Hollow is a messaging app at chathollow.com. "Hollow", "we" and "us" mean the people who run it. The Hollow server is called the relay here: it passes messages between devices and keeps the small amount of data described below.

Questions about this policy, or requests about your data: support@chathollow.com.

• Your seed phrase and private key. They are what decrypts your messages, and the relay never receives them.
• The interests you pick in Discover to sort the community list.
• App settings like your sound choices, stored in your browser.

Your public profile

Your Hollow ID, public key, and whatever you add: display name, username, picture, bio and banner. Anyone who looks up your ID or username can see these, which is how people find and message you.

Friends and blocked lists

The IDs on each list, so they carry over to your other devices. These are stored as-is, not end-to-end encrypted.

Encrypted chat history backup

A copy of your chat history, backed up automatically so you can restore it on another device. It's encrypted on your device with a key made from your identity, and that key is never sent to us, so we only ever hold ciphertext we can't read.

Messages waiting for delivery

If you're offline, messages sent to you wait on the relay, still encrypted, until your device connects. They're deleted from the relay once delivered. Up to 200 can wait per identity; messages with a timer are dropped when the timer runs out.

Communities

Each community's name, description, members, rooms, and its recent messages and images (up to 200 messages per room). Messages are encrypted on disk, but with a key the relay holds, so we can read them. That's why every community shows a "not encrypted" badge.

Feed

Your posts and photos, replies, likes, reposts, quotes and follows, all of which are public on Hollow. Your bookmarks, which only you can see. Reports, with the reason given: the relay records who reported a post so nobody can report it twice, but the person reviewing reports sees only the reasons, never who sent them.

Reports

When you report someone, a message or a community, the relay keeps what was reported, the reason, and any note you add. For a message in a 1:1 or group chat, that includes the text of the message you chose to report, sent by your device, since the relay can't read those chats itself. The relay records who filed each report so the same report can't be filed twice, but the person reported is never told, and neither is the person reviewing it.

Optional extras

If you set a login PIN, a scrypt hash of it, never the PIN itself. If you turn on notifications, your browser's push subscription. The conversations and communities you've muted. If you have Premium, your custom background and notification sound, so they sync across your devices.

Premium

Premium works by one-time codes. The relay records which identities have Premium and which codes have been used, and by whom. For a crypto payment, the relay keeps the transaction ID so it can't be used twice, but doesn't record which identity it paid for. For a card or PayPal payment, the processor handles your payment details and the relay only ever sees a code. That code does keep the processor's order reference and which identity redeemed it, so a card payment can be connected to the identity that used it.

• Your IP address. Used while you're connected to limit abuse, like too many sign-ups from one place. The relay doesn't write it to disk, but our hosting providers may log it (see below).
• Who is talking to whom, and when. The relay needs the sender and recipient of each message to deliver it. It can't see what's inside a 1:1 or group message.
• Whether you're online. Shown to your friends, and to nobody else.

Hosting

The relay runs on Render, behind Cloudflare. Every request passes through them, so they process your IP address and connection details under their own privacy policies.

GIFs

When you use the GIF picker, your search and your IP address go straight from your device to Giphy. A GIF sent in a chat is loaded from Giphy by everyone who sees it.

Voice and video calls

Calls connect your device directly to the other person's. To set that up, your device contacts a Google connection server (STUN), and the person you're calling can see your IP address.

Notifications

If you turn them on, notifications are delivered by your browser or phone maker's push service, such as Apple, Google, Mozilla or Microsoft. Each notification is encrypted for your device and says at most who a message is from, never what it says.

Link previews

When a Feed post contains a link, the relay fetches the page to build the preview. Your device doesn't, so the linked site doesn't get your IP address.

Payments

Card payments go through Stripe and PayPal payments through PayPal, under their own privacy policies. Crypto payments happen on public blockchains, and the relay checks them with public blockchain lookup services.

Market data

The stock ticker and Premium's crypto prices are fetched by the relay from public price services. Nothing about you is sent with those requests.

• No advertising, and no ad or analytics trackers of any kind.
• No cookies. The app keeps its data in your browser's own storage.
• We never sell, rent or trade information about you.
• We never ask for an email address, phone number or legal name.

We keep what's listed above for as long as your identity uses Hollow, unless you remove it sooner. You can:

• Delete your own Feed posts at any time.
• Leave any community, and edit or clear your profile.
• Delete your whole account with Delete Identity Permanently in Settings.

Deleting your account erases, from the relay and from that device: your profile and username, friends and blocked lists, encrypted chat history backup, messages waiting for you, Feed posts (with the replies under them), likes, reposts, follows, notifications and bookmarks, your messages, reactions and poll votes in communities, PIN, notification subscription, mutes, Premium status and custom background and sound. Communities you own pass to one of their moderators, or are deleted if they have none. Your other devices are signed out. It takes effect immediately and can't be undone.

A few things are kept on purpose. Messages you already sent in 1:1 and group chats stay on the other person's device, where we can't reach them. Your ID and the date it was deleted are kept for 90 days, so a device of yours that was offline at the time also signs out instead of re-uploading its copy. Bans and reports about the account are kept, because an ID comes from the seed phrase and logging back in would otherwise undo a ban. Reports you filed are kept without your ID.

If you can't get into the app, email support@chathollow.com with your Hollow ID and we'll help.

We can only hand over what we have. We can't provide the contents of 1:1 or group chats, or your chat history backup, because we can't decrypt them. If legally required, we could be made to provide the data we do hold, as listed above.

Hollow isn't meant for children under 13. We don't knowingly collect data from children. If you believe a child is using Hollow, email us and we'll remove what the relay holds for that identity.

1:1 and group messages are encrypted on your device with an ECDH key exchange and AES-GCM before they're sent, with a fresh key for every message. Connections to the relay use TLS. No system is perfectly secure, so keep your seed phrase private and your devices up to date.

If we change what Hollow collects or how it's used, we'll update this page and the date at the top. For anything significant, we'll say so in the app as well.