Pozitiv Privacy Policy

Effective date: 23 October 2026

In short

Pozitiv does not collect your data. There are no ads, no analytics, no trackers and no crash reporting in the app.

Your account and messages are kept by the Matrix server ("homeserver") you choose when you log in, not by the Pozitiv developers.

Messages in encrypted chats can only be read by the people in the chat.

About this policy

This policy explains what happens to your data when you use the Pozitiv app ("the app") on Android, Linux or the web. "We" means the Pozitiv developers. "You" means the person using the app.

Pozitiv is a client for Matrix, an open network for secure chat. Like email, Matrix has many independent servers that talk to each other.

Your homeserver

When you log in, you choose a homeserver: for example matrix.org, pozitiv.chat (once available) or a server you or someone else runs. Your account, your messages, your files and your profile live on that server, and its own privacy policy and terms apply.

matrix.org is run by The Matrix.org Foundation. Its privacy notice: https://matrix.org/legal/privacy-notice/

When the pozitiv.chat server becomes available, this policy will be updated to describe it before it opens.

What the app sends, and when

The app only sends data to your homeserver, and only when it is needed for what you do:

• Your user name and password when you log in.
• Messages, photos, files and stickers when you send them.
• Your display name and profile photo when you set them.
• Chat settings such as favourites, pinned messages and muted chats, so they work on all your devices.
• Encryption keys of your device, so others can send you encrypted messages.

In encrypted chats (the default in Pozitiv), the content of messages, photos and files is encrypted on your device before it is sent. Your homeserver cannot read it. Some information cannot be encrypted, because servers need it to deliver messages: who is in a chat, who sent something and when, the size of files, display names, profile photos and room names.

Stickers come from the app's built-in pack. The sticker picture itself is uploaded unencrypted (like in other Matrix apps), so a server can see which sticker was sent, but not your messages.

Federation: other servers

If you chat with people on other homeservers, copies of the chat (encrypted where applicable), your user name, display name and profile photo are stored on their servers too. Those servers may be in other countries and are subject to their own laws and policies.

Stored on your device

The app keeps some data on your device so it works quickly and securely: your session, encryption keys, a copy of recent messages and your settings (language, message disguise style).

If you set a PIN, only a scrambled version of it (a salted PBKDF2 hash) is stored, on your device only. The PIN never leaves your device.

Logging out removes your session and its encryption keys from the device. Uninstalling the app removes everything the app stored.

Permissions

• Internet: to talk to your homeserver.
• Camera: only when you tap "Take a photo".
• Photos and files: only the items you pick yourself.

The app does not access your contacts, location or microphone.

Links and outside services

Invite links use matrix.to, the standard Matrix link format. A personal invite link contains your user ID. If someone opens it in a web browser, the matrix.to page (run by The Matrix.org Foundation) is shown to help them open it in a Matrix app.

Links in the server tutorial open outside websites in your browser. Their own privacy policies apply.

The web version of the app loads parts of the Flutter engine and some fonts (for example for emoji and some alphabets) from Google's servers (gstatic.com), which can see your IP address.

Push notifications

The app does not use push notifications at the moment. If they are added later (for example through Google Firebase Cloud Messaging), this policy will be updated before that version is released, explaining what is sent and to whom.

Security

End-to-end encryption uses the vodozemac library, the same encryption used by other Matrix apps. The web version of Pozitiv does not support end-to-end encryption yet; use the Android or Linux app for encrypted chats.

The message disguise and PIN protect what people around you can see on your screen. They do not replace the encryption described above.

Deleting your data

We cannot see or delete data on your homeserver. To delete your account or data, use your homeserver's options or contact its operator. Because of federation, other servers may keep copies of chats you were part of, and some may ignore deletion requests. Your user name can remain visible in old chats.

Data stored by the app on your device is removed when you log out or uninstall the app.

Children

Pozitiv is not intended for children under 16. We do not knowingly collect any data, from anyone.

Changes to this policy

If this policy changes, the new version will be published with the app and on pozitiv.chat, with a new effective date.

Contact

Questions about this policy: privacy@pozitiv.chat