privacy

Privacy policy · 2026-10-19.1 Operator: Operator details pending. Country: Not provided. Public support/privacy contact: Not provided. Business/postal details (if applicable): Not provided. These operator details are not finalized; this is a development preview, not a claim of legal compliance. Illusion stores usernames, display names, public encryption keys, salted password hashes, hashed session tokens, public profiles, conversation participants/times/sizes, encrypted message envelopes, separately stored photo/video attachments, read markers, moderation reports, policy acknowledgements and deletion requests. Network infrastructure processes IP addresses; this app does not persist raw IP logs. Short-lived hashed abuse-limit keys, including IP-derived registration counters, can remain for up to 25 hours; account-based counters also survive server hibernation. These are pseudonymous security records, not anonymous data. We do not request phone numbers, email, contacts, precise location or advertising identifiers. Message text is encrypted on your device. New photos and videos are uploaded without end-to-end encryption; the relay operator and hosting provider can access their contents. Do not send sensitive media. Older attachments remain encrypted. The relay has no account private keys for message text. This custom protocol is unaudited, has no forward secrecy, and first contact trusts the public-key directory. A compromised device/key, malicious directory or browser code served by a compromised host can expose messages. Encryption does not stop screenshots. Public profiles are visible to signed-in users. Reports disclose only explicitly submitted notes/profile snapshots and optionally selected verified message text/caption. Necessary account processing supports sign-in, delivery, abuse handling and service security. This is not bundled consent to advertising; there are no optional advertising/analytics features. The appropriate legal bases, transfer arrangements and controller details need review for the operator's jurisdiction. Messages and attachments remain until account deletion or their selected timer; timers default to Off. Opened view-once content is removed from active storage. Sessions expire after 30 days and at most 10 sessions per account stay active; signing in again can revoke the oldest session. Web sign-out clears rendered chats/drafts and attempts to revoke the current server session. If offline, it can only sign out locally. Reports and completed deletion-request records are removed after 90 days. Hosted mode stores relay data in Cloudflare Durable Objects. Cloudflare may retain managed recovery copies under its service policies; deletion removes active app records and cannot promise immediate erasure from provider recovery copies. Local deployments and migrations may retain operator-controlled database backups until the operator removes them. Bot update IDs and delivery status are retained for up to 24 hours to avoid duplicate replies; message text and Telegram chat IDs are not stored by the bot. Operator-made backups, filesystem/WAL remnants and other users' copies cannot be remotely recalled. Windows stores keys, drafts and bounded recent history using DPAPI. The web Mini App stores non-extractable private CryptoKeys in this browser's IndexedDB and appearance/necessary preferences locally; session tokens stay in memory. Browsers/Telegram may clear web storage. Password-protected key backups are under your control. Telegram receives bot interactions/its own client data under Telegram's policies. Cloudflare-hosted mode serves the app, stores the relay database and terminates TLS, processing credentials/API traffic, uploaded media and metadata while message text remains client-encrypted. Local mode may instead use an optional Cloudflare tunnel with the same TLS visibility. No third-party SDKs, analytics, advertising pixels, remote fonts or remote image trackers are loaded by the Mini App. Hosting/network providers can process data outside your country. Use Settings → Privacy and data → Request account deletion, or the public operator contact above, to request deletion/access/correction. Requests require account authentication; do not send private keys. Applicable rights and complaint authorities depend on your location. Requests enter the host's manual review queue. This preview is restricted to adults (18+); no parental-verification workflow is implemented. If a child has registered, contact the operator for removal. A checkbox is not verifiable parental consent.