Privacy Policy

In short

Chirping is built so that your private conversations belong to you. Messages are end-to-end encrypted, stored only on your phone, and never used for ads or analytics. There are no ads or trackers in chats, calls or Chipchip, and Chirping sells no data. Chirps, the public communities, shows ads from Google (see Ads in Chirps).

What stays on your phone

Your chats, photos, files, voice notes, contacts, reactions and encryption keys are stored only in Chirping's private storage on your device. They are excluded from automatic Android cloud backups and device-to-device transfers. If you turn on Chat Backup (Settings → Chat Backup), a copy of your chats, settings and keys (and, if you choose, photos and videos) is encrypted on your phone with a passphrase only you know and stored in the hidden Chirping folder of your own Google Drive; neither Google nor Chirping can read it, a forgotten passphrase can't be reset, and you can delete the backup at any time. Settings → Erase All Data deletes all of it. Received photos, videos, audio and files are also saved to your phone's Downloads/Chirping folder (Photos, Videos, Audio, Documents) so you can find and manage them; other apps you've allowed to read your files can see that folder. Turn this off in Settings → Save to Downloads.

End-to-end encryption

Every private message, reaction, receipt and file is encrypted on your phone before it leaves it (ECDH P-256 key agreement with AES-256-GCM). Only the recipient's phone can decrypt it — not our server, not Google, not anyone in between. Your private key never leaves your device and is protected by the Android Keystore. You can compare safety numbers in a chat's info screen to confirm nobody is intercepting your conversation.

Offline (nearby) messaging

Without internet, Chirping talks directly to nearby phones over Bluetooth and Wi-Fi using Google Play services' Nearby Connections. Android requires the Location permission for this kind of discovery; Chirping only reads your location when you choose Location in a chat's + menu: your phone then gets it once and sends it, end-to-end encrypted, to that chat. It isn't stored on our servers. People nearby can see the name you choose and your profile photo while you're discoverable, which you can turn off in Settings.

Online mode and your account

If you choose Online + Offline, you sign in with your email address, phone number or Google account through Google Firebase Authentication (with Continue with Google, Google shares your name, email address and profile picture with it; Chirping uses only your email address). Our server (Google Cloud Firestore, Mumbai region) then stores: your email or phone number, your unique username, your public encryption key and a random device ID, so friends can find and reach you. Your email is never shown publicly. If you add an About line, it's shown on your profile to everyone signed in to Chirping, except people you've blocked. If you set a profile photo, a small copy is stored with your account so the people you chat with online see it; only people you've let message you can see it, and it's deleted with your account.

Phone numbers and contacts

You can sign up with your phone number, or add one to an email account in Settings. It's verified by SMS through Firebase Authentication, stored privately so people who already have your number can find you, and never shown publicly. If you open New Message → Phone Contacts and allow contacts access, Chirping reads the phone numbers in your address book on your phone and checks each one against Chirping accounts. The numbers aren't uploaded in bulk, stored on our servers or used for anything else, and nobody is told you checked. The contacts found on Chirping are remembered on your phone so the list opens instantly. You can turn off contacts access at any time in Android settings. To share a contact in a chat (+ → Contact), you pick it in Android's contact picker; Chirping reads only that contact's name and numbers and sends them end-to-end encrypted to that chat, like any message.

Online messages and files are deleted after delivery

When a message or file travels over the internet, the server only ever holds the encrypted version. Messages go through our encrypted relay on Google Cloud Firestore; files go through Cloudflare's storage (R2), and only the recipient can download them. The recipient's phone deletes each message and file from the server the moment it's downloaded. Anything never collected is erased automatically (messages after 14 days, files after 15). Files up to 100 MB can be sent online; larger files wait until you're nearby.

Voice and video calls

You can call people you can message online. Calls are end-to-end encrypted: the two phones agree on keys through Chirping's encrypted inbox, then audio and video travel directly between them. When a network blocks a direct connection, the encrypted call passes through Cloudflare's relay servers, which can't listen to or watch it. Chirping never records calls by itself. You can choose to record a call with the Record button: the recording is made on your phone and saved only to your phone's storage (Recordings or Music/Chirping for voice, Movies/Chirping for video), and it's never uploaded. The other person sees that you're recording while it's on. Recordings are yours to keep or delete in your phone's files. The microphone and camera are used only during a call you place or answer. Your call history (who, when, how long) is kept only on your phone.

