Privacy Policy

A username (it can be made up), a password that you choose, and a public name so your contacts can recognise you (it can also be made up). No email. No phone number. No data that links you to a real person, unless you pay with Apple or Google (we explain this in “If you pay with Apple or Google”).

Almost everything travels directly from one device to another. When this is not possible (for example, due to the network you are on), the connection passes through our relay server, which cannot read anything because everything is end-to-end encrypted. To look after that server, it counts how many bytes each account has carried each day: a single number, without knowing what was sent or with whom, which is deleted after 93 days. We use it only to size the service and so the relay is shared fairly among everyone.

In addition, the app anonymously sends technical totals: how many connections were direct and how many went through the relay, how many bytes in each case, and how long they took to establish. They are added into global figures, with no account, no IP, and no link between reports. They help us know if Solo2 is working well and how much capacity it needs.

For an exhaustive detail of all fields we store, how we protect them, and how long we keep them, see our Transparency Manifesto

The processing of your data is based on the following legal bases of the General Data Protection Regulation (GDPR)

• Execution of the contract ( Art. 6.1.b RGPD ): Your account data is necessary to provide you with the service.
• Legitimate interest ( Art. 6.1.f RGPD ): Anonymous measurement of visits to the presentation page (no cookies, no IP, no identification).
• Legal obligation ( Art. 6.1.c RGPD ): Preservation of records of payments for tax obligations.
• Legitimate interest ( Art. 6.1.f RGPD ): Count, for each account and day, the bytes that pass through the relay server (TURN). It is a single number, and serves to size the service and protect the relay from abuse with a fair-use limit.
• Execution of the contract (Art. 6.1.b RGPD) and legitimate interest (Art. 6.1.f RGPD): the reference of purchases made with Apple or Google, to apply each payment and refund to your balance, and retain it for 12 months after the subscription ends in case of a late refund or a legal requirement.

Each type of data has a different retention period, detailed in our Transparency Manifesto

• Account data: until you delete your account.
• Sessions: maximum 24 hours.
• Connection signals: maximum 60 seconds, in memory only.
• Linking requests: maximum 3 days.
• Records of payments on the web: permanent (tax obligation). They contain the amount, date and time, order and invoice numbers, and the bank's authorisation code; if you request a full invoice, also the tax details you give us (name or company name, NIF, and address). Once the balance is credited, they contain no data linking the payment to your Solo2 account.
• References of purchases with Apple or Google: while the subscription is active and 12 months more; afterwards they are deleted automatically.

All our servers are located in Germany

Payments are processed through external payment gateways, which receive the payment details you enter on their page (for card payments, the card number and your bank's verification) and process them in accordance with their own privacy policies. We do not receive or store your card details. If you request a full invoice, we store the tax details you give us, solely in the billing system.

If you pay with Apple or Google, our server queries the store's servers to verify each purchase. Apple and Google process your payment data on their own, according to their own privacy policies, and may do so outside the European Union.

No link between your account and your identity, unless you pay with Apple or Google: then we store a purchase reference, needed for refunds and, in the worst case, for a legal requirement.

When you subscribe from the app, the store confirms the purchase with its own identifier. Our server uses it at that moment to verify with Apple or Google that the payment is genuine and corresponds to a Solo2 plan, and what it stores afterwards is only a reference: a fingerprint of that identifier calculated with a secret key stored separately from the database. The reference serves to recognise the same purchase when the store notifies us of a renewal, cancellation, or refund. During purchase, we also use a single-use random code linking the purchase to your account; we delete it upon confirmation, and at most within 24 hours. Apple retains it with the purchase, but it is a random number that contains neither your username nor any data of yours.

Alongside that reference, we store, linked to your account: the plan, subscription status, dates, whether it auto-renews, whether it is a store test purchase, what each payment added to your balance, and what any refund deducted. We do not store your name, email, card, or any data from your Apple or Google account, nor the price, currency, or country of purchase.

We retain all this while the subscription is active and for 12 months after it ends; afterwards it is deleted automatically, in a daily task. If you delete your account earlier, the reference is unlinked from it and deleted at the end of that same period, without any associated amount: a refund arriving later no longer affects any account.

To Apple and Google we only send what is necessary to verify each purchase: the identifier they created themselves. If you request a refund, the store may ask us about your purchase. To Google we always respond that the service was available and that Solo2 offers a free trial, with no data of yours; if you gave us permission, we add what portion of the paid month you used. To Apple we only respond if you gave us permission, to confirm that the service reached you and that Solo2 offers a free trial; usage time is calculated by Apple on its own. We never send your username, messages, or contacts, and we log nothing from these queries.

On iPhone, before your first purchase, we ask you once whether we may respond to Apple in the event of a refund. The purchase proceeds whichever answer you give. We store your response (yes or no) and the day you gave it, and a copy alongside each subscription reference; your account's response is deleted when the account is deleted.

On the landing page (not in the application) we perform anonymous visit measurement on our own servers hosted in Germany. No cookies, no IP address, no identifying anyone, and no sharing data with third parties.

Legal basis:

Right to object:

You can delete your account and all your associated technical data with a single click. No questions asked.

