Privacy policy
Hum Kalam is a private chat app for families. This page explains what the app stores, why, who processes it on our behalf, and how to delete it. If anything here is unclear, email humkalam@hssan.dev.
What we store
- Your account
- Your Google account's email address, name and profile picture, which you share when you sign in with Google. You can change the name and picture shown in Hum Kalam.
- Your access settings
- Whether you're an admin or blocked.
- Messages and media
- The messages, photos, videos, voice notes, audio files and documents you send, with captions, replies, read receipts and the time they were sent. Group names and pictures.
- Location you choose to share
- When you share your current location, we store its latitude, longitude and accuracy with that message. When you share live location, we update those coordinates for the duration you choose: 15 minutes, 1 hour or 8 hours. Location is never shared continuously unless you start live sharing.
- Calls
- Who called whom, when, whether the call was answered, and how long it lasted. The sound and picture of a call are not recorded or stored.
- Activity
- When you were last active, so family members can see you're online, and a short-lived marker while you type.
- Your device
- A push token for your phone, so we can notify you about new messages and calls.
What stays on your phone
If you allow it, Hum Kalam reads the names and email addresses in your phone's contacts to show family members under the names you saved for them. Your contacts are read on your phone only. They are never uploaded or stored by us.
The microphone is used only while you record a voice note or are on a call. The camera is used only during a call, and only while you have it turned on. Location permission is requested only when you choose to share your location. Live sharing continues in the background with a visible notification until you stop it, the selected time expires, or the app is force-stopped. These permissions are asked for only when first needed. Call sound and video are streamed live, encrypted on your phone with a key unique to each call that Agora never receives, and never recorded or stored.
Why we use it
Only to run the app: to let people sign in, deliver messages, locations and calls between them, and send notifications. We don't sell your data, show ads, or use it for tracking or profiling. We use your location only to provide the current or live location sharing you start.
Who can see it
Your messages, media and shared locations can be read only by the members of the chat they were sent in. Opening a shared location sends its coordinates to the maps app or website you choose, which then handles them under its own privacy policy. Other users can see your name, email, photo and online status, and whether you're an admin or blocked. Admins can block or delete accounts.
These services store or carry data for us:
- Google Firebase: sign-in, messages, profiles and push notifications.
- Cloudflare: photos, videos, voice notes and files, and delivering notifications.
- Agora: carries the sound and video of calls between phones. Each call is encrypted with a key unique to that call, which Agora never receives.
- Vercel: issues a short-lived permission for each call.
Data is sent over encrypted connections. Messages are not end-to-end encrypted: the services above could technically access stored data.
How long we keep it
We keep your data while you have an account. Stopping live location ends further updates; the last shared coordinates remain in the message. When you delete a location message for everyone, its coordinates are erased. When you delete any other message for everyone, its text is erased and its media can no longer be opened in the app. When you delete your account, we delete your profile, picture, admin role and push tokens, remove you from every group, and delete your sign-in account.
If you are blocked, deleting your data removes the same things, but we keep a record of the block and your sign-in account, so the block stays in place.
When an admin deletes your account, your profile and photos are removed, but your Google sign-in record stays until the owner removes it. You can sign in again and start with an empty account, unless the admin also blocked you.
Messages you sent stay in the chats of the people you sent them to, without your name or picture, the same as with a letter you've posted. If you'd like those removed too, email us and we'll delete them.
Deleting your account
In the app, open Profile and tap Delete account. If you are blocked, tap Delete my data on the screen you see instead. If you can't open the app, follow the steps on the account deletion page.
Children
Hum Kalam is for families. It isn't directed at children under 13, and we don't knowingly collect their data without a parent's involvement.
Changes
If this policy changes, we'll update this page and the date at the top.
Contact
Email humkalam@hssan.dev.