Privacy Policy for Malakh

1. Overview

Malakh is an offline nearby communication application. Its core messaging operates directly between nearby devices without requiring an internet connection or developer-operated central messaging server.

2. Data Handling and Messaging

• No Accounts: Malakh does not require user accounts, phone numbers, or email sign-ins.
• No Central Servers: The developer does not operate a server that receives your messages, peer identities, contacts, analytics, or advertising data.
• No Analytics or Ads: Malakh contains no advertising SDKs, tracking pixels, or analytics trackers.
• Local Content Storage: User-created message content is stored locally on the sender and recipient devices in Android-protected application storage.
• Peer Communication: Messages are transmitted directly to the selected nearby device using Bluetooth Low Energy (BLE). The selected recipient necessarily receives the message and the associated authentication information required for communication.
• Recipient Device Autonomy: Data delivered to another user's device is controlled independently by that device's user.

3. Security and Authentication

• Authenticated Encryption: Message content transmitted after a secure peer session is established is protected using authenticated encryption.
• Session Establishment: Connection establishment exchanges cryptographic identity and verification information necessary to establish a session.
• Emoji SAS Verification: Users verify a Short Authentication String (SAS) represented by matching emojis to help confirm the intended peer and detect possible interception.
• Public Identifiers: Public identity information and cryptographic fingerprints may be exchanged with the selected peer for mutual authentication.
• Private Keys: Private identity-key material remains in Android-protected local storage on your device and is not transmitted to the developer.

4. Device Permissions

• Bluetooth Permissions: Nearby Bluetooth permissions (Scan, Connect, Advertise) are used for peer discovery, advertising, connection, and direct communication.
• Legacy Location Requirement: On Android 11 (API level 30) and earlier, Android OS requires Location permission for Bluetooth LE scanning. Malakh uses BLE scan results exclusively to discover nearby peer radios and does not derive, record, or retain physical location.
• Unrequested Permissions: Malakh does not request contacts, microphone, camera, or shared external media storage permissions.

5. Retention and Data Deletion

• Data Retention: Local information remains in protected application storage until removed.
• Deletion Controls: Data can be cleared locally by clearing app data in Android system settings or by uninstalling the application. Clearing local data removes the local copy on your device, but does not remove copies previously delivered to another user's device.
• No Data Sales: No data is sold or provided to advertisers, analytics companies, or data brokers.

6. Security Measures and Children's Privacy

• Security: Malakh employs reasonable cryptographic and technical measures to secure local data and peer sessions.
• Children's Privacy: Malakh is a general communication app and is not specifically directed to children.

7. Updates and Contact

This privacy policy may be updated periodically. Updates will be reflected by updating the effective date above. For questions regarding this policy, please contact malyilmathew@gmail.com.