Privacy Policy

This Privacy Policy describes how ASH ("the App") handles information. ASH is developed by Tomas Mihalicka ("Developer", "I", "me").

ASH is a secure messaging application that uses One-Time Pad encryption. The App is designed to minimize data collection and maximize user privacy.

ASH is designed to collect as little information as possible. We do NOT collect:

• Personal identifiers - No name, email, phone number, or account required
• Message content - Messages are end-to-end encrypted; we cannot read them
• Encryption keys - Keys are generated on-device and never transmitted
• Contact lists - We do not access your contacts
• Location data - We do not track your location (unless you choose to send a location message)
• Device identifiers - We do not collect UDID, IDFA, or similar identifiers
• Usage analytics - We do not track how you use the App
• Crash reports - We do not collect crash data

The following information is processed transiently by our relay server to deliver messages. This data is NOT stored permanently:

The relay server is designed to be "untrusted" - it cannot decrypt messages, identify users, or correlate conversations.

The following data is stored locally on your device and never transmitted:

• Encryption keys (pads) - Generated during the ceremony, stored in device secure storage
• Conversation state - Pad consumption pointers and metadata
• App preferences - Your settings and preferences

This data is protected by your device's security features (Face ID, Touch ID, passcode). If you delete the App, all local data is permanently destroyed.

ASH uses Apple Push Notification service (APNs) to deliver silent push notifications when a message is waiting. These notifications:

• Contain no message content
• Only signal that a message is available for download
• Are processed by Apple according to their privacy policy

You can disable push notifications in your device settings at any time.

ASH allows you to send one-shot location messages to your contact. When you choose to send a location:

• Location access is requested only when you initiate a location message
• The location is encrypted end-to-end like any other message
• We do not store or process your location on our servers
• Location precision is intentionally limited (approximately 10cm accuracy)

You can deny location permissions entirely, and all other features will continue to work.

ASH uses the following third-party services:

We do not use any analytics services, advertising networks, or social media integrations.

Security is the core purpose of ASH. We implement:

• One-Time Pad encryption - Provides information-theoretic security
• No key escrow - Keys exist only on user devices
• Untrusted relay design - Server cannot decrypt or identify messages
• Ephemeral storage - Encrypted blobs are deleted after retrieval
• Secure local storage - Keys stored in device keychain/secure enclave

ASH is not directed at children under 13 years of age. We do not knowingly collect personal information from children. Since we do not collect personal information from any users, this is not applicable in practice.

ASH can be used internationally. The relay server may process encrypted message blobs in various jurisdictions. Since these blobs are encrypted with One-Time Pad encryption and contain no identifying information, the jurisdiction of processing does not affect your privacy.

Since we do not collect personal data, traditional data subject rights (access, rectification, deletion, portability) are not applicable. However:

• Data deletion - Delete the App to permanently destroy all local data
• Data portability - Not applicable as we store no data about you
• Opt-out - Stop using the App at any time

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Your continued use of the App after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy, please contact: