beChat is designed to minimize personal data. We do not require email addresses, phone numbers, or legal names to create an account.
1. Registration data
When you register, beChat creates an auto-generated 8-character PIN and a device fingerprint. These values help identify your account and device without requiring personal contact information.
2. Messages
Messages are end-to-end encrypted using a Double Ratchet construction with post-quantum cryptography. The beChat server cannot read message content.
3. Attachments
Attachments are encrypted with AES-256-GCM-SIV before upload. Plaintext attachments are not uploaded to the server.
4. Local storage
Local message data is stored in SQLCipher-encrypted storage. The encryption key is keyed by the user's PIN.
5. Server data
The server stores only the data needed to operate the service: your PIN, device fingerprint, public keys, and encrypted message blobs.
6. Transport security
Requests are protected with TLS, certificate pinning, and HMAC request signing.
7. Tracking and SDKs
beChat does not use analytics, crash reporting, advertising libraries, or third-party SDKs that collect user behavior. The only external service used is Google Firebase Cloud Messaging for Android push notifications, and those payloads are encrypted and contain no message content.
8. Account deletion
You can delete your account from inside the app in Settings. You can also request deletion by emailing privacy@bechat.world. See the data deletion page for instructions.
9. Contact
For privacy questions or deletion requests, contact privacy@bechat.world.