Notifications when the app is closed

So that messages and calls arrive even when Chirping is closed, your phone registers with Google's Firebase Cloud Messaging. When something lands in your encrypted inbox, our server (Google Cloud Functions, Mumbai region) sends your phone a wake-up signal that contains nothing: no sender, no message. Your phone then fetches and decrypts the message itself. Google can see that a signal was sent to your device and when, but not who it came from or what it says. The push token that makes this possible is stored with your account and deleted when you log out or delete your account.

Chipchip

Chipchips (text, a photo or a video) last 12 hours. Online, they're end-to-end encrypted on your phone: our server stores only the encrypted Chipchip, a small encrypted preview and, for each viewer, its key locked so only their phone can open it. Online viewers are the people saved in your phone's contacts who are on Chirping and the people you chat with online, minus anyone you choose in Settings → Hide Chipchip From. Your phone works this out, and the Chirping account IDs of those viewers are stored with it so the server only lets them fetch it. When you watch someone's Chipchip, your phone tells them you saw it (and how you reacted, if you did); only its owner can see this. If you set Last Seen & Online to Nobody, viewing isn't reported, but reacting still is. Replies and reactions are sent to the owner as normal end-to-end encrypted chat messages. Chipchips, their views and their media are deleted from the server automatically after 12 hours (photo and video files within a day), or straight away when you delete one. Settings → Auto-Download Chipchip chooses whose online Chipchips your phone fetches in the background. People who can see a Chipchip can repost it (it shows who it came from) or pass it on, as with any message. You can add a song from Audius to a text or photo Chipchip: which song it is travels encrypted with the Chipchip, and the phones of people who watch it stream the song from Audius (audius.co), so Audius sees their phone's internet address, as with any website.

Chipchip with people nearby

When Discoverable is ticked on a new Chipchip (it is by default), it is also shared with anyone using Chirping within about 100 m, including people you don't know, over Bluetooth and Wi-Fi with no internet and no Chirping server involved. Your phone lets phones around it know it has Chipchips; they can ask for your name, the text and a small preview, and download the photo or video when someone taps Download. Everything travels over the same end-to-end encrypted link as nearby chats. People you've blocked, or hidden your Chipchip from, get nothing. What phones nearby receive stays on them until the Chipchip expires after 12 hours; like anything you share, they could save it. Videos longer than 60 seconds (up to 3 minutes) are shared only this way. If someone nearby watches yours, their phone tells yours, unless their Last Seen & Online is set to Nobody. Untick Discoverable to keep a Chipchip off nearby phones. Your Chipchip streaks and achievements are worked out and kept only on your phone.

Deleting messages

Delete for Me removes a message from your phone. For 48 hours after sending, Delete for Everyone also sends an end-to-end encrypted note (online or nearby) asking the other phones in the chat to replace it with “This message was deleted”; if it hadn't been delivered yet, it isn't sent at all. People using an older version of Chirping, or who already saved, forwarded or took a screenshot of it, may still have it. Unsent drafts are kept only on your phone. Disappearing messages (a chat's timer, set in its info) are deleted from every phone in the chat after the chosen time, though people can still screenshot or save them first. Scheduled messages wait on your phone until they're sent. App Lock uses your phone's own fingerprint, face or screen lock; Chirping never sees them.

Profile names and names you give people

Your profile name is what people nearby see instead of your username. It's kept on your phone and sent only to phones nearby, over the end-to-end encrypted nearby link; it isn't stored on our server. Anyone can choose any profile name, so it doesn't prove who someone is. You can also give anyone a different name in their chat. That name stays on your own phones and in your encrypted backup, and is never sent to them or to anyone else.

