Privacy Policy — PeerChat

Effective date: October 8, 2026 Last updated: October 8, 2026

This Privacy Policy explains what information is handled when you use PeerChat (the "App"), where it goes, who it is shared with, and the choices and rights you have.

1. Who we are

The App is developed and published by BrightPixel (Suleiman Jaber), Israel ("we", "us"). We are the data controller for the limited processing described below.

Contact: [email protected]

We aim to reply to every privacy request within 30 days (sooner where the law requires).

PeerChat is open source (GPLv3) and based on bitchat. You can read the code to check how it works.

2. Summary

The App has no accounts, no sign-in and no phone number. We never ask for your name, e-mail or contacts, and we run no servers. We never receive your messages.
Bluetooth mesh chat works offline. Messages travel directly from phone to phone over Bluetooth (and Wi-Fi Aware where available). They do not pass through the internet.
Location chats and out-of-range direct messages use the internet through public Nostr relays run by third parties. What is sent there is explained in section 5.
Direct messages are end-to-end encrypted. Public mesh and location-chat messages are not private: anyone in the same chat can read them.
To show place names for location chats, your device's location is sent to a geocoding service (Google's Android geocoder, or OpenStreetMap on phones without one). See section 6.
The App does not use analytics or crash reporting.
The App shows ads through Google AdMob. Google and its ad partners may collect device and usage information to show, measure and (where you allow it) personalize ads. See section 7.
Where the law requires it (for example in the European Economic Area, the United Kingdom and Switzerland), we ask for your consent before personalized ads are shown, and you can change your choice at any time.
We do not sell your personal information for money. Ad-related sharing that some laws treat as "selling" or "sharing" is explained in section 11, with how to opt out.

3. Information stored on your device

The App saves the following locally, inside the app's private storage on your device:

Identity keys (created on first launch, kept in Android's secure storage): to encrypt direct messages and let your contacts recognise you
Nickname: shown to people you chat with
Messages, images, voice notes and files you send or receive: to show your conversations
Favorite and verified contacts, blocked people: to recognise people in later sessions and hide people you blocked
Joined channels, bookmarked places, pinned and muted chats, read markers: to build your chat list
Settings (theme, language, notification sounds and vibration, Tor, proof-of-work, rating-prompt and ad-timing flags): to remember your preferences and space out prompts and ads

This information is not sent to us. Panic mode (triple-tap the logo) wipes it instantly. Uninstalling the App, or clearing its data in your device settings, deletes all of it permanently.

4. Device permissions

Nearby devices / Bluetooth: to find nearby PeerChat users and exchange messages over Bluetooth
Location (precise), including in the background: Android requires location permission to scan for Bluetooth devices. Background access lets the mesh keep finding people and delivering messages while the App is closed (you can turn background mode off in Settings → Mesh). For location chats, the App also reads your position to work out your area (section 6). Your position is never stored as a history.
Wi-Fi state, network state, local network: Wi-Fi Aware mesh transport and sharing the App over a local hotspot
Internet: location chats and out-of-range direct messages (Nostr), optional Tor, place names, and ads
Camera: scanning a contact's QR code, and taking photos you choose to send
Microphone: voice notes and live push-to-talk, only while you record
Photos, videos and audio: sending media you pick
Notifications, vibration: message notifications with your chosen sound and vibration
Foreground service, run at startup, battery optimisation exemption, wake lock: keeping the mesh running in the background, if you enable it

5. Messages and what other people can see

Bluetooth mesh (offline). Nearby PeerChat and bitchat users can see your nickname, a temporary public key and the messages you send to the public mesh chat. Your messages may be relayed by other people's phones to reach further. Direct messages are end-to-end encrypted, so relaying phones cannot read them.
Location chats (internet). Messages you send in a location chat are published to public Nostr relays (for example relay.damus.io, relay.primal.net, offchain.pub, nostr21.com) together with your nickname, a Nostr public key and the geohash of the chat (an area code, for example a city block or a city, not your exact position). Public relays and anyone using them can read, store and copy these messages; we cannot delete them. Relay operators also see your IP address unless you turn on Tor (Settings → Privacy).
Direct messages over the internet. When a favorite contact is out of Bluetooth range, direct messages are sent through Nostr relays end-to-end encrypted. Relays see encrypted data and timing, not the content.
Media and files you send go only to the people in that chat, over the same paths as messages.

