Asagiri朝霧
The short version
Asagiri is a private messenger. Your messages, calls, photos, files, contacts and keys stay on your phone and are encrypted end to end — our servers carry sealed data they cannot open. To make the app work when your contact is offline, to let people find you if you want them to, and to deliver updates, a few servers do see some information, mostly technical. This policy lists all of it.
- We do not have your messages, your contact list or your keys, and we cannot read them.
- You don't need a phone number or an e-mail address to use Asagiri.
- The app contains no advertising network, no analytics or crash-reporting service and no Google Firebase.
- We do not sell or share personal data.
Who we are
Asagiri is provided by [Company name], [Address] ("we", "us"). We are the controller of the limited personal data described below. You can reach us at support@asagiri.top [and, if applicable, our data protection contact / EU representative].
What stays on your phone
Your identity keys, your contacts, your chats and their history, your media, your drafts and your settings are stored only on your device, in an encrypted database. We never receive a copy. When you delete a message, chat or contact, it is deleted from your device (and, if you choose "delete for everyone", the other phone is asked to delete its copy too — an honest app does).
Some features run entirely on your phone: on-device translation and voice transcription (their language models are downloaded once from Mozilla and Alpha Cephei, which see only that a download happened), and the optional nudity cover for received photos, which checks pictures with a model inside the app and sends nothing anywhere.
What our servers handle
The delivery server (offline delivery)
When your contact can't be reached directly, a text-sized message (a text, a receipt, a reaction, a group message and similar) is sealed to your contact's keys and left on our delivery server until their phone collects it. Photos, videos, files and voice messages never go there: they wait on your phone. For each device the server keeps its device identifier (a public key), when it registered and was last seen, and — only if you chose Push delivery — the push address your UnifiedPush app gave. For each waiting message it keeps the recipient's device identifier, the sealed message and its arrival time. It cannot see who sent a message or what it says. A message is deleted when delivered or after 30 days; a device record is deleted 90 days after the device was last seen. You can switch offline delivery off in Settings › Message delivery.
Like any server, it sees the IP address of each connection. It does not log requests, but its operating system may record the address of a failed secure connection in its system log (kept for a limited time, see Retention). Because a phone that sends and a phone that collects messages both connect to it, a dishonest operator could try to link them by their addresses and timing; we don't, and we tell you so that you can decide.
Relay and call relay
When two phones can't connect directly, an encrypted relay or a call relay (TURN) passes their traffic along. They see which devices connect through them, their IP addresses, when and how much — never the content. Their system logs may record shortened device identifiers and IP addresses.
Usernames (optional)
If you register a username, our directory keeps the name, your device identifier, your signed claim to the name, your public contact keys, when the name was registered and last checked in, and how long it may stay unused. If you verify it with an e-mail address, the directory keeps only a one-way, peppered hash of that address — the address itself is used once to send you a code and is not stored. If you protect the name with a password, it keeps only a public key derived from the password and its salt. Anyone can look a username up; that is its purpose. The app checks in with the directory once a day while you hold a name, and the name is released if you delete it or don't use the app for the period you chose.
Phone numbers (optional)
Adding a phone number is optional and the number is not checked. If you allow people to find you by it, your phone blinds the number before contacting the directory (an "oblivious" cryptographic exchange) and uploads a sealed entry with your contact card. The directory keeps an identifier for the entry, the sealed entry, a hashed write token and two timestamps — not your number. When you search with your address book, numbers are blinded on your phone and are never uploaded in readable form or stored. Honest limit: whoever holds the directory's secret key could test every possible number of a numbering plan and so learn which numbers are registered and their contact cards; we keep that key like our other server keys. Contacts see your number only if your setting allows it, inside encrypted profile messages.
Profile photos
Your profile photos are encrypted on your phone, each with its own key, and stored on the delivery server under a random identifier. The server holds no key and no owner for them; only the contacts you allow receive the key. A photo is deleted when you remove it, or after 180 days without renewal.
