✦Privacy policy
Privacy, plainly.
Hithra is a private, invite-only messenger. It runs on one server that its operator controls; people join only with an invite code. This page explains what the app and the server store, why, and what you can do about it. Questions: [email protected].
What is stored
- Your account: username, display name, and your password as a one-way hash (never the password itself).
- Your profile, only what you fill in: photo, cover picture, status, a few words about you, your city, your birthday (day and month, never the year) and links. Everyone on this Hithra server can see it.
- Messages and attachments you send (text and its edits, photos, videos, voice notes, documents, stickers, polls, shared places and meetups, games and countdowns, link previews) are end-to-end encrypted from Hithra 1.3 on: your phone seals them before they leave, and only the phones of the people in the chat can open them. The server stores and forwards them so they reach every device, but it cannot read them, and it cannot see the photos, videos or files either. Photos are stripped of location and camera metadata on your phone.
- Reactions, poll votes, meetup answers, live location and Moments are end-to-end encrypted too when everyone they go to has Hithra 1.5 or later; the server then only sees that someone reacted, voted or answered, and when a position or Moment arrives. With someone on an older version they go as before, readable by the server.
- What the server still sees to deliver them: who is in each chat, who sent what and when, how large it is, who is mentioned (so a mention notifies even in a muted chat), pins, read receipts, and who viewed a Moment and the emoji they reacted with. Plans and trips with their shared expenses, receipts and checklists, and your profile are not end-to-end encrypted, so they work for everyone who should see them; the operator can technically access them.
- View-once photos and videos open once on the recipient's phone. The server keeps who opened one (not shown to the sender when that person turned read receipts off) and deletes its file once everyone opened it, or after 14 days.
- Encryption keys: your phone makes them and keeps the private ones. The server stores your public keys, and a backup of your keys locked with your 12-word recovery phrase, which only you have: without the phrase nobody can open it, the operator included. The phrase cannot be reset, so if you lose it and your phone, earlier messages cannot be read on a new phone. From Hithra 1.7 the backup also keeps which messages you starred or deleted only for yourself, sealed the same way, and your own stickers (made, saved or imported): each is sealed on your phone before it goes up, and only you can fetch it. A sticker you delete leaves the backup too. A new phone can also be unlocked from your old one by scanning a code: the old phone seals your key for that new phone alone, and the server holds it for at most 10 minutes, until the new phone picks it up.
- Hithra on a computer (from Hithra 1.7): at hithra.com/web, your browser shows a code that you scan with your phone. Your phone seals your keys for that browser alone (for the key in the code); the server passes them on within 5 minutes and deletes them as soon as the computer picks them up, or within the hour if it never does. The browser keeps your chats, files and keys in its own storage on that computer, locked with a key it keeps there. The computer appears in Settings → Your devices, where you can sign it out; signing out in the browser deletes what it stored. A computer nobody uses for 30 days is signed out automatically, as if you had done it in Your devices, and the browser deletes what it stored the next time Hithra opens there.
- Before encryption: messages sent before Hithra 1.3, and new ones in a chat where someone still uses an older version, are not end-to-end encrypted, and the operator can technically access them. The chat says when it is waiting for someone to update. Once everyone has updated, the server's readable copies of the older messages are deleted; the copies on your phone stay.
- Scheduled messages wait on the server, sealed like any other message, until their time comes (up to a year ahead).
- Your chat list: which chats you pinned, archived, muted (and what still notifies you there) or marked unread, so every device shows the same list; in groups, who the admins are and what members may do.
- Group links (from Hithra 1.7): when a group's admin makes one, the server keeps it with the group until an admin resets it or turns it off. Anyone on this Hithra server who has the link can see the group's name, photo and how many people are in it, and join.
- Recent messages for someone added (from Hithra 1.7): when you add someone to a group, you can let them read its latest messages (up to 100, from the last 14 days). Each sender's phone hands over the keys to its own messages, sealed for the new member, so the server still cannot read them.
- Moments (photo or text stories) are shared with everyone on this Hithra server, or only with your close friends if you choose; people you blocked, or who blocked you, never see them. Your close-friends list is visible only to you. A Moment is deleted from the server 24 hours after you post it, together with who viewed it and their reactions.
- Live location, only while you share it with a chat. You pick the chat and for how long (15 minutes, 1 hour, 8 hours or until you stop), and only that chat's members see where you are, only while the share runs. The server keeps just your latest position and deletes it once you are no longer sharing with any chat; positions older than 48 hours are removed.
- Calls run through the operator's own media server. When everyone in the chat has Hithra 1.4 or later, a call is end-to-end encrypted: its key is made on a phone in the call and reaches the others sealed, so the media server passes on sound and video it cannot decode, and the call screen shows a lock with four emoji that match on every phone. With someone on an older version in the chat, a call is encrypted on the way but not end to end, and the call screen says so. Calls are not recorded, and neither is a shared screen: it goes live to the people in the call and nowhere else, as do reactions and raised hands. The chat keeps a note that a call happened and how long it lasted. Background blur is done on your phone, before the video is encrypted. On Android 12 and later, Hithra asks for "Nearby devices" only when a Bluetooth headset is connected during a call, to play the call through it; it does not look for or remember other devices.