6. Place names (geocoding)

To show the name of your area (for example your neighbourhood or city) in location chats and bookmarks, the App sends a location to a reverse-geocoding service:

Google's Android geocoder (part of Google Play services) on most phones, or
OpenStreetMap Nominatim (nominatim.openstreetmap.org) on phones without one.

For your current area this is your device's position; for bookmarks it is the centre or corners of the bookmarked area. The service receives the coordinates, your IP address and your language, and returns a place name. Their policies apply: Google (https://policies.google.com/privacy) and OpenStreetMap (https://osmfoundation.org/wiki/Privacy_Policy). If you do not use location chats, no location is sent.

7. Advertising (Google AdMob)

The App uses Google AdMob, an advertising service provided by Google LLC / Google Ireland Limited. The App shows:

Banner ads at the bottom of the screen (hidden while the keyboard is open).
Interstitial ads: occasional full-screen ads when you go back from a chat to your chat list (never in the first minutes after opening the App, and not more often than every few minutes).

When an ad is requested or shown, the Google Mobile Ads SDK may automatically collect and process:

Device identifiers: the Android Advertising ID (or similar resettable identifiers) and app-set ID;
Device and app information: device model, operating system and version, language, screen size, app version, mobile carrier and network type;
IP address, which can be used to estimate your approximate (coarse) location (country/city);
Ad interaction data: which ads were shown or clicked, and ad performance and diagnostic data (crash and performance logs of the ad SDK).

The ads SDK does not receive your messages, nickname, contacts, channels or location-chat area. Ad requests go directly to Google and are not routed through Tor, even when Tor is on.

Google uses this information to deliver ads, limit how often you see the same ad, measure ad performance, prevent fraud and abuse, and — only where you have allowed it or where the law permits — to show ads based on your interests. Google may share it with its advertising partners as described in its policies:

How Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites
Google Privacy Policy: https://policies.google.com/privacy
Google advertising technologies: https://policies.google.com/technologies/ads

We do not receive the advertising identifier or the other raw data the SDK collects. We only see aggregated reports in AdMob (for example how many ads were shown and earnings per country).

8. Legal bases (EEA, UK and Switzerland)

Where the GDPR, UK GDPR or the Swiss Federal Act on Data Protection applies:

Personalized ads and the use of device identifiers for advertising are based on your consent (GDPR Art. 6(1)(a) and the ePrivacy rules). We ask for it through Google's consent form (a certified consent management platform under the IAB Transparency & Consent Framework) before any ad is requested.
Non-personalized ads, ad delivery, frequency capping, fraud prevention and ad measurement are based on our legitimate interest in funding a free app (Art. 6(1)(f)), within the limits allowed by your consent choices.
Sending messages, location-chat areas and place-name lookups is necessary to provide the features you use (Art. 6(1)(b)).

You can withdraw or change your consent at any time in the App: Settings → Privacy → Ad privacy choices. Withdrawing consent does not affect processing done before you withdrew it. If you refuse consent you can still use the full App; you may see non-personalized or limited ads.

We do not receive your data, so we share none of it ourselves. Data leaves your device only as follows:

Other users, when you send messages (section 5).
Public Nostr relays, for location chats and out-of-range direct messages (section 5).
Google or OpenStreetMap, for place names (section 6).
Google (AdMob) and the advertising partners Google works with (section 7), under Google's terms, which include the EU Standard Contractual Clauses for international transfers.
The Tor network, if you turn on Tor routing.

