Legal
Privacy Policy
Draft. This policy is not yet in effect and will be reviewed by a lawyer before poqop launches.
The short version
- We don't ask for your name, phone number, email or contacts.
- Messages and photos are end-to-end encrypted. We can't read them.
- Our servers keep encrypted messages only until they're delivered, and never longer than 3 hours and 5 minutes after sending.
- We don't use advertising or analytics tools, and we don't sell or share your information.
- To deliver messages, our servers know which anonymous IDs share a room while you're connected.
1. Who we are
poqop is operated by [your full legal name], an individual doing business as forestbook.me ("forestbook.me", "we", "us"), [contact address]. You can contact us at support@forestbook.me.
This policy explains what information the poqop app and service process, why, and for how long.
2. Information we don't collect
- Your name, phone number, email address or contacts. If you use the contact form on our website, we receive the email address you give there, which isn't linked to your poqop account.
- The content of your messages and photos in readable form, except when you choose to send it to us in a report (section 5).
- Your location.
- Advertising identifiers. poqop contains no advertising or third-party analytics tools.
3. Information we process
The table shows what our servers hold, why, and when it's deleted.
| Information | Why | How long |
|---|---|---|
| Anonymous ID and public encryption keys, created on your phone | To identify your account and let you connect | Until your account is deleted |
| Which anonymous IDs share a room | To deliver messages only to the two people in the room | While you're connected. Deleted when the connection ends |
| Encrypted messages and photos | To deliver them to the other person | Deleted once delivered, and in any case no later than 3 hours and 5 minutes after sending |
| Message timing: sent time, read time, deletion time, unsend and screenshot notices | To run the disappearing timer and tell the other phone to delete | Deleted once the other phone confirms, and no later than 3 hours and 5 minutes after sending |
| Connection-ended notice: room ID, the other person's anonymous ID and the end time | To tell the other phone that the connection ended | Until that phone confirms, or 30 days, whichever comes first |
| Block records: the anonymous IDs of the person who blocked and the person blocked | To stop blocked people from reconnecting | Until the block is removed or either account is deleted |
| An encrypted package of your room keys and passcodes when you move to a new phone. We can't read it: the key is only in the QR code on your phone | To move your rooms to your new phone | Deleted as soon as the move finishes on your new phone. If it's never received, it's deleted after 10 minutes; if it's received but not finished, 10 minutes after that. A record that the move took place (without the package) is kept for 30 days |
| Invite codes | To connect two people | Expire after 10 minutes and can be used once |
| Push notification token, and the notification wording you choose | To send notifications that contain no names or messages | Until your account is deleted. Replaced when it changes |
| Subscription status and a purchase link (an anonymous account token and transaction ID) | To know whether you have a paid plan | Only as long as needed to manage your subscription |
| Current device session identifier | To reject access from an old phone after a transfer | Until account deletion; replaced on each transfer |
| Invite, screenshot notification, transfer, and push settings counters | To limit abuse | Deleted by scheduled cleanup after 1 day |
| Daily message and report counters | To limit spam | 1 day |
| Reports you send (section 5) | To review abuse | 90 days |
| Messages you send through our website's contact form, and the email address you give | To reply to you | 1 year |
| A one-way hash of your IP address, made with a key that changes every day | To limit spam on the contact form | 1 day |
| Suspension records | To keep a suspended anonymous ID from using poqop | Until that account is deleted |
The poqop app and service do not record your IP address. The only exception is the contact form on our website, which keeps a one-way hash for one day to limit spam. Our hosting provider may process it briefly to deliver network traffic, and we keep its logs for the shortest period available (1 day).
We use the connection-ended notice to tell the other phone that a room has closed. While we hold it, it links an anonymous ID to a room that ended. We delete it on the schedule above.
4. Information on your phone
Messages, photos, room keys and passcode information are stored only on your phone, encrypted with a key protected by the iPhone Keychain or the Android Keystore. They're deleted when the timer runs out, when you end the connection, or when you delete the app. poqop doesn't back them up to any cloud. Photos you send or receive are not saved to your photo library.
We can't recover your passcodes, messages or rooms, because we never have them.
5. Reports
If you report someone, you choose which messages and photos to include (up to 100 messages and 3 photos) and agree to send them. Those messages reach us in readable form so that we can review them. A report also includes the reason you chose, any details you write, and the anonymous IDs of you and the person you reported.
We use reports only to review abuse and enforce our Terms, for example by suspending an anonymous ID. Reports are deleted after 90 days, and unfinished reports after 1 day.
6. Age
poqop is for adults 18 and over. Where available, we ask Apple or Google for an age range from your device (Apple's Declared Age Range or Google Play's Age Signals). We receive only the age range, not your date of birth or identity. Where it isn't available, we ask you to confirm your age. We don't knowingly allow anyone under 18 to use poqop.
7. Service providers
We use these providers to run poqop. They process information only on our behalf.
- Google Firebase and Google Cloud: servers, database, storage of encrypted data, push notifications and app integrity checks. Data is stored in the United States.
- Apple and Google: push notification delivery, in-app purchases and age signals. Apple and Google handle payments under their own privacy policies. We never receive your Apple ID, Google account or payment details.
We don't sell your personal information or share it for advertising.
8. Legal requests
We may disclose information we hold if the law requires it. Because messages are end-to-end encrypted and deleted quickly, and because we don't know who you are, we generally hold very little: the anonymous records in section 3.
9. Security
Messages and photos are encrypted on your phone with keys only the two phones in the room have. Our servers accept requests only from the genuine app and check that each request comes from someone in the room. No system is perfectly secure, and no app can stop someone from photographing a screen with another device.
10. Deleting your account
You can delete your account from the app's settings. This ends all your connections and deletes your anonymous ID and the records linked to it, including blocks and suspension records. Reports you sent or that name you are kept for up to 90 days, as described above. Deleting the app also removes everything stored on your phone. A paid subscription must be cancelled separately in the App Store or Google Play.
11. Your rights
Depending on where you live, including California, the United Kingdom and the European Economic Area, you may have the right to access, correct or delete your personal information, or to object to how we use it. Because we don't know who you are, we may need you to use the app to make a request, for example by deleting your account. You can contact us at support@forestbook.me, and you have the right to complain to your local data protection authority.
Where the GDPR or UK GDPR applies, we rely on performing our contract with you to run the service, on our legitimate interest in preventing abuse to handle reports and blocks, and on legal obligations where they apply. Data is stored in the United States.
12. Changes
If we change this policy, we'll update the effective date above. If a change is significant, we'll tell you in the app before it takes effect.
13. Contact
[your full legal name] (forestbook.me)
[contact address]
support@forestbook.me