the boring-but-important bit
Cuap ("Cuap", "we", "us") makes Cuap: a private feed for exactly two people, on iPhone and on the web. This policy explains what personal data the apps and our server handle, and why. Cuap is the controller of that data.
"You" means you. "Your person" means whoever is in your feed with you. "The bird" is our mascot and has no legal standing.
Every phone or browser you use Cuap on makes its own keys, and the private halves never leave that device. Each feed has a key that only the devices in it hold. We pass it between those devices sealed, and we can't open it. Before anything you post leaves your device, it's encrypted with that key (X25519 and Ed25519 keys, AES-256-GCM encryption) and signed, so your person's phone can tell it really came from you.
That covers the text of your posts, your photos, notes, stickers, stamps and reactions, and deleting them. Our server stores and forwards scrambled bytes it can't read. Photos sit in storage the same way, encrypted.
Each feed has a security code (Settings → Privacy). If yours matches your person's, you know nobody, including us, has slipped a device in between you. If either of you adds or removes a device, the app tells you and the code changes.
I still eat the posts. I just can't read them any more. Honestly it's more relaxing.
Encryption hides what you say. It can't hide that you said something. To deliver your posts, our server has to handle these details, called metadata:
| What | Where it comes from | Why |
|---|---|---|
| An account ID | A random ID we create. If you use Sign in with Apple, Apple also gives us a stable random ID for you. We don't ask Apple for your email. | So your feeds follow you to a new phone. |
| Your devices | Each phone or browser's public keys, a name like "iPhone", and when it was added or removed. | So your person's devices know who to encrypt to, and so you can see and remove your devices. |
| Your name and colour in a feed | You type and pick them. They aren't encrypted, on purpose. | So someone holding your invite code can see whose feed they're joining before they join. |
| Feed details | Created automatically: the feed ID, its 6-character invite code, who's in it and when they joined. | Pairing, and sorting your feeds. |
| Message envelopes | For each post: who sent it, from which device, when, its order in the feed and roughly how big it is. Not what it says. | Delivering posts in the right order, and syncing a phone that was offline. |
| Read position | How far you've read in each feed. | Unread dots, on your other devices too. |
| A push token | Your iPhone, if you allow notifications. | To wake your phone when there's something new. The push itself says only "New message". Your phone decrypts the real text itself. |
| Online and typing | Your app, while it's open. | The little "typing…" and online ring. Passed straight through and never stored. |
| IP address | Every connection. | Rate limiting and keeping out abuse. Kept only in short-lived server logs. |
We know a letter was sent, and roughly how thick it was. We don't know what's inside. That's the deal.
Cuap Plus is optional. We never see your card details, whichever way you pay.
One subscription covers both people in a feed, so your person's app can see that your feed has Plus. It doesn't see how you paid.
If someone in your feed is harming you, you can report them from the app. We store the reason you picked, your optional note, and only the posts you choose to attach. Your phone decrypts them and sends them to us. This is the one way the content of a feed can reach us, and it only happens if you decide it should. We use reports to deal with abuse, and we keep them as long as we need to for that and for any legal duty.
We don't use your data for advertising or marketing, and we don't use it to train AI models. We couldn't use your posts even if we wanted to.
Your person. Everything you post in a feed is visible to the other member of that feed. That's the point. A feed holds two people, and once both are in, nobody else can join.
Us: only the metadata described above, plus anything you attach to a report. Not your posts or photos.
Nobody else. We don't sell, rent or share your personal data with advertisers or data brokers. If we ever receive a valid legal order, the only things we have to hand over are the things listed in What we can see. If Cuap is ever acquired, this policy goes with it, and the new owner would have to follow it or tell you first.
One honest warning: encryption can't stop your person taking a screenshot. Choose your person wisely. 💗
A few companies run parts of Cuap for us, under contracts that only let them use the data to provide their service:
These providers process data in the United States and possibly other countries. Where data leaves the EEA, UK or Switzerland, we rely on Standard Contractual Clauses or an equivalent safeguard in their terms.
Deleted means deleted. I don't keep a little shoebox of old posts under my wing.
Wherever you live, you can ask us to:
Your posts and photos already live on your own devices, in a form only they can read. Email us at hello@cuap.app and we'll reply within 30 days. If you're in the EEA or UK, you can also complain to your local data protection authority. California residents: we don't sell or "share" personal information as the CCPA defines it, and we won't treat you differently for using your rights.
Beyond end-to-end encryption, everything travels over HTTPS, and our server checks every request: only a feed's members can read from it or post to it, a removed device stops working right away, and nobody can post as someone else. If you lose a phone, remove it in Settings → Privacy. Your person's app will then lock the feed to a new key that the lost phone never had.
The honest limits: we can see the metadata listed above; a new device is trusted the first time it appears, unless you check the security code; and someone who gets into your unlocked phone can read what's on it. If we ever have a breach that affects you, we'll tell you and the relevant authorities as the law requires.
Cuap isn't for children under 13 (or under the age of digital consent where you live, such as 16 in parts of the EU). We don't knowingly collect their data. If you think a child is using Cuap, tell us and we'll delete the account.
If we change this policy, we'll update the date at the top. If the change is significant, for example new kinds of data or a new purpose, we'll tell you in the app before it takes effect.
The bird can't type. We can.