We do not use any analytics, attribution, crash-reporting or social-media SDKs, and we do not share data with data brokers.

10. International transfers and retention

Google, OpenStreetMap and Nostr relay operators may process data on servers in the United States and other countries. For advertising data from the EEA, UK or Switzerland, Google relies on safeguards such as the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

On-device data is kept until you delete it, use panic mode, delete the App or clear its data.
Messages on Nostr relays are kept according to each relay's own rules; we cannot delete them.
Advertising data is retained by Google according to its own retention policies (https://policies.google.com/technologies/retention).
E-mails you send us are kept only as long as needed to answer your request, and then deleted (at most 24 months).

11. Your rights and choices

Everyone

Use the App offline. Bluetooth mesh chat and direct messages to nearby people need no internet.
Turn on Tor (Settings → Privacy) to hide your IP address from Nostr relays.
Reset or delete your advertising ID: Android Settings → Google → Ads (or Privacy → Ads).
Opt out of personalized ads: Android Settings → Google → Ads → "Delete advertising ID" or "Opt out of Ads Personalization", and in the App: Settings → Privacy → Ad privacy choices (where shown).
Manage Google ad settings: https://adssettings.google.com
Revoke permissions in Android Settings → Apps → PeerChat → Permissions.
Delete your data: panic mode, or uninstall the App or clear its storage.
Contact us at [email protected] with any question or request.

You have the right to access, rectify, erase, restrict and object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority. Because we do not hold personal data about you ourselves, we will help you exercise these rights and point you to Google, which holds the advertising data.

United States (California CCPA/CPRA and other state privacy laws)

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with consumer privacy laws have the right to know what personal information is collected, to access and delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information for targeted (cross-context behavioral) advertising.

In the last 12 months, the categories collected through the ad SDK are: identifiers (advertising ID, IP address), internet or other electronic network activity (ad interactions), and approximate geolocation. They are disclosed to Google and its ad partners for advertising.
We do not sell personal information for money. Using advertising IDs for targeted ads may count as "sharing" or "selling" under some state laws. To opt out, use Android's "Delete advertising ID" / "Opt out of Ads Personalization" setting, the App's Ad privacy choices (where shown), or e-mail us.
We do not use or disclose sensitive personal information, and we will not discriminate against you for exercising your rights.
You may use an authorized agent; we may need to verify the request.

Israel (Protection of Privacy Law, 5741-1981, as amended)

You have the right to review information about you held in a database and to request its correction or deletion. Contact us at [email protected]. You may also contact the Israel Privacy Protection Authority.

Brazil (LGPD), Canada (PIPEDA) and other countries

You have similar rights to access, correct and delete your personal information and to withdraw consent, as provided by your local law. Contact us and we will respond within the time the law requires.

12. Children's privacy

The App lets people chat with strangers nearby and is not directed at children under 13 (or under 16 where that is the age of digital consent in your country). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has used the App, contact us at [email protected]. You can also use panic mode, reset the device's advertising ID and uninstall the App to remove all data from the device.

13. Security

Direct messages are end-to-end encrypted (Noise protocol Noise_XX_25519_ChaChaPoly_SHA256, with Ed25519 signatures). Password-protected channels use PBKDF2 key derivation and AES-256-GCM.
Keys and data stay in the app's private storage, which other apps cannot read on a standard (non-rooted) device.
Connections to Nostr relays, geocoding services and Google's ad servers are encrypted (TLS).
Public mesh and location-chat messages are not encrypted for privacy: treat them as public.

No method of storage or transmission is 100% secure, but we keep the data that leaves your device to a minimum.

14. Changes to this policy

If we change this policy (for example if we add a feature that sends new data, such as analytics, accounts, cloud backup or in-app purchases), we will update this page and its "Last updated" date before the change takes effect, and where required by law we will ask for your consent again.

15. Contact

BrightPixel — Suleiman, Israel E-mail: [email protected]