Privacy Policy

Last updated: February 11, 2026

Enclave is built on the principle that your conversations are yours. This Privacy Policy explains what data we collect, why, and how we protect it. We designed Enclave to collect the minimum data necessary to operate the Service.

1. What We Collect

Data	Why	Stored Where
Email address	Account creation, password reset, critical notifications	Database (hashed for lookups)
Username & display name	Identify you to other users	Database
Password	Authentication	Database (bcrypt hashed, never stored in plaintext)
Messages & files	Deliver them to recipients	Database & file storage
IP address	Rate limiting, abuse prevention	Server memory only (not persisted)
Push subscription tokens	Deliver push notifications you opted into	Database

2. What We Do NOT Collect

No telemetry - We do not track clicks, page views, or usage patterns
No analytics - No Google Analytics, no Mixpanel, no tracking pixels
No advertising data - We do not build advertising profiles
No biometrics - We never collect fingerprints, face scans, or voice prints
No device fingerprinting - We do not fingerprint your browser or device
No third-party trackers - No cookies from third parties
No data selling - We never sell, rent, or trade your data to anyone

3. Direct Messages & Encryption

Direct messages on Enclave support end-to-end encryption (E2EE). When E2EE is active, messages are encrypted on your device before being sent and can only be decrypted by the intended recipient. We cannot read E2EE messages even if compelled to.

Server (community) messages are encrypted in transit (TLS) and at rest (database encryption) but are not end-to-end encrypted, as they need to be delivered to multiple recipients.

4. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion.
Messages: Retained while the server or conversation exists. Deleted when you delete a message, or when a server/conversation is deleted.
Files: Retained while the associated message exists. Deleted when the message is deleted.
Server logs: IP addresses in server memory are not persisted to disk and are lost on restart.

5. Data Export

You can request a full export of your data at any time through your account settings. We will provide your data in a machine-readable format (JSON) within 30 days of your request.

6. Third-Party Services

The managed Enclave platform (enclaveapp.online) uses the following third-party services:

Railway - Infrastructure hosting (servers located in US/EU)
Cloudflare - DNS and DDoS protection
Stripe - Payment processing (only if you subscribe to a paid plan; we never see your full card number)

7. Law Enforcement

We will only disclose user data to law enforcement when presented with valid legal process (court orders, warrants, subpoenas). We will:

Narrowly scope our response to what is legally required
Notify affected users unless legally prohibited
Challenge overly broad requests
Publish a transparency report annually (when applicable)

We cannot provide E2EE message content as we do not have the decryption keys.

8. Children's Privacy

Enclave is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has created an account, we will delete it promptly.

9. International Users

If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdiction with data protection laws:

Our legal basis for processing is contract performance (providing the Service) and legitimate interest (security, abuse prevention).
You have the right to access, correct, delete, and export your data.
You have the right to object to processing and to lodge a complaint with your local data protection authority.

10. Changes

We may update this Privacy Policy from time to time. We will notify users of material changes via the Service or email. The "Last updated" date at the top indicates the most recent revision.

11. Contact

For privacy-related questions or requests: pressf@wastedmyult.com

For general legal inquiries: pressf@wastedmyult.com