Privacy Policy

Last updated: September 2026. This policy explains what data the Shield app and service process and why. The data controller is the company listed at the bottom of this page.

What we store

• Account: username, password (stored only as a salted hash), optional display name, profile photo and language.
• Messages and photos in chats: end-to-end encrypted on your iPhone before sending (X25519, ChaCha20-Poly1305, Ed25519 signatures). Our servers store and deliver only encrypted data and cannot read it. Encryption keys never leave your device. Messages sent before end-to-end encryption was introduced remain stored encrypted in transit only.
• Stories and profile photos: visible only to people you share a chat with (stories) and are stored on our servers without end-to-end encryption. Stories are deleted automatically after 24 hours.
• Delivery and read status: which messages were delivered and read, to show checkmarks.
• Device tokens: push notification tokens so we can notify you about messages and calls.

What we do not do

• We do not sell your data, show ads, or share your data with advertisers.
• Translation is performed on your iPhone by Apple's built-in translation; message text is not sent to us or to third parties for translation.
• Voice and video calls are encrypted end-to-end by WebRTC (DTLS-SRTP). Relay servers forward encrypted packets and cannot listen to calls.

Where data is stored

Servers are located in the European Union (Finland). Encrypted backups are stored for 7 days and cannot be read without our encryption key. Call relay (TURN) servers may be located in other countries to improve connectivity; they process only encrypted call traffic.

Retention and deletion

Your data is kept while your account exists. You can delete your profile photo and stories at any time. To delete your account and all associated data, write to us from the contact address below; we will complete the deletion within 30 days.

Your rights (GDPR)

You have the right to access, rectify, delete and port your data, to restrict or object to processing, and to lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es). Contact us at the address below to exercise these rights.

Children

Shield is not intended for children under 14.