Under the GDPR and the Spanish LOPDGDD, you have the right to:

• Access: Know what data we have about you. Everything is detailed in the Transparency Manifesto; For your specific account, contact us.
• Correction: You can change your public name and password directly from the application.
• Deletion: Delete your account and all associated data with one click, from settings.
• Portability: Solo2 offers export of encrypted backups containing all your local data.
• Limitation of processing: In practice, the data we have about you is so minimal that there is hardly anything to limit. But if you request it, we will restrict any processing that is not strictly necessary to maintain the service.
• Objection: You can object to the treatment at any time. For anonymous analytics, simply disable JavaScript.

To exercise any of these rights, write to us at hola@solo2.net

If you believe we have not adequately addressed your rights, you can file a complaint with the Data Protection Commission (DPC)

Solo2 uses cryptography proven by the academic community, not proprietary schemes. The primitives are the same as those that validate peer-reviewed publications and have been deployed for years on a global scale in other systems.

• X3DH (Extended Triple Diffie-Hellman) for the initial session establishment between two contacts: both derive a shared key without ever having exchanged any secret before.
• Double Ratchet for ongoing encryption of each conversation. Each message is encrypted with a different key, which is derived and deleted immediately after encrypting the next.
• ChaCha20-Poly1305 for the authenticated encryption of each individual message, within the Double Ratchet. Data at rest — your local data and backups — is encrypted with AES-256-GCM. Both are widely deployed and validated authenticated ciphers (AEAD).
• Argon2id to derive, from your password, the key that wraps (encrypts) your master key. Resistant to attacks with specialized hardware (GPUs, ASICs).
• Curve25519 and Ed25519 for the encryption and signature key pairs. Modern elliptic curves, without suspicious "magic constants".

A key property offered by these primitives is forward secrecy: if a session key is compromised, previous messages remain unreadable. And the complementary property, post-compromise security: the conversation "self-heals" as soon as new messages are exchanged.

There is no master key, backdoor or recovery mechanism that allows us to read your messages. That includes the case of a court order: technically we cannot decrypt what we do not have.

A serious privacy policy is not just a list of what we do: it is also a clear list of what we will never do.

• We do not train AI models with your messages. It is not a voluntary promise: it is a consequence of all of the above. We do not have them at any time — the clause that sounds reassuring in other policies is intrinsically true here by construction.
• We do not sell advertising. Solo2 is a paid service, not monetized through ads. Your data is not our business model.
• We do not build profiles of use, behavior, location, contacts or interests. We also don't have a social graph that links some users to others.
• We do not share data with third parties for commercial purposes. There are three narrow exceptions, none commercial: payment gateways, which receive the amount, order number, and purchase description, in addition to the payment details you enter on their page, but never your username or any account identifier; the delivery of push notifications, which necessarily passes through your own browser's notification service (Google, Mozilla, or Apple, depending on the browser). Normal notifications only contain a generic alert. Short messages by notification are enabled by default and you can disable them at any time, for all your contacts or only for some. With them enabled, when your contact is offline, a short message can travel end-to-end encrypted inside the notification: only your contact's device can open it. Our server keeps it for a few seconds in memory and the notification service can retain that encrypted copy for up to 72 hours. The third is link previews, which are optional and off by default: only if you enable them, our server sees the link you send during the moment it reads the page. It does not store it, does not log it, and does not know who receives it, and that website only sees our server's address, never yours.
• We do not use tracking cookies, nor pixels, nor browser fingerprinting, nor external services like Google Analytics or Facebook Pixel.
• We do not log your IP address persistently. The connection needs a transient IP, but it is not saved associated with your account.

In application of Article 28 of the GDPR, the subprocessors currently involved in the provision of the service are as follows. If at any time a new subprocessor is incorporated, this list will be updated and we will communicate the change to users before it takes effect.

• Hetzner Online GmbH (Germany) — Server infrastructure with data centers in the European Union. Complies with GDPR and ISO 27001 certifications.
• Infomaniak (Switzerland) — Corporate email. Data hosted in Switzerland, a country with an adequacy decision from the European Commission.
• Payment gateways — Payment processing. They receive the amount, currency, order number, purchase description, and the payment details you enter on their page (for card payments, the card number and your bank's verification). They do not receive your username or any identifier of your Solo2 account.

When we receive a valid court order issued by a competent Spanish or European authority, we comply. The interesting question is not whether we would comply, but what we could effectively deliver.

Solo2's technical design drastically limits what we could provide to a subpoena. We do not have access to the content of messages (end-to-end encryption), we do not keep metadata of who talks to whom, we do not store connection histories and we do not keep IP addresses associated with accounts.

What we could deliver, if the case arose, are the minimum data associated with an account as described in the Transparency Manifesto: username and public name (both can be invented), a hash of the password, and a master key encrypted with that password which for us is an opaque blob. If you paid with Apple or Google, also the reference of that purchase, the plan and its dates: with it and the store records, an authority could potentially identify who paid.

This policy applies only to competent authorities in Spain and the European Union. We do not respond to requests from law enforcement in third countries without an intermediate European legal channel.