About this policy
This policy covers the Chitti messaging app and this website. “Chitti”, “we”, and “us” refer to the provider of Chitti. For privacy questions or requests, contact harshita210604@gmail.com.
Your messages and attachments
Messages, voice notes, and attachments are encrypted on your device before being sent. Chitti uses X3DH to establish sessions and the Double Ratchet for subsequent messages. The delivery service handles encrypted content rather than readable conversation content.
Encrypted messages are queued until the receiving device acknowledges delivery; that delivered copy is then removed from the active delivery queue. Undelivered copies can remain queued until delivery or account deletion. Your conversation history normally lives on your devices. Recipients can retain, copy, or share what you send them.
Account and connection information
We process your username, display name, password hash, optional profile picture, account creation information, and privacy settings to provide and secure your account. Your password is stored as a scrypt hash rather than as readable text.
We process device identifiers, device names, public encryption keys, device activity timestamps, delivery information, and contact requests, accepted connections, and blocks to route messages and manage access. Username search queries are processed to find people you want to contact. Public keys are different from your private keys, which remain on your device.
Group names, descriptions, pictures, membership, and administrator roles are held by the service to operate groups. This information is not protected in the same way as encrypted message bodies. Online and last-seen information is shown according to your privacy settings.
Optional message notifications
If you allow notifications, Chitti registers a device push token and your muted conversation settings to deliver new-message alerts through Apple Push Notification service on iOS or Firebase Cloud Messaging on Android. These providers process push tokens, routing identifiers, and notification delivery information.
Alerts use generic text rather than readable message content. Routing identifiers let a notification open the correct conversation. You can mute conversations or turn notifications off in device settings. Signing out removes this device’s push registration when it can contact the service; deleting your account removes its registered push tokens.
Optional encrypted backups
If you enable history backup, Chitti stores an encrypted backup and the salt, nonce, and key-derivation parameters needed to restore it. Backup metadata includes the chat count, whether media is included, size, and last update time.
Your backup passphrase is used on your device and is not sent to the server. We cannot recover a forgotten passphrase. The active backup remains until you replace it, delete it in Settings → Chat backup, or delete your account.
Permissions you control
Microphone access is used when you record a voice note. Camera access is used when you choose to take a picture. Photo and file access supports the specific media you choose to share, set as a picture, or save. You can decline optional permissions and revoke them in your device settings; the related feature may then be unavailable.
Chitti does not request your device address book or precise location to provide messaging. A phone number or email address is not required to create a Chitti account. If you contact support by email, we receive the email address and information you voluntarily send.
Support, reports, and technical logs
A report can contain the reporting account, reported account or group, reason, and time. In-app reports do not automatically include readable message history. Support emails may contain whatever information you choose to provide. Do not email passwords, private keys, backup passphrases, or illegal content.
The backend and hosting infrastructure can process IP addresses, request routes or URLs, timestamps, response status, and error information for operation, security, and troubleshooting. These are operational records, not behavioural advertising profiles. Chitti does not use advertising identifiers or behavioural analytics in the app.
How information is used
We use information to create accounts, authenticate devices, deliver encrypted messages, operate groups and backups, apply privacy controls, respond to support requests, investigate abuse, secure the service, and meet applicable legal requirements.
Where a legal basis is required, processing may be necessary to provide the service you request, pursue legitimate interests in security and abuse prevention, comply with legal obligations, or act on consent for optional features. You can withdraw a device permission through your device settings.
Service providers and disclosure
We use infrastructure providers to host and operate the service. The app backend is hosted on Railway. This public website is hosted by Hostinger. Previous website addresses use Sites and Cloudflare infrastructure to redirect visitors to chitti.chat. These providers process connection and operational information needed to deliver their services. A website sign-in is separate from your Chitti account.
We do not sell your personal information or share it for targeted advertising. Information may be disclosed to a provider performing services for us, when legally required, or as necessary to protect people and the service. End-to-end encryption limits the readable message content available to us.
Hosting or support processing may occur outside your country. Applicable provider arrangements and legal safeguards govern that processing. Third-party websites and identity services also have their own privacy notices.
Retention and deletion
Account and associated service records remain while your account exists. Using Settings → Delete account removes the account and associated device records, public keys, contacts, group memberships, queued messages, reports you submitted, and optional encrypted backup from active application storage. Groups may continue under another member; a group with no remaining members is removed.
Reports submitted by other users may remain for abuse handling with the deleted account’s target reference removed. Information already delivered to other participants remains on their devices. Deleting your account or using Delete for everyone cannot remove copies someone has already saved. Deletion from active application storage does not guarantee instant removal of infrastructure logs or recovery copies maintained by hosting providers; those follow the relevant provider retention processes. Information may also need to be retained where a legal obligation requires it.
Support correspondence and operational records are retained only as needed for their purpose or applicable legal obligations. Contact us for information about a particular record. See Delete your account for both the in-app and web request routes.
Message editing and deletion
Sent text messages can be edited for 15 minutes and show an edited label. Delete for everyone is available for your sent messages for 48 hours and requests removal on participants’ updated apps, leaving a deletion placeholder. Delete for me removes a message from the current device at any time. These controls do not retract screenshots or other saved copies.
Your choices and rights
You can change your profile and privacy settings, manage blocks, delete an optional backup, revoke permissions, or delete your account. Depending on your location, you may also have rights to access, correct, delete, obtain a copy of, restrict, or object to the processing of personal information, withdraw consent, or complain to a privacy regulator.
Send requests to harshita210604@gmail.com. We verify ownership before disclosing or deleting account information and respond within applicable legal timelines. We cannot retrieve readable conversation history or private keys from the server.
Children and safety
Chitti is not directed to children under 13. You must meet any higher minimum age or consent requirements where you live. Contact us if you believe a child below the applicable age is using Chitti or has supplied personal information. Our child-safety standards prohibit child sexual abuse and exploitation.
This website
This static website does not use advertising or analytics scripts. Hosting and access-control services may process connection logs and use essential authentication storage. Links that open your email app do not submit a request to Chitti until you send the email.
Changes and contact
We may update this policy as the service changes. The date above identifies the latest version. Material changes will be communicated through an appropriate available channel. Contact: harshita210604@gmail.com.