Privacy Policy

Last updated: 20 August 2026

CalixGo (“the app”) is an end-to-end encrypted chat and calls app with an encrypted Vault. This policy explains what data the app and its server handle, what stays only on your device, and the one feature that is deliberately not end-to-end encrypted. It applies to CalixGo on iOS and Android.

Your identity: a key, not an account

CalixGo has no email/password sign-up. When you first open the app, it generates a recovery phrase and a key pair on your device; your identity is an address derived from that key. You sign in by cryptographically signing a message with your key — the app never asks for, and we never receive, an email address, phone number, or password.

What our server stores

To make chat, calls and contacts work, our server stores the minimum needed to route them:

• Your address, public signing key, and chat public key (all needed to verify your signature and deliver encrypted messages to you)
• The display name and avatar you choose to set
• Your contact list (the addresses you've added)
• A push-notification token (Firebase/APNs) if you allow notifications, so the app can be woken for new messages and calls

We do not collect your email, phone number, or password — the app doesn't have them to collect.

End-to-end encrypted: chat, media, and calls

Message text, and anything you attach — photos, voice messages, files — in 1:1 and group chats is encrypted on your device (X25519 key exchange, ChaCha20-Poly1305) before it ever leaves your phone. Our server relays it live and cannot read it. If you're offline, your messages are held as ciphertext (never plaintext) for up to 30 days and deleted the moment they're delivered to you — we do not keep a standing copy of your chat history once it's been delivered. The same applies to messages you schedule to send later. Voice and video calls are relayed live through our call-routing server for connectivity; audio/video is not recorded or stored. Call metadata needed to connect a call — who is calling whom, and when — is visible to the server for routing, the same way it would be for any calling service.

Not end-to-end encrypted: the Social feed, avatars, and group photos

CalixGo includes an optional Social feed for posts you choose to share more broadly. Unlike chat, feed posts and any image attached to them are not end-to-end encrypted — treat anything you post there as shared content, visible the way any shared post would be, not as a private message. Your profile photo and any group photo work the same way: they're stored as ordinary image files, not ciphertext, because they need to be visible to your contacts before any encrypted session exists.

If you report a message

Reporting a message is optional and always your choice. If you choose to include the message as evidence, your device sends us the decrypted text you're reporting so our moderation team can review it; if you decline, we review the report with no message content attached. Nothing is shared with moderation unless you choose to attach it.

What never leaves your device

• Recovery phrase & private keys — generated and stored on-device only. We cannot see or recover them.
• Vault (Notes, Images, Files) — encrypted and stored locally. It is never uploaded, unless you deliberately export a backup.
• Vault backups — if you export one, it's a password-protected .clx file, encrypted with post-quantum cryptography (Kyber-768 + ChaCha20-Poly1305). Where you save or send that file is entirely your choice.
• PIN / biometric unlock — Face ID, Touch ID, or your PIN unlock the app locally and are never transmitted.

Built-in browser

CalixGo includes an in-app browser so you can open links without leaving the app. Pages you visit are handled the same way as in any mobile browser (the site you visit sees your request, as it would in Safari or Chrome); we do not log or collect your browsing history.

Permissions we request

• Camera — video calls, scanning QR codes, and photo capture for on-device OCR into notes.
• Microphone — voice/video calls, voice messages, and dictating notes.
• Speech recognition — used on-device where available to transcribe your voice into note text; audio is not sent to us.
• Photo library — to save media you export from a chat, and to pick photos for OCR.
• Location — used only when you actively choose to share your location in a chat. CalixGo never tracks your location in the background.
• Face ID / Touch ID — used solely to unlock the app on your device.

Each permission is requested only the first time you use the related feature, and every one is optional except where it's required for the specific action you're taking (e.g. camera access to make a video call).

Third parties

Push notifications are delivered via Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS), governed by Google's and Apple's own privacy policies. Calls are routed through infrastructure we operate; we do not sell or share your data with data brokers or advertisers, and the app carries no advertising or analytics SDKs.

Data retention & deletion

Go to Settings → Delete Account to delete your account yourself, at any time — no need to contact us. This removes your server record (display name, avatar, contacts, room memberships, Social feed posts) and, in the same step, erases this device's copy of your identity, chat history, and Vault. It cannot be undone, so back up your Vault first if you want to keep anything in it. If you'd rather not use the in-app flow, email us at letanphuoc@gmail.com with your address (shown in Settings) and we'll delete the server record for you — that route doesn't touch anything on your device.

Children's privacy

CalixGo is not directed at children and we do not knowingly collect data from children under 13 (or the relevant age of digital consent in your region).

Changes

If this policy changes, the updated version will be posted on this page with a new date.

Contact

Questions: letanphuoc@gmail.com