Online status and last seen

While Chirping is open, your phone marks you as online, and when you leave it saves the time (your “last seen”). Only people you've accepted in a chat can see it, and only while Settings → Privacy → Last Seen & Online is set to My Contacts or My Contacts Except…. With My Contacts Except…, the people you pick can't see it (the list is stored with your account so the server can enforce it, and only you can read it), and you won't see theirs. Choose Nobody to hide it from everyone; you then won't see other people's either. If you set a mood (Settings or tapping your photo), it's shared the same way, with the same people, for a day. Mood music is either built into the app or, if you choose Songs (Audius), streamed from Audius (audius.co): your phone asks Audius for a song matching the mood, so Audius sees your phone's internet address, as with any website; nothing about you or your chats is sent. If you choose your own song for your mood, its title, artist and Audius link are stored with your online status on our server. They aren't end-to-end encrypted. The same people see them for as long as the mood lasts, and their phones stream the song from Audius when they open your mood card. It's deleted when you log out or delete your account.

Usernames

Some usernames are kept for public figures, organisations and brands. To ask for one, you email [email protected] with a document that proves it's yours. We use it only to decide your request and delete the email once we've decided. Chief moderators can also take away a username that impersonates someone or breaks the rules. If you think that was a mistake, email [email protected]. Chirping does not read your phone's Android ID, IMEI or serial number.

Signed-in devices

For each phone signed in to your account, our server stores its model (for example “Pixel 8”), Android version, when it signed in and when it was last active, so you can see your phones in Settings → Devices and log any of them out. Each phone also keeps a random secret; the server stores only a fingerprint (hash) of it, to check that a log-out really comes from one of your phones. Only you can see this list. A phone's entry is removed when it logs out or is logged out, and the whole list when you delete your account. After 4 wrong verification codes or passwords in a row, signing in on that phone pauses for 12 hours (24 hours if it happens again); this is counted only on the phone.

Stickers and GIFs

Stickers you make or import are kept only on your phone. A sticker or GIF you send travels end-to-end encrypted, like a photo. GIF search sends what you type to GIPHY (giphy.com), and your phone downloads the GIF you pick from GIPHY; the person you send it to gets it from you, encrypted, so GIPHY never learns who receives it. Animated emoji (Noto Emoji Animation by Google) are loaded from Google's servers (fonts.gstatic.com) when you open them, so Google can see your phone's internet address, as with any website; the person you send one to gets it from you, encrypted.

Message requests, blocking and muting

Nobody can message you online unless they have your phone number (as on WhatsApp), you accept their request, you've met nearby, or you share a group. Blocking someone is enforced by the server: they can no longer message you or send you requests, and their posts are hidden. Muting only hides their Chirps content and notifications on your phone.

Reports

You can report posts, comments, accounts and chats. Reports, including any details you add, go privately to our moderators and the reported person isn't told who reported them. Reports on Chirps posts and comments go first to that community's admins once 10 people report the same thing for the same reason; they can remove it, keep it, or send it to Chirping's chief moderators, and they don't see who reported it. Child sexual abuse reports go straight to Chirping's moderators. Because chats are end-to-end encrypted, a chat report only includes messages if you choose to attach them (up to the last 20 text messages); those copies are readable by our moderators and may be shared with authorities when the law requires, for example in cases of child sexual abuse. See our Child Safety Standards.

Chirps (public communities)

