Skip to content
CrewChirpOpen app

Privacy · updated 11 September 2026

What stays on your phone, and what does not

CrewChirp is built so that the people running it do not hold your messages, your keys or a list of your contacts. This page describes the software as it exists today, including the parts that are still being tested. It is written by engineers, not lawyers, and it will be updated before any paid service launches.

The short version

No account

Your identity is a key pair generated on your device. We do not know who you are, and there is nothing to sign up for.

No message server

Nearby messages go phone to phone. We operate no server that stores or forwards them today.

No analytics

The app contains no analytics or advertising code and never uploads contacts, recordings or location.

Stored on your device

Recovery seed and keysDerived from a 12-word recovery phrase. On Android the seed is protected by the phone's hardware-backed keystore; in a browser it is wrapped and kept in that browser's storage. Never sent anywhere.
ContactsAddresses, public keys and the names you give people. Local only.
Messages and voice clipsKept in the app's local database until you delete them. Voice clips are audio recordings you chose to send; they are encrypted in transit and stored only on the sending and receiving devices.
Settings and diagnosticsConnection mode, power mode, theme. The Test status report contains versions, counters and error text — no names, addresses in full, or message content — and is only shared if you copy it yourself.
BackupsCreated only when you ask, encrypted with a password you choose, saved where you choose. We never receive them.

What other phones can see (nearby messaging)

Every message is encrypted on your device for one recipient and signed with your key. Phones that carry a message along cannot read it. They can, however, see routing metadata:

Sender and recipient addresses32-character identifiers derived from public keys — not names or phone numbers, but stable for as long as you keep the same identity.
Timestamps, size and hop countNeeded to expire, de-duplicate and stop forwarding messages.
Radio presenceWhile Nearby is on, phones in range can tell a CrewChirp device is advertising, under the display name you chose. Turn Nearby off to stop this.

CrewChirp therefore does not provide anonymity. It provides confidentiality of message content and authenticity of the sender.

Network services the app may contact

Nearby-only modeThe app opens no internet connections of its own. Bluetooth and Wi‑Fi are driven by Google Play Services (Nearby Connections) on Android; that system component is subject to Google's own policies and outside our control.
Internet mode (browser, or phone app in Auto)To find a paired friend online, the app contacts a public matchmaking service (PeerJS signaling at 0.peerjs.com) and public STUN/TURN relays (Google STUN, Metered Open Relay). They see your IP address, a peer ID derived from your address, and — for TURN — encrypted bytes they cannot read. These are third-party, best-effort services with no agreement with us.
This websiteStandard hosting logs (IP address, requested page, browser type) kept by our hosting provider. No cookies are set by us and no analytics run. The browser messenger at /app stores your data in your browser, not on the server.
Crash reportingInside the development preview only, unhandled errors are forwarded to the development tooling. The published app and website do not send crash reports.

Optional paid services (not launched)

We are evaluating monthly internet services: relayed delivery, a temporary encrypted mailbox for offline friends, crew administration and optional encrypted cloud backup. Nothing is live and nothing is priced. If and when they launch, these rules already apply by design:

  • · Relays and mailboxes receive only ciphertext. They never receive decryption keys and cannot read messages or play voice clips.
  • · Visible metadata will be limited to: addresses involved, timestamps, sizes, and the usage counters needed to enforce your allowance.
  • · A paid-service account is separate from your messaging identity, so paying does not attach your name or card to your address on the mesh.
  • · Usage limits are enforced by counting bytes and requests, never by inspecting content.
  • · Losing a subscription or hitting a limit pauses the hosted service only. Nearby messaging, local history and local backup are never withheld.

Permissions we ask for

Nearby devices / Bluetooth / Wi‑FiDiscover and talk to nearby phones. Android 10–12 additionally require Location for Bluetooth scanning; the app does not read GPS coordinates.
MicrophoneOnly while you hold the record button.
CameraOnly while scanning a pairing QR code.
NotificationsLocal notifications for incoming messages. No push server is involved.

Children, changes and contact

CrewChirp is not directed at children under 13. This page will change as the app changes; the date at the top is the version you are reading. CrewChirp is operated by neoLEGALAi LLC. A contact address for privacy questions will be published here before any paid service opens.