Privacy Policy

The short version

Your messages are end-to-end encrypted, we don't sell your data, and we don't run ads. Signing up only needs a phone number • no email, no real name required. Everything below explains that in more detail.

Who we are

Gistnode operates the Gistnode messaging app and this website from Nigeria. We are the data controller for the information described here. You can reach us about anything in this policy at privacy@gistnode.com, or for general support at support@gistnode.com.

What we collect

• Your phone number, used to verify your account via a one-time code (OTP).
• Whatever you choose to add to your profile: display name, username, photo, bio.
• Your contacts, but only as one-way hashes computed on your device • we match hashes to find who else is on Gistnode, and we never see or store your contacts' raw phone numbers.
• Basic device and connection info needed to deliver messages and calls in real time.
• A push notification token, so we can wake your device when a message arrives. The push itself carries no message content.
• Reports you submit about other users, including the reason you give, so a human can review them.

We do not collect your location, we do not track you across other apps or websites, and we do not build advertising profiles.

What we can't see

Messages, calls, voice notes, and status posts are end-to-end encrypted. Our servers relay encrypted envelopes between devices • they are not designed to decrypt or read message content. Encrypted chat backups are protected by a key that's escrowed for you but never exposed to us in a usable form.

What we do with it

We use your data to run the service: deliver messages, sync your account across devices, show your profile to people you talk to, and keep the app secure (for example, reviewing reports of abuse). We do not sell, rent, or share your data with advertisers, and Gistnode does not run ads.

Who else touches your data

We use a small number of service providers to run Gistnode. They only ever handle what they need to, and none of them receive your message content in readable form:

• Cloud hosting • runs our servers and databases.
• Object storage • holds media blobs, which are encrypted before upload.
• Push services(Firebase Cloud Messaging on Android, Apple Push on iOS) • receive a device token and a content-free "you have a message" signal.
• SMS provider • delivers your one-time sign-in code.
• Google Gemini • only if you choose to use the optional Gistnode AI assistant, and only for the messages you send to that assistant.

We may also disclose information where we are legally required to. Because message content is end-to-end encrypted, we cannot produce it — a request can only ever reach the limited account data described above.

Gistnode AI

The optional AI assistant is powered by a third-party model (Gemini) through our own server, so our API credentials are never exposed to your device. It's opt-in and can be turned off in Settings at any time. Messages you send to the assistant are handled separately from your end-to-end encrypted chats with other people, and are not protected by end-to-end encryption, because the model has to read them to answer.

How long we keep things

• Messages • an undelivered message is held only until it reaches your device, then dropped from our queue. Your chat history lives on your own devices.
• Status posts • deleted automatically 24 hours after posting.
• Account data • kept while your account exists, then deleted (below).
• Abuse reports • kept while under review and for a period afterwards, so repeat behaviour can be recognised.

Deleting your account

You can delete your account from inside the app, under Profile → Account → Delete account. That removes your profile, username, encryption keys, and group memberships from our servers, and any undelivered messages queued for you.

If you can't access the app, see Delete your account for how to request deletion by email.

Your choices

• Delete messages for everyone, or delete your whole account, at any time.
• Block or report anyone • reports go to a human reviewer, not an automated system.
• Control who can see your status, call you, or read your last-seen and receipts.
• Lock the app or individual chats with biometrics or a PIN.
• Ask us for a copy of the account data we hold, or ask us to correct it, by emailing privacy@gistnode.com.

Children

Gistnode isn't intended for children under 13, and we don't knowingly create accounts for them. Some regions set a higher minimum age, and where that applies, that age applies to you. If you believe a child has an account, email privacy@gistnode.comand we'll remove it.

Security

Messages use the Signal Protocol for end-to-end encryption. Traffic between your device and our servers is encrypted in transit. Media is encrypted on your device before it is uploaded. No system is perfect, and we'll tell affected users promptly if we ever discover a breach that puts their data at risk.

Changes to this policy

If we change this policy in a way that materially affects you, we'll update the date at the top of this page and give notice in the app before the change takes effect.

Questions

Email privacy@gistnode.com and a person will read it. You can also reach us through the official Gistnode channels linked in the footer below.