Privacy

What we collect

Our server needs some information to work, mostly who is in which group and when things were sent:

• Your email address, if you sign up with email or Apple or Google share it. If you sign in with Apple and hide your email, we keep Apple’s relay address instead. It is used for sign-in codes, never shown to other people, and you can remove it in Settings.
• Your sign-in methods (email, Apple, Google, passkeys), the identifier each provider gives, the name you gave each passkey, and when each was last used.
• Your username, which other people use to find and add you.
• Each phone signed in to your account: its model, its public keys, and when it was last active, to the hour.
• A push token for each phone, so Apple or Google can deliver notifications, which stay encrypted.
• Who shares with whom, but not what: who is in each group, plan and chat, roles, invitations, contact requests, blocks, your invite link, and when encrypted content was added and how large it is.
• How much storage you use, and your sticker pack purchases (which pack, the store’s ID for it, when, and any refund). The store handles the payment; we never see your card.

Our host keeps a log of each request to our server, with its IP address, for 7 days. When something breaks, an error report goes to Sentry with nothing in it that identifies you; it is kept for 30 days.

What’s end-to-end encrypted

Everything you create or share: plans and replies, notes, chat messages, photos and files, checklists, polls, costs, your free and busy times, your name and profile photo, and the replies guests leave on a plan’s web page. It is encrypted on your phone before it leaves, and our server stores it without being able to read it.

Your recovery key goes to iCloud Keychain on iPhone, or to Google’s Block Store on Android, so you can get your account back on a new phone. Apple and Google encrypt it end to end there. On Android it is only sent when Block Store says the backup is end-to-end encrypted, and otherwise stays on the phone. It is never on our servers.

Reports

If you report someone, you choose which of their messages to include. They are sent to us as text, with anything you write about them, and staff read them in the admin to review the report. This is the one place we hold readable content. Photos and files in a reported message are never sent.

A report is deleted 90 days after it is closed, or a year after it was sent if nobody closes it. Reports stay even if an account is deleted.

Your contacts

sama sama doesn’t upload your address book. On Android, if you allow it, the app reads only your own contact card, to fill in your profile. On iPhone, you pick a contact yourself.

Who else sees what

These services see what they need to do their part, and none of them get your content in a form they can read:

• Railway hosts our server, its database and file storage, so it holds everything the server holds.
• Cloudflare serves this website, the plan pages and the links that open the app, keeps our encrypted backups and runs our domain. It sees the IP address and the address asked for when someone opens one of those links.
• Resend sends our emails: sign-in codes and the early-access emails. It sees the email address, the email and the time.
• Apple and Google deliver notifications. They see each phone’s push token, the time, which group it is for, and sometimes the encrypted message. On Android, Google’s library also makes a Firebase installation ID for each install.
• Apple and Google know you signed in to sama sama, if you use Sign in with Apple or Sign in with Google.
• The App Store and Google Play handle payment for sticker packs.

Link previews: when you send a link in a chat, your own phone fetches the page to make the preview, so that website sees your phone’s IP address. You can turn link previews off in Settings, under Privacy.

This website and early access

This website sets no cookies and uses no analytics.

If you sign up for early access, we keep your email address, which kind of phone you use (iPhone or Android) if you tell us, and when and how you agreed to our emails, with the wording you agreed to. Resend sends the email that asks you to confirm.

A sign-up you don’t confirm is deleted after 7 days. A confirmed one is kept while you stay subscribed, or until you ask us to delete it. After you unsubscribe, we won’t send you early-access or launch emails again, and we keep the record for 3 years as proof of your consent; that period is still being reviewed.

The form uses Cloudflare Turnstile to stop spam: when you click into the email field, your browser contacts Cloudflare. Our server checks the result with Cloudflare without sending your IP address.

What we never do

• Show ads in the app
• Sell or rent your data
• Read your chats: we can’t, apart from messages you report to us

Your choices

In Settings, under Your data, Export my data downloads everything you can read in sama sama, decrypted on your phone. It also includes, in a file called server.json, what our server holds about you: your email address, username, sign-in methods, phones, sign-ins, blocks, groups, purchases and the reports you made. If your phone can’t reach the server, that file is left out and the export says so; email us for it. The export isn’t encrypted, so keep it somewhere safe.

Delete account, in the same place, deletes your account right away. Some things stay: what you wrote in groups shared with other people, still encrypted and shown as written by a deleted user; accepted contact requests; an empty account record with only the date it was deleted; your removed phones’ records, without their models; reports, as above; our encrypted backups, for up to 98 days; and our host’s logs, for 7 days. The privacy policy has the full list.

Where it’s stored

Everything our server holds is stored outside Canada: the server and its database in the United States (Virginia), files in the United States (California), and our encrypted backups in Cloudflare’s eastern North America location. Sentry and Resend are in the United States.

Canadian privacy law

sama sama is built in Edmonton, Alberta, and handles personal information under Canada’s privacy law, PIPEDA. Under Quebec’s privacy law, Law 25, the developer who runs sama sama is the person responsible for protecting it. Law 25 asks for an assessment before personal information leaves Quebec; that assessment is not written yet.

For any question about what we hold about you, email support@samasamasocial.ca; we answer within 30 days. If you are not happy with the answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d’accès à l’information.