself. For every new registration we get a Telegram message - no name, only "new account", the total count and the time.

Notifications

Apple delivers the notification, and the server cannot put your text in it - it does not have it. So an empty signal arrives and your own phone fills in the text after decrypting the message itself. How much shows in the banner is your choice: name and text, name only, or nothing.

We state the cost of that choice plainly: to fill in the text, a separate Tysha helper needs the keys while the phone is unlocked - and the app lock is not asked. Whoever holds your unlocked phone will read what arrives. If you don't want that, set notifications to show nothing.

Backups

Your conversations do not go to iCloud and are not synchronised anywhere. There is an encrypted account backup on our server, and we say so plainly rather than letting you discover it: it holds your identity, your contacts, the list of chats, your groups and your settings - not the messages. Twelve words bring the account back, not the conversations. The text stays only on the phone that read it.

The backup is encrypted with a key derived from your twelve words, and we do not have that key. Lose the words as well as the phone and the copy stays a block of bytes forever - that is not a figure of speech.

This website

This website counts visits - so that we know whether what we say about Tysha reaches people. The counting is done by our own statistics on our own server: no cookies, no third-party services, and your browser talks to nobody but tysha.cloud. We see how many people came, which pages they opened, where they came from, their country and city, and what kind of device. The IP address is not stored - it is only used to work out the country and city. If your browser sends «Do Not Track», the visit is not counted at all. None of this applies to the app: the app has no analytics.

Children

Tysha is not intended for children under 13, and we do not knowingly collect anything from them - there is nothing to collect: we have no profiles, no address books and no content.

Your data

You can delete your account and everything tied to it from the app at any time, or by writing to us - see Delete your account. Deletion removes the username, the push token, the queue with any envelopes in it, your encrypted backup and your uploaded attachments. A hash of the username stays for 30 days so the name cannot be taken over immediately.

Changes and contact

If this page changes in a way that matters, the app will say so before the change takes effect. Questions: tysha@qbdp.online.