Privacy policy

Who we are

Derin is owned by Edoardo Pirani and published by Pygocen Ltd under licence. Pygocen Ltd is registered in England and Wales (company no. 16080946), registered office Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.

Edoardo Pirani is the data controller for the personal data described here, under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for people in the European Economic Area, the EU GDPR. For any question or request about your data, email derin@pygocen.com.

In short

• Your messages are end-to-end encrypted on your phone. We cannot read them, and nobody else can either, other than the people in your conversation.
• We keep what the app needs to work: your sign-in, your profile, your groups, and encrypted copies of messages until they are delivered.
• This website has no analytics, no advertising and no cookies.
• We never sell your data and never use it for advertising.

What the app collects

Your account

Your phone number, which you sign in with by a code sent in a text message, and your email address if you give one. They are kept in a private record that only you can read, together with whether you want product news by email.

Your profile

Your first and last name, username, profile photo and the short text about you, if you add them. Any signed-in Derin user who knows your username can see your profile, so people can find and invite you. Profile and group photos are stored at a web address that anyone holding it can open.

Your groups and friends

The groups you belong to (their name, picture and description, and their members), your friends and friend requests, and which questions your group has had and when. The people in a group can see these.

Your messages, answers and media

Text, voice notes, photos and videos are encrypted on your phone before they leave it, with the Signal protocol, using keys that never leave your devices. Our servers pass on an encrypted copy for each device that should receive it and delete it once delivered, or after 7 days at the latest. Encrypted media files are stored in Cloud Storage so the people in your group can download them. Your conversation history is kept on your phone.

Your devices

For each phone you use: its public encryption keys (which other Derin users need, to encrypt messages to you), and, in your private record, its notification token, its name, model and operating system, and an identifier for the device.

Whether you are online

Whether the app is open on your phone and when it last was. Other signed-in Derin users can see this.

How the app is used

Google Analytics for Firebase records events such as an account being created, a group being created or a message being sent (its type, never its content), with your device's model, operating system, country and an identifier for this installation of the app. We use it to see which parts of Derin work.

Crash reports

When the app crashes in a release build, Firebase Crashlytics receives the type of error, its message with any quoted text removed, where in the code it happened, and your device's model and operating system. Crash reports never include your messages, the app's logs or screenshots.

Support requests

If you send a bug report or a question from the app, we receive your name, email address and message, and any screenshots you attach. For a bug report you can choose to attach the app's recent logs, a record of what the app did, such as the screens opened and the errors met.

The pilot sign-up

When you sign up for the Derin pilot on this website, we keep your first name, your email address, who you would use Derin with, the note you add (if any), and when you signed up and agreed to be emailed. We use them only to run the pilot: to choose who takes part and to email you about it. We send you a confirmation when you sign up, and nothing else unless there is pilot news.

We keep your sign-up until the pilot list is no longer needed or until you ask us to remove it, whichever comes first. To be removed, reply to any of our emails or write to derin@pygocen.com. The legal basis is your consent, which you can withdraw at any time.

This website

The public pages of this website set no cookies. If you use the light and dark switch, your browser keeps that one choice (light or dark) for your next visit, and nothing else is stored. They load no analytics, advertising or tracking code, and their fonts are served from this site. Like any web host, Firebase Hosting receives your IP address and browser details in order to deliver the pages.

The admin pages are for the Derin team only. Signing in to them stores Firebase Authentication's session in the browser, which is needed for the sign-in to work.

AI

Derin does not send your messages or answers to any AI service, and your words are never used to train AI. If we add AI recaps, this policy will say what is sent, to whom and for how long before the feature is turned on, and your group will be asked to agree to it.

Why we use your data (legal bases)

• To provide Derin (contract): your account, profile, groups, the delivery of encrypted messages and media, notifications, and support.
• Legitimate interests: crash reports and usage events to keep the app working and improve it, and limits that protect the service from abuse. You can object by emailing derin@pygocen.com.
• Consent: emails about the pilot, and product news if you ask for it.

Who processes it for us

Each processes your data on our instructions, under its own data processing terms. We do not sell or share your data with anyone else.

Where it is kept

The database and the online-status records are in Google Cloud's European Union locations. Server functions run in the United States, and some providers above process data in the United States. Those transfers rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework (with its UK extension), as each provider offers.

How long we keep it

• Account, profile and group data: while your account exists.
• Encrypted message copies on our servers: until delivered, and 7 days at most.
• Crash reports: 90 days. Usage events: as long as Google Analytics keeps them, two months by default.
• Support requests: as long as needed to deal with them.
• Pilot sign-ups: as described above.

You can delete your account in the app's settings: that deletes your sign-in and your profile and removes you from your groups. To make sure every other record linked to your account (such as your devices' records) is erased too, email derin@pygocen.com and we will confirm when it is done.

Your rights

You can ask for a copy of your data, have it corrected or erased, restrict or object to how it is used, receive it in a portable format, and withdraw consent at any time. Email derin@pygocen.com. We cannot provide copies of your messages, because we cannot read them; they are on your phone.

You can also complain to a supervisory authority: in the UK, the Information Commissioner's Office at ico.org.uk; in the EU, the authority in your country.

Children

Derin is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, email derin@pygocen.com and we will delete it.

Changes

When this policy changes, the date at the top changes with it. We will tell you in the app or by email before a change that affects what we collect or who receives it.

Contact

Questions and requests: derin@pygocen.com.