Draft, pending legal review. This is how we intend Ardea to handle your information. It may change before the app is released, and it takes effect only when the app is available.
The short version
- Your messages, files, photos and calls are sealed on your device and opened only on the devices you send them to. Our servers carry them but can't read them.
- We keep only what we need to run the service, such as your email address, your name and which devices are yours.
- No ads. No tracking. We don't sell or rent anyone's information.
- A Work account belongs to your organization. It runs on that organization's servers, under its rules, and it may keep records of your work messages. Read more.
1. Who this covers
This policy explains how Ardea ("we") handles information when you use the Ardea app and this website.
- Personal accounts run on Ardea's servers. This policy applies to them in full.
- Work accounts are set up by an organization, such as a company or a government agency, and run on servers that organization controls. The organization decides how its service is run, and its own privacy policy applies. This policy describes what the app itself does on a Work account, so you know what to expect. See Work accounts.
2. What we can't see
Ardea uses end-to-end encryption. Everything you send is sealed on your device with keys that only your devices and the devices of the people you're talking to hold. The encryption combines long-proven methods with newer ones designed to resist attack by future quantum computers.
Our servers pass sealed envelopes along. They can't open them. That covers:
- the words of your messages, and your edits;
- photos, videos, voice messages and files you send;
- the sound and picture of your calls;
- your profile photo, which goes sealed to your contacts and never to our servers;
- which groups you're in, and who else is in them.
Notifications on your phone don't carry your messages either. The notification only wakes the app, which then collects the sealed message and opens it on your phone. (A few account-security alerts, such as "someone is setting up Ardea with your address", are written by our servers and say exactly that.)
3. What we keep
To run a Personal account, our servers hold:
- Account details: your email address, the name you give, an account ID, and whether people can find you.
- Your devices: the name of each device you link (such as "iPhone"), its public keys (the lock others use to seal messages to you), when it was added and last checked in, and the notification address Apple gives us so we can wake it.
- Sign-in security you choose to add: a phone number if you use text-message codes, an authenticator app or a passkey, and scrambled fingerprints of your backup codes (not the codes themselves).
- Being findable, if you turn it on: your email address or phone number, so people who already know it can find you.
- Delivery information: to deliver a sealed envelope, our servers see who it's for, its size and when it was sent, and they know when your device is connected.
- Envelopes waiting for you: sealed messages and files, until your device collects them (see How long we keep things).
- Security records: a sealed log of account events, such as a sign-in or a new device, used to protect your account and investigate abuse.
Our servers use your device's internet (IP) address to connect to it and to limit abuse, such as too many attempts in a short time. On a Personal account, we don't keep a log of IP addresses.
4. Your contacts
Ardea never uploads your address book. If you choose to add someone from your phone's contacts, the app sends that person's email addresses or phone numbers to our servers to check whether they use Ardea, one person at a time. We use them only to answer that question. The number of lookups is limited, to stop anyone from searching for people in bulk.
5. Your location
Ardea doesn't share or store your location. If you allow it, the app uses your approximate location on your phone only, to show where you are on a map inside the app. It never leaves your phone, and the app never uses location in the background.
On a Work account, the organization's servers estimate the city you're signing in from, using your IP address. See Work accounts.
6. Calls
Calls are encrypted end to end: every piece of sound and picture is sealed on your device. To protect your internet address from the person you're calling, calls travel through our relay server instead of connecting the two phones directly. The relay sees both devices' internet addresses, how much data passes and how long the call lasts. It can't hear or see the call, and it doesn't keep logs.
To ring the other person, a sealed call request goes through our servers, which see who it's for and when. Call requests are deleted within minutes.
7. GIF search
GIF search is provided by GIPHY. Your search goes through our server, which asks GIPHY on your behalf, so GIPHY sees the search words and our server's address, never yours, and nothing that identifies you. Our server sees the words you search for while it passes them on.
8. Diagnostics
Ardea contains no analytics, advertising or crash-reporting tools from other companies. The app can keep a responsiveness log of slow moments and call timings on your phone, under Settings, Advanced. It never leaves your phone unless you choose to share it with us.
