01Introduction
QCloak is a messaging application with quantum-resistant, post-quantum end-to-end encryption. This policy describes what data we process, for what purposes and for how long, in accordance with Regulation (EU) 2016/679 (GDPR).
The core principle: the content of your communications is encrypted on your device and can only be read by the recipient. The service provider is not technically able to read it.
02Data we process
2.1 Data provided during registration
| Data | Purpose | Legal basis |
|---|---|---|
| Phone number | Account identification, sending the OTP code | Performance of a contract (Art. 6.1.b GDPR) |
| Registration code (redeem code) | Authorization to access the organization's domain | Performance of a contract |
| Nickname | Identification between users | Performance of a contract |
| Profile picture (optional) | Personalization | Consent (Art. 6.1.a GDPR) |
For sign-ins via Microsoft Entra ID, we receive the email address and display name from the identity provider.
2.2 Technical data generated by use
| Data | Purpose | Retention |
|---|---|---|
| Cryptographic public keys | Allow other users to encrypt messages to you | Until account deletion |
| Push notification token (FCM) | Notification delivery | Until logout or account deletion |
| Online status and last seen | Presence functionality | Latest value, overwritten |
| Organization domain | Segregation between organizations | Until account deletion |
| Encrypted messages and encrypted attachments | Delivery | See §4 |
2.3 Data we do NOT process
- We do not read message content. Text, images, videos, audio and documents are end-to-end encrypted. The server only stores the encrypted text, which cannot be decrypted without the private key held on the recipient's device.
- We do not store private keys. They are generated exclusively on the device and are never transmitted.
- We do not collect analytics, profiling or advertising data. The app does not integrate any advertising tracking SDK.
- We do not sell or share data with third parties for marketing purposes.
03Encryption
Message content is protected with AES-256-GCM. The encryption key of each message is in turn protected by the key-exchange scheme configured by the organization, which may include post-quantum algorithms (ML-KEM-768, FIPS 203 standard) combined with classical algorithms (RSA-3072 or ECDH P-521).
Private keys are stored:
- on Android, in the Android Keystore (with hardware backing where available);
- on iOS, in the Keychain (with Secure Enclave on supported devices);
- in browsers, encrypted with a local key in
localStorage.
The local message archive is encrypted with SQLCipher on mobile devices.
04Message retention
Encrypted messages pass through our servers only for as long as needed for delivery.
- If the organization has enabled the "delete after reading" option, the message is removed from the server as soon as the recipient receives it (for groups, once all members have received it). Attached files are deleted too.
- Otherwise, the message remains on the server marked as delivered, until the account is deleted or the user removes it.
The local copy on your device remains until you delete it or uninstall the application.
05Recipients and transfers
Data is processed through the following providers (data processors under Art. 28 GDPR):
| Provider | Service | Location |
|---|---|---|
| Back4App | Application hosting and database | EU |
| Google (Firebase Cloud Messaging) | Push notifications | EU / USA |
| SMSTools | Sending OTP codes via SMS | EU |
| Microsoft (Entra ID) | Enterprise authentication, where enabled | EU / USA |
Push notifications contain only the sender's name and a generic indication ("new message"): the content is never included in the payload.
Back4App is a company based in the United States: the data is hosted on infrastructure located in the European Union, while the company operating it is subject to United States jurisdiction.
For transfers outside the EU, the Standard Contractual Clauses approved by the European Commission apply.
In on-premise deployments, all components can be hosted on the organization's own infrastructure, without third-party providers.
06Reports and moderation
If you report a user or a message, we record: your identity as the reporter, the reported user, the reason and — if you report a specific message — the metadata and encrypted text of that message. Because the content is encrypted, the moderator cannot read it unless you provide a decrypted copy. Legal basis: legitimate interest in the security of the service (Art. 6.1.f GDPR).
07Multiple devices
Your account can be linked to multiple devices at the same time. Each device generates and holds its own independent cryptographic key pair: if one device is compromised or removed, the keys of the other devices linked to the same account are not affected.
08Your rights
You can exercise, at any time, the rights provided for in Articles 15-22 GDPR: access, rectification, erasure, restriction, portability and objection. Write to info@quantum2pi.com.
Account deletion: you can delete your account yourself from the app, under Profilo → Elimina definitivamente il mio account (Profile → Permanently delete my account). This removes the profile, sent and received messages, attachments and keys. This action is irreversible.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
09Minors
The service is not intended for individuals under 18 years of age.
10Changes
Any updates will be published in this section along with the relevant date. Material changes will be communicated within the application.