Privacy Policy
Effective Date: May 29, 2026
Dunes is a secure peer-to-peer messenger built on the principle that private communication is a fundamental right. This Privacy Policy explains exactly what data Dunes collects, what it does not collect, and how any collected data is handled. Our commitment is simple: collect as little as possible, encrypt everything, and never sell your data.
1
Information We Collect
Dunes is designed to collect the absolute minimum amount of data necessary to deliver secure messaging. Here is an exhaustive list of what we process:
-
●
Public Identity Keys — When you create a Dunes account, an X25519 keypair is generated locally on your device. Only the public key is shared with the relay server to enable message routing. Your private key never leaves your device.
-
●
Optional Hashed Email — If you choose to claim a human-readable
@username, you may provide an email address for verification. This email is stored only as a cryptographic hash on the relay server. Your raw email address is never saved in plaintext.
-
●
Firebase Cloud Messaging (FCM) Token — A device push notification token is registered to deliver wake-up signals when someone sends you a message. This token contains no personal information and is used solely for push delivery.
⚡ That's it. Three data points — public key, optional hashed email, and FCM token — are the only pieces of information the Dunes relay server ever handles.
2
Information We Do NOT Collect
Dunes is built to prove that a messenger can function without harvesting personal data. We do not collect, store, or process any of the following:
-
✕
Phone numbers or SIM card data
-
✕
Device contacts or address book entries
-
✕
Location data, GPS coordinates, or IP-based geolocation
-
✕
Browsing history, search queries, or app usage analytics
-
✕
Camera roll, photos, or files (unless explicitly sent as a message)
-
✕
Device identifiers, IMEI, or advertising IDs
-
✕
Telemetry, diagnostics, or crash reports
-
✕
Message contents (all messages are end-to-end encrypted)
🛡️ Dunes runs zero analytics, zero tracking pixels, zero telemetry, and zero advertisements. There is nothing to opt out of because there is nothing being collected.
3
How We Use Information
The minimal data we process serves exactly two operational purposes:
-
✓
Relay Signaling — Your public key is used to route encrypted message envelopes between peers. The relay server acts as a temporary buffer, forwarding sealed packets it cannot decrypt.
-
✓
Push Notifications — FCM tokens are used to send silent wake-up signals to your device when a new message arrives. These push notifications contain no message content — they simply tell the app to connect and retrieve waiting messages.
We do not use any collected data for profiling, advertising, recommendation algorithms, or any purpose beyond the two listed above.
4
Data Storage & Retention
Dunes follows a strict data minimization and ephemeral storage model:
-
✓
Encrypted Signaling Messages — Buffered in relay server memory for a maximum of 15 minutes. Once delivered or expired, they are permanently and irrecoverably deleted.
-
✓
Encrypted Media Files — Stored on the relay server for up to 72 hours. Files are automatically deleted after the recipient downloads them or upon expiry — whichever comes first.
-
✓
Messages & Chat History — Stored only on your local device. Dunes has no cloud database of conversations. If you delete the app or factory reset, your messages are gone forever.
-
✓
Contact List — Stored exclusively on your device's local storage. Never uploaded or synchronized with any server.
-
✓
Identity Keys — Your private keys (X25519) are generated and stored locally inside your device's sandboxed application directory. They never leave the device.
🔐 All data in transit is sealed with XSalsa20-Poly1305 authenticated encryption. The relay server sees only encrypted ciphertext — it cannot read, analyze, or extract message contents.
5
Third-Party Services
Dunes uses exactly one third-party service:
-
✓
Firebase Cloud Messaging (FCM) — Provided by Google, FCM is used solely for delivering silent push notification wake-up signals to your device. These signals contain no message content, no metadata, and no personal information. They simply instruct your device to connect to the relay to check for waiting messages.
FCM is governed by Google's Privacy Policy. No other third-party analytics, advertising, or tracking services are integrated into Dunes.
We do not sell, share, trade, or otherwise transfer your personal data to any third party, under any circumstances.
6
Children's Privacy
Dunes is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@dunes.chat and we will take immediate steps to remove that information.
Given that Dunes does not collect personal data during registration, the risk of inadvertent child data collection is inherently minimal.
7
User Rights
As a Dunes user, you have full control over your data and interactions:
-
✓
Block Users — You can block any user at any time to prevent them from sending you messages or initiating calls.
-
✓
Report Users — You can report abusive or harmful behavior through the in-app reporting mechanism.
-
✓
Delete All Data — You can perform a factory reset from within the app to permanently erase all local data, including identity keys, messages, contacts, and settings. Since your data lives on-device only, this action is absolute and irreversible.
-
✓
Unlink Username — If you claimed a
@username, you can release it by removing the email verification binding from your account.
Because Dunes stores virtually no data on its servers, traditional data access or portability requests are not applicable — your data already lives exclusively on your device.
8
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:
-
✓
Update the "Effective Date" at the top of this page
-
✓
Provide a notice through the Dunes app or on this website
We encourage you to review this page periodically to stay informed about how we protect your privacy. Continued use of Dunes after policy updates constitutes acceptance of the revised terms.
