Application Privacy Policy

Kayro Mobile — Privacy Policy

Last Updated: May 8, 2026

1. About Kayro Mobile

Kayro Mobile is a secure messaging and calling application based on the open Matrix protocol. The app connects to a Matrix-compatible homeserver of the user's choice and supports encrypted one-to-one and group chats, voice and video calls, file and media sharing, and message search. End-to-end encryption (using the Matrix Olm/Megolm protocol) is enabled by default for direct chats and supported in group chats.

2. Data Controller and Contact

Fizzify Inc. publishes the Kayro Mobile application. The operator of the Matrix homeserver you connect to is the data controller for the messages and metadata routed through that server. For privacy questions about the app itself, please contact us.

3. Information the App Accesses

Kayro Mobile requests the following permissions only when you use the corresponding feature.

Permission	Why the app needs it	Where data goes
Camera	Take photos/videos to send in chats; participate in video calls.	Encrypted message envelopes routed via your Matrix homeserver; peer device(s) over an encrypted media connection during calls.
Microphone	Voice messages and audio/video calls.	Calls: peer device(s) over an encrypted media connection. Voice messages: encrypted and stored on your homeserver.
Photo library (read)	Pick existing photos and videos to send in chats.	Only the items you choose are uploaded — encrypted on-device before transmission.
Photo library (add)	Save received media to your photo library when you choose to.	Stays on your device.
Contacts	Optional: discover Matrix contacts who are also in your address book (only if you opt in to contact discovery).	Contact identifiers are hashed before being checked against the homeserver's directory; the homeserver never receives raw contact data.
Notifications	Display incoming messages and call alerts.	Notification envelopes flow through Apple Push Notification service / Firebase Cloud Messaging; payloads are minimized and decrypted on-device.
Background tasks & foreground service	Receive incoming calls, deliver messages while the app is backgrounded.	Maintains a persistent connection to your Matrix homeserver for sync.
Biometric (Face ID / Touch ID / fingerprint)	Unlock the app when an app passcode is configured.	Biometric matching happens on-device by the operating system. The app never sees your biometric data.

4. Categories of Personal Information Processed

Mapped to Apple's App Privacy and Google Play's Data Safety categories:

• Identifiers: your Matrix user ID, your homeserver URL, device IDs used for end-to-end-encryption key management, push notification tokens.
• Authentication credentials: sent only to your chosen homeserver; access tokens are stored on-device in iOS Keychain or Android Keystore-backed storage. Not sent to Fizzify Inc.
• End-to-end encryption keys: generated and stored on-device. Backups (when you enable them) are encrypted with a key derived from your recovery phrase, which only you hold.
• Message content (text, attachments, voice notes): encrypted on-device for end-to-end-encrypted rooms; transit through your homeserver as ciphertext. The homeserver retains messages according to its policy.
• Audio & video streams during calls: peer-to-peer where possible, otherwise relayed through TURN servers in encrypted form. Streams are not recorded by Kayro Mobile.
• Contacts (optional): only if contact discovery is enabled; transmitted as salted hashes.
• Diagnostics: anonymous crash reports and basic app diagnostics; payload contents are not included.

5. End-to-End Encryption

Direct messages and group conversations using end-to-end encryption are protected by the Matrix Olm/Megolm protocols. Message content cannot be read by Fizzify Inc., the homeserver operator, or any other intermediary. You are responsible for safeguarding your recovery phrase; if you lose it, encrypted history that has not been backed up to other devices may not be recoverable.

6. How the Information Is Used

• Provide app functionality: sign in to your homeserver, sync messages, deliver calls, manage encryption keys.
• Operate features you initiate: sending a message, joining a call, sharing a file.
• Maintain reliability: reconnect after network changes, redeliver missed messages.
• Security: detect and prevent unauthorized access, enforce optional app passcode/biometric lock.
• Comply with the law: respond to lawful requests addressed to Fizzify Inc.

Kayro Mobile does not use your data for advertising, profiling, or any form of monetization. The app contains no advertising or user-tracking SDKs.

7. Third Parties and Sub-Processors

• Your Matrix homeserver: the entity you choose; controls your messages, metadata, and key backup.
• Apple Push Notification service / Firebase Cloud Messaging: push delivery only. Notification payloads are minimized.
• TURN/STUN servers: used only when a direct peer-to-peer connection cannot be established for calls. Media relayed through TURN remains encrypted with SRTP/DTLS.

8. Data Storage and Security

• All transport uses TLS / HTTPS.
• Authentication tokens and end-to-end-encryption keys are stored on-device in iOS Keychain or Android Keystore-backed encrypted storage.
• Locally cached messages and media are stored in the app's private sandbox.
• Optional app-passcode and biometric lock add an additional layer of access control.
• WebRTC media is encrypted with SRTP/DTLS as part of the WebRTC standard.

9. Account Deletion

You can delete your account directly from inside the app: go to Settings → Account → Delete Account and confirm. This sends a deactivation request to your Matrix homeserver, which deactivates your user, releases your username, and (depending on the server's policy) erases or anonymizes your messages. Locally cached content and encryption keys are wiped from the device. For step-by-step instructions and the alternate web-based procedure, see Account Deletion.

10. Data Retention

• Messages on the homeserver: retained according to the homeserver's policy, which is set by the homeserver operator.
• Locally cached messages and media: retained until you sign out, delete the account, or uninstall the app.
• Authentication tokens and encryption keys: retained on-device until you sign out, delete the account, or uninstall the app.
• Diagnostic logs: rotated locally; not transmitted unless you explicitly export them for support.

11. Children's Privacy

Kayro Mobile is not directed to children under 13 (16 in the EEA). We do not knowingly collect personal information from children.

12. International Data Transfers

If your homeserver, or any sub-processor, is located outside your country of residence, your information may be transferred to and processed in that country. Where required, transfers rely on the European Commission's Standard Contractual Clauses or equivalent safeguards.

13. Your Rights

You have the rights described in the general Fizzify Inc. Privacy Policy. To exercise rights affecting message history stored on your homeserver, contact your homeserver operator. To exercise rights against Fizzify Inc. as the app publisher, contact us.

14. California & EU/UK Disclosures

The CCPA, CPRA, GDPR, and UK GDPR sections in the Fizzify Inc. Privacy Policy apply to the Kayro Mobile application. We do not sell or share personal information for cross-context behavioral advertising.

15. Changes to This Policy

We may update this app-specific policy when the app's data flows change. The "Last Updated" date at the top of this page reflects the most recent revision.

16. Contact