- Call links (from Hithra 1.6.4): the server keeps each link's id, who made it, when it was last used and, from Hithra 1.7, whether its owner lets each new person in. The call's key stays in the link itself, after the #, so neither the server nor this website ever sees it, and the link's name is sealed with it. When the owner lets people in, the server passes on who is asking to join. A link nobody joins for 90 days is deleted.
- Invites: who created each invite code and who used it.
- Your devices: device name, platform, app version, the app's language (so notifications arrive in it), when each was last active and the tokens needed to send you notifications, so you can see and sign out your devices in Settings. A new sign-in is announced on your other devices.
- Technical data: IP addresses in the server's logs, which rotate automatically, used to keep the service secure (for example rate limits).
- Crash reports (from Hithra 1.6.3): when the app crashes, freezes or hits an error, it sends this server what broke: the error and where in the app's code it happened, the kind of screen it was on (such as "a chat", never which one), the app version, the phone model and its system version, linked to your account. Never what anyone wrote, who you talk to or anything you shared; ids, addresses and keys that an error might mention are taken out on your phone before it is sent. They are used only to fix the app, and you can turn them off in Settings → Privacy → Send crash reports.
Some things never leave your phone: the reminders you set on messages, birthday reminders, the earlier versions of edited messages, your recent and favourite stickers, your appearance choices (accent colour, text size, bubble colours, app icon, quick reactions) and a chat's Wrapped, which is worked out on the phone. A sticker you make from a photo is cut out on the phone too; on Android, the cut-out tool comes from Google Play services the first time you use it.
Who else handles data
- Notifications are delivered through Expo's push service and then Apple Push Notification service (iPhone) or Google Firebase Cloud Messaging (Android). A notification carries the sender's name. For an end-to-end encrypted message it carries the message still sealed, which only your phone can open to show its text (from Hithra 1.5, with "Message previews" on); the push services cannot read it. For older, unencrypted chats it carries the start of the message, unless you turn off "Message previews" in Settings. On iPhone, an incoming call rings through Apple's VoIP push service directly, carrying the caller's name. In a browser (Hithra on a computer), notifications you turn on come through that browser's push service (Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari), carrying the sender's name and "New message", or the caller's name for a call, never the message itself. They are encrypted for your browser, so the push service cannot read them. While Hithra is open in a tab, that tab puts the message's text in the notification itself, on your computer.
- App updates: when it starts, the app asks Expo's update service whether a fix is waiting. Expo sees your phone's IP address, the app version and a random number for this installation, nothing from your account or your chats.
- Cloudflare carries the app's connection to the server (encrypted in transit). Hetzner hosts the server in Germany.
- Link previews are fetched by the sender's phone: the website sees the sender's IP address, never the readers'. You can turn previews off in Settings.
- Maps: map images are loaded from OpenFreeMap, a free public map service that sees your phone's IP address and which area is on screen, but not who you are or where your friends are. When you plan a meetup, the name of the spot under the pin comes from your phone's own map service (Apple on iPhone, Google on Android), which is sent that point.
- GIF search (from Hithra 1.7, when this server has it on) goes to GIPHY through this server: GIPHY sees the server ask and the words searched, never who searched them or their IP address. The GIF you pick comes through the server too, and is sent sealed like any photo.
- iPhone beta: Hithra for iPhone is installed through Apple's TestFlight. Apple may share crash reports, and any feedback or screenshots you choose to send from TestFlight, with the operator.
There is no advertising, no analytics, no tracking across apps, and no data is sold or shared for marketing. This website sets no cookies and loads nothing from third parties.
How long it is kept
- Messages stay until someone deletes them, or until a chat's disappearing-messages timer removes them.
- Moments are removed 24 hours after they are posted.
- Scheduled messages are removed once they are sent or cancelled.
- The sync log that lets devices catch up is kept for 30 days.
- Crash reports are kept for 30 days, and deleted with your account.
- Server backups are kept for up to 14 days.
Your choices
- Delete messages for everyone or only for you, and turn on disappearing messages per chat.
- Delete a Moment before its 24 hours are up, or post it only to your close friends.
- Leave any part of your profile empty, and cancel a scheduled message before it goes.
- Turn off read receipts, message previews in notifications, link previews and crash reports in Settings.
- Stop sharing your live location at any time, from the chat's map or Settings → Live location. Leaving a chat stops it there too.
- Compare a security code with someone (their profile → Security code) to be sure your messages reach them with no one in between.
- Block people and report messages or people to the operator. A report includes the message you report, so the operator can see it.
- Delete your account in Settings → Account → Delete account. This removes your profile, Moments, sign-ins on every device, your position, messages still waiting to be sent, your close-friends list, your reactions to other people's Moments and your crash reports, and takes you out of every chat. Messages you already sent stay in the recipients' chats, shown as from "Deleted account". Copies inside backups disappear within 14 days.
Children
Hithra is not intended for children under 13.
Changes
If this policy changes, the new version is published on this page with a new date.