Privacy policy
Last updated 5 November 2026
The short version
- Your chats and calls with other people are end-to-end encrypted. We can't read your messages, see your photos or listen to your calls, and neither can our staff.
- We keep only what we need to run the service, and we delete it as soon as we can.
- We never sell your data, and we don't show ads.
- You can delete your account in the app at any time.
Who we are
ACC Chat is run by Smithery Technology PLT, a limited liability partnership in Malaysia ("we", "us"). We're responsible for the personal data described here. Questions go to support@accchat.com.
What we can't see
Messages, photos, videos, voice notes, files, shared locations, polls and calls between people are end-to-end encrypted with the Messaging Layer Security standard. They're locked on your device and can only be unlocked on the devices of the people in the chat. Our servers pass them along without being able to open them. The same goes for your name, your about line, group names, Moments and chat backups.
What we hold, and why
Your account
- How you sign in: your email address, or your Apple or Google account ID and its email. If you use a mobile number, we keep only a scrambled fingerprint of it (a keyed hash), never the number itself.
- Your username, if you choose one, so people can find you by it.
- Passkeys, if you add one: its public key, name and when it was used. Your face or fingerprint never leaves your phone.
- Sign-in codes, stored only as a keyed hash, and deleted after a day.
Your devices
For each phone, tablet or computer you use: its public encryption key, its platform, when it was added and last connected, and its push notification token, so we can tell it a message is waiting. Notifications carry no message content.
Who's in which chat
To deliver messages, our servers know which accounts are in which chats and groups, and which groups belong to a Circle. They don't know what you say. Encrypted messages wait on our servers only until your devices collect them, and are deleted then, or after 30 days at most.
Calls
We learn that a call started in a chat, and for group calls which devices joined and when. We keep that for 7 days after the call ends. Our call relays see network addresses and how much data passes, never what's said.
Finding friends
If you let ACC Chat look through your contacts, it checks them on your phone in a way that hides the numbers from us. Your address book never leaves your phone in a readable form.
Things that aren't end-to-end encrypted
- Broadcasts are public by design. We can read posts, names and descriptions, and we know who follows which Broadcast. Posts are kept for 30 days.
- Chats with businesses that use our Business API are handled by a hosted service that can read them. The chat tells you so. We relay each message and don't keep a history. The business sees only a business-specific ID and the name you share.
- Reports and help requests: when you report someone or ask us for help, our team sees what you choose to send, including any messages you attach.
Chat backups
If you turn on backups, your chats are encrypted on your phone with a key only your recovery code or passkey can open. We store one backup per account and can't read it.
Keeping the service safe and working
We keep records of blocks, reports, warnings and the actions our staff take, to protect people and to show our decisions were fair. Our logs never contain message content, phone numbers, contacts or tokens. We count anonymous app events (for example, "a message was sent") to see what works. We also collect crash reports and app sessions, to see what breaks and how many installs it affects. On phones these carry a random ID for your install of the app, but not your IP address or account.
Who else handles data for us
We use these providers, and they receive only what's listed:
| Provider | What they receive | Where |
|---|---|---|
| DigitalOcean | Our servers and database | Singapore |
| Cloudflare | All traffic in transit; encrypted media, encrypted backups; call relays | Global network, storage in Asia-Pacific |
| Amazon Web Services | Your email address or mobile number, and the sign-in code we send to it | Singapore, then your mobile carrier |
| Apple and Google | Push tokens and content-free notifications; sign-in with Apple or Google | Their global services |
| Grafana Cloud | Service logs and measurements, with no personal data | Singapore |
| PostHog | Anonymous app event counts | European Union |
| Sentry | App crash reports and app sessions, with a random ID for your install on phones, without your IP address or account | European Union |
| Expo | App updates we publish; no data about you | United States |
Our data stays in Singapore, apart from what these providers handle where shown. When data leaves your country, we use providers bound to protect it, and we follow the transfer rules of the countries we serve.
How long we keep it
- Encrypted messages waiting for delivery: until delivered, 30 days at most.
- Encrypted photos and files: 30 days.
- Sign-in codes: 1 day.
- Group call records: 7 days after the call.
- Broadcast posts: 30 days.
- Chat backups: until you replace or turn them off, and no more than a year without a new one.
- Our own encrypted database backups: 35 days.
- Your account details: until you delete your account.
Your choices and rights
- Delete your account in the app at any time (see Support). We delete your sign-in details, passkeys, devices' tokens, blocks, backups and waiting messages, and sign out every device. A record that the account existed remains, without your name or contact details, along with reports and staff records. Copies in our backups expire within 35 days. People you chatted with keep their own copies of past messages.
- Ask us for a copy of the personal data we hold about you, to correct it, or to stop using it, by writing to support@accchat.com. Depending on where you live, you may have further rights under laws such as Malaysia's Personal Data Protection Act 2010. We'll reply within 21 days.
- You can turn off contact access, notifications and backups in your phone's or the app's settings.
Children
ACC Chat is not for children under 13, or under the minimum age in your country if that is higher. If you believe a child is using it, tell us and we'll delete the account.
Security
Besides end-to-end encryption, all connections are encrypted in transit, only approved staff can use our staff tools, and every staff action is logged. If a breach affects you, we'll tell you and the authorities as the law requires.
Changes
We'll update this page when anything changes, and let you know before a significant change takes effect.
Contact
Smithery Technology PLT, Malaysia · support@accchat.com