Chirps posts (text and an optional photo), comments, votes and community names are public to everyone signed in to Chirping and are stored on our server so others can read them. They are not end-to-end encrypted. You can add one PDF to a post, up to 20 MB. It's public like the rest of the post, isn't checked automatically, and is kept until you delete the post. Photos are resized on your phone and stripped of location and camera details before upload, checked by Google Cloud Vision SafeSearch (photos with nudity, sexual or graphic violent content are refused; Google doesn't keep them), stored on Cloudflare (R2, served from media.chirping.in), and kept until you delete the post, then deleted straight away. Community logos and banners added by a community's creator or moderators are public too. Your votes are private. You can delete your posts and comments at any time. Your Chirps profile (u/name, About line, karma from votes, followers, following and when you joined) and who you follow are public to everyone signed in to Chirping. Notifications about replies, mentions, new followers and trending posts are stored with your account so the app can list them (only you can see them) and are sent to your phone as push notifications with a short preview. A link in a post gets its preview from Chirping's server, so the website sees our server rather than your phone. Posts can have up to 10 photos or one video, stored and deleted like photos. To make search work, the server keeps a list of the words and #hashtags in each public post and comment, and people can find your u/name in search. Muted words stay on your phone. Each community has a public moderation log of what its admins, Chirping's moderators and AutoMod (automatic filters a community's admins set) removed or changed, naming admins by u/name but never showing removed content. If you ask to join a private community, its admins see your u/name and your note. Private communities are hidden from feeds, search and lists, but their posts aren't encrypted. Posts on the Nearby feed go straight from phone to phone over Bluetooth and Wi-Fi (end-to-end encrypted, like nearby chats), never through our server; people within range see your name and the post, likes go back to the author's phone, and posts are deleted from phones after 24 hours. To find local communities, your phone's location is turned into a rough area (about 5 km) on your phone and only that area is used to look; your exact location isn't sent or stored. A group's invite link (chirping.in/g/…) stores only the group's name, its member count and which admin accounts handle join requests on our server; asking to join shares your username, device id and public key with those admins so their phone can send you the encrypted invite. Group messages, members and keys stay end-to-end encrypted between phones. Broadcast channels are public: a channel's name, description, admins, subscriber count and posts are stored on our server (photos on Cloudflare R2) and can be read by anyone signed in, so they aren't end-to-end encrypted. Which channels you subscribe to is stored with your account (only you can see it), and your phone subscribes to the channel's push topic so new posts can notify you. If you link another phone to your account (Settings → Devices), your phones share your account's encryption identity: the phone that has your chats sends the new phone a snapshot of your chats, contacts, settings and keys, encrypted end to end with a one-time key only the two phones know (you compare a 6-digit code to approve it), through our cloud storage, where it's deleted as soon as the new phone has it. Afterwards our server keeps a separate copy of each still-encrypted message for each linked phone until that phone fetches it, and your phones send each other, end-to-end encrypted, what you send, read and receive nearby. A community's admins can set its place (a city, college or area) and the rough area it's in, which everyone can see.

Ads in Chirps

Chirps, the public communities, shows ads from Google AdMob between posts and under a post, marked “Sponsored”, to help pay for running Chirping. There are never ads in chats, calls or Chipchip, and Google never sees your messages, which stay end-to-end encrypted. To choose and show ads, Google's AdMob receives your phone's advertising ID, its IP address (and so a rough location), basic device and app details, and how you interact with the ads; ads may be personalised from this. In the EEA, the UK and other places where the law asks, you're asked for consent first and can change your answer in Settings → Ad Privacy Choices. Anywhere, you can reset or delete your advertising ID in Android's settings (Privacy → Ads). Ads are limited to content suitable for teens. How Google uses this: policies.google.com/technologies/partner-sites.

Community admins and removed content

Each Chirps community has up to 3 admins (its creator and the next people to join), shown publicly on the community. Admins can remove posts and comments that break the rules, warn members and ban them from that community; the reason for a removal is shown to everyone. A copy of removed content is kept for Chirping's chief moderators to review. Only chief moderators can see a community's full member list; others see its admins and any members they already know. If you add a GIF to a comment, your search is sent to GIPHY (giphy.com) to find GIFs, and the GIF is loaded from GIPHY's servers; only the GIF's id is stored with your comment.

Deleting your account

Settings → Delete Online Account removes your login, username, directory entry and your Chirps posts and photos from the server. Erase All Data removes everything stored on your phone.

Services we use

Google Firebase Authentication, Cloud Firestore (account and encrypted relay), Cloud Storage (encrypted Chipchips), Cloud Vision (SafeSearch checks of Chirps photos), Cloud Functions and Firebase Cloud Messaging (content-free wake-up signals), Firebase App Check and Google Play Integrity (checking requests come from the real app), GIPHY (GIF search, only if you use GIFs), Audius (songs, only if you use them), Cloudflare (relaying calls that can't connect directly, storing encrypted files until they're delivered, Chirps photos, this website, and forwarding emails sent to our chirping.in addresses), Brevo (sending our replies to those emails), and Google Play services Nearby Connections (offline messaging). Their use is governed by Google's privacy policy. Google AdMob shows the ads in Chirps (see Ads in Chirps). Chirping includes no analytics SDKs.

Children

Chirping is not directed at children under 13.

Changes and contact

Chirping is developed by Dr. Faruk Hasan Biswas, Cooch Behar, West Bengal, India. If this policy changes, the new version will appear in the app and at chirping.in/privacy. Questions: [email protected]. Feedback (Settings → Send Feedback opens your email app): [email protected].