9. Reports and safety
If someone bothers you, you can report them. You choose up to 10 recent messages from that conversation to include. They're sealed so only Ardea's safety team can read them, and the person you report isn't told. You can also email safety@getardea.com; see Safety and reporting.
To keep people safe, we may warn, limit, suspend or close accounts that break our rules, keep information about an account when the law requires it, and report illegal content to the authorities when the law requires it. We can only ever act on what we can see. Without a report, that never includes your messages.
10. Work accounts
A Work account is run by your organization, on its servers, under its policies. Your organization, not Ardea, decides much of what happens to your information, and its privacy policy applies. Ask your organization if you have questions.
Depending on how your organization sets it up, a Work account can:
- Keep a records copy of your work messages. Many organizations must keep records by law. The app can send a sealed copy of each message, its files and who was in the conversation to your organization's records system. This is on by default. You may be able to turn it off, unless your organization requires it. Even when it's off, the app still records some events, such as edits, deletions, calls and group changes. Records copies aren't removed by disappearing-message timers.
- Report security events to your organization's security team, such as sign-ins, new devices, and a device reported lost.
- Show administrators your account's devices, whether they passed security checks, how many messages are waiting, and the approximate city each sign-in came from.
- Offer other ways to connect, labelled "Send as …", that use your organization's own relays. Those relays see your device's internet address and the size and timing of sealed data, never what's inside.
Your Work account and your Personal account are kept apart. Your organization can't see your Personal account.
11. Who else is involved
We don't sell, rent or trade information, we don't show ads, and we don't track you across other companies' apps or websites.
We use a small number of service providers, only to run Ardea:
- a cloud hosting provider, to run our servers;
- an email provider, to send sign-in codes and account emails;
- a text-message provider, only if you choose text-message codes;
- Apple, to deliver notifications, to check that the app is genuine, and to provide age information where the law requires it;
- GIPHY, for GIF search, as described above.
If the law requires us to hand over information, we can only provide what we have. We can't provide the contents of messages, files or calls, because we can't open them.
12. How long we keep things
- Sealed messages: deleted as soon as your device collects them. If they're never collected, they're deleted after at most 30 days.
- Sealed files: kept for 30 days so everyone in a conversation can download them, then deleted.
- Call requests: deleted within minutes.
- Security records: kept for 90 days.
- Your account details: kept while you have an account, and erased when you delete it (see below).
Work accounts follow their organization's rules, which may keep records for longer.
13. Deleting your account
Personal account: you can delete it in the app, from your account settings. You'll confirm with a fresh code. We then erase what our servers hold for your account. Two exceptions: if the law requires us to preserve information, for example during an investigation, we may delay erasing it; and if an account was closed for breaking our rules, we keep its email address so it can't simply sign up again.
Your messages live on your devices and on the devices of the people you sent them to. Deleting your account doesn't remove copies other people already have.
Work account: you can ask to close it in the app. Your organization's administrators close it and decide what records they must keep.
14. Children and teens
Ardea isn't for children under 13. Personal accounts are for people 13 and over, and Work accounts for people 18 and over.
Where the law requires it, the app asks Apple for an age range. That answer stays on your phone; we don't receive or store your age. Teens can't make themselves findable by others, and get extra protections. Where the law gives a parent a say, the parent's consent goes through the App Store.
If you believe a child under 13 is using Ardea, please contact us.
15. Your choices and rights
You can change your name, choose whether people can find you, remove devices, and turn location and contacts access on or off in your phone's settings at any time. Depending on where you live, you may have the right to ask for a copy of the information we hold about you, to correct it, or to have it deleted. Email us and we'll help. For a Work account, ask your organization.
No system is perfect, which is why we hold as little as we can.
16. This website
This website uses no cookies, no analytics and no scripts, has no forms, and loads nothing from other companies. If you email us, we use your message and address only to reply. It's hosted by Cloudflare, which handles your internet address to deliver the pages and to protect the site from attacks. We don't keep visitor logs.
17. Changes to this policy
This is a draft. Once it takes effect, if we change it, we'll post the new version here with a new effective date. If a change matters to how your information is handled, we'll also tell you in the app before it takes effect.
18. Contact us
Questions about privacy, or a request about your information: