Effective date: [TO BE APPROVED]. ComX is provided by [LEGAL ENTITY OR DEVELOPER NAME], at [REGISTERED ADDRESS, COUNTRY]. Privacy contact: [PRIVACY EMAIL].
Data we process
ComX processes display name, username, account and device identifiers, registered devices, contact relationships, device public keys, notification tokens, security and session records, a Recovery Key verifier, and recovery or revocation audit data.
To route messages and calls, the service processes participant identifiers, message and call identifiers, timestamps, read state, ciphertext or blob sizes and network information such as IP addresses. Cloudflare may process network and security data, and Google Firebase Cloud Messaging processes push-routing identifiers.
Content encryption and its limits
Message content and current-format attachment content are encrypted on the user's device. The server routes and stores ciphertext rather than normal readable message content. This does not hide operational metadata such as who communicates, when, account and device relationships, sizes or network addresses.
Legacy attachments produced by older versions may not have had the same content protection. Access is authenticated while retention and migration rules are reviewed. Live WebRTC audio calls are not recorded by ComX, but signaling services and STUN or TURN infrastructure may process IP and network metadata.
Purposes
- Provide accounts, devices, contacts, messaging, attachments, notifications and audio calls.
- Authenticate devices, recover account control and revoke lost devices.
- Synchronize read state, prevent abuse, rate-limit requests and troubleshoot failures.
- Handle user reports and comply with applicable legal obligations.
Retention and deletion
An authenticated in-app deletion request immediately suspends the account and provides exactly 24 hours for secure cancellation. After that deadline, deletion processing begins. Active server data is intended to be removed promptly.
- Backup retention: proposed maximum 30 days — not legally approved.
- Operational logs: proposed 30 days — not approved.
- Closed moderation cases: proposed 90 days — not approved.
- Minimal deletion receipt: proposed 90 days — not approved.
ComX cannot remotely delete copies already stored on recipients' devices. Legal or security exceptions require a documented basis and approved retention period.
Providers and transfers
ComX uses Cloudflare for connectivity and protection and Google Firebase Cloud Messaging for push delivery. Exact legal entities, regions and processor agreements remain [TO BE CONFIRMED]. ComX does not currently contain advertising SDKs. The owner must confirm the final no-sale and no-advertising statements.
Your choices and rights
Users can manage their display name, contacts, blocked users, notification permission and registered devices through the app. Access, correction, deletion, portability, objection, complaint and appeal procedures depend on [TARGET JURISDICTIONS AND APPROVED PROCESS].
Children
Minimum age and target audience: [OWNER AND LEGAL APPROVAL REQUIRED].
Contact
Privacy: [PRIVACY EMAIL]
Support: [SUPPORT EMAIL]
Postal address: [REGISTERED ADDRESS]