Updates, notices and sponsor cards
The Android app downloaded from our website checks our public, signed news and update feed when you open it and now and then in the background (you can turn this off). The request carries no identifier; to save data it may send back a tag of the last feed it got, which is the same for every phone. For notices we mark for counting, the app may tell the server once that a notice arrived, was read, had its link tapped or was dismissed — only the notice and the event, no device or person — and the server adds one to a daily total; you can switch this off in Settings › News and updates. Some screens show sponsor cards that we choose and place ourselves, for us or for a partner we work with directly; your phone picks which card to show and reports nothing about it, and partners receive nothing from the app. If you tap a card we count, the app sends only the card's identifier and the server adds one to that card's daily total. No IP address, device or time is stored with these totals.
Push wake-ups (optional)
If you choose Push delivery, your UnifiedPush distributor (an app you pick, such as ntfy) gives the app a push address, which our delivery server uses to send an empty "wake" signal when a message waits. The push service learns that some server woke that address, and when.
The web app
The web app is a window onto your phone: the browser asks your phone for what to show over an encrypted connection, and keeps nothing. To connect, the browser and phone exchange sealed setup messages through a temporary mailbox on our server, held in memory only and gone 10 minutes after the last message. Your phone always shows that a browser is connected and can disconnect it.
Bots
A bot is an ordinary Asagiri contact run by a program. Whoever runs a bot (including us, for bots we run) sees what other services send to it and the commands you send it directly. A bot can't read the groups it posts into.
Things you can turn on that involve others
- Link previews (off by default): your phone fetches the page you are about to send, so that website sees your IP address.
- Calls as phone calls (off by default): Android's telecom service is told a call's contact name and direction so a headset, car or watch can answer it; Android may list the call in its own call history.
- Your keyboard: GIFs and stickers you insert from your keyboard come from the keyboard's maker, under its own privacy terms. Asagiri sends the result end to end encrypted.
- Backups: an encrypted backup is written to a folder or drive you choose. Its provider stores the file but can't open it without your passphrase.
What we never do
- We never receive or store the content of your messages, calls, photos or files in readable form.
- We never upload your address book.
- We don't use advertising networks, tracking pixels, analytics, crash-reporting services or Firebase.
- We don't sell, rent or share personal data, and we don't build profiles of you.
This website
asagiri.top sets no cookies, runs no analytics and loads nothing from other websites. Like any web server, ours sees your IP address in order to send you the page; we do not keep access logs for this site.
How long things are kept
| Data | Kept |
|---|---|
| Sealed waiting messages | Until delivered, at most 30 days |
| Device records (delivery server) | 90 days after the device was last seen |
| Username records | Until released, deleted, or unused for the period you chose |
| Phone-number entries | Until you turn finding by number off or remove the number |
| Profile photos | Until removed, or 180 days without renewal |
| Web app setup mailbox | In memory, 10 minutes after the last message |
| Daily totals (feed, downloads, notices, sponsor taps) | Aggregate numbers only, [retention period] |
| Server system logs | [e.g. 14 days] |
Why we process this data
We process the limited data above to provide the service you asked for (delivering messages, letting people find you if you choose, delivering updates) and, for security and abuse prevention, on the basis of our legitimate interest in keeping the service working [adapt to your jurisdiction, e.g. GDPR Art. 6(1)(b) and (f)]. Optional features rely on your choice to switch them on.
Your rights and choices
Most of your data is on your phone and under your control: you can delete messages, chats, contacts, your username, your phone number and your profile photos in the app at any time. Uninstalling the app deletes everything on the device. Your device record on the delivery server expires on its own. Depending on where you live, you may have the right to access, correct, delete or restrict the processing of personal data we hold, to object to it, to data portability and to complain to a data protection authority. Because we hold so little — and most of it isn't linked to a name — we may need your device identifier or username to find it. Write to support@asagiri.top.
Children
Asagiri is not intended for children under [16]. If you believe a child has given us personal data, contact us and we will delete what we can.
Where our servers are
Our servers are located in [country]. If you use Asagiri from another country, the limited data above is processed there [describe safeguards if required].
Security
How the encryption works, what it protects and what it doesn't, and how to report a vulnerability: see our security page.
Changes to this policy
If we change this policy, we will update the date above and, for important changes, tell you in the app's notices before they take effect.
Contact
[Company name], [Address] · support@asagiri.top