Privacy policy

Who we are

Apex Flow Shield is made by Apex Flow Labs LLC ("we", "us"). Contact: apexflowlabs@gmail.com.

This policy covers the Apex Flow Shield apps for phones and computers and the servers they connect to when you choose to use them.

The short version

There is no account with your name, email or phone number. We show no ads, run no analytics and use no tracking tools. We do not sell data. Your vault, device checks, link checker and password tools run on your device and are not sent to us.

Features that use a server (private chat, calls, text-message inbox, protected DNS) send only what they need, described below. Everything sent for chat is encrypted so that our servers cannot read it.

What stays on your device

Your vault (encrypted with a key made from your passphrase, which we never see), your chat history and keys (encrypted with a key held in your device's secure storage), your Telnyx API key if you add one, your relay and DNS settings, and the results of device checks.

If you uninstall the app, this data is deleted from your device. If you forget your vault passphrase we cannot recover it.

What our relay server holds (private chat, calls and text inbox)

A random account identifier and a scrambled fingerprint of a random access token (never the token itself). No name, email or phone number.

Public keys that other people use to start a chat with you.

Encrypted messages waiting for delivery. We cannot read them. We do not record who sent a message. We can see the recipient's random identifier, a random chat identifier, the message size and the time it arrived. Messages are deleted when your device collects them, or after 14 days.

If you turn on notifications: your device's push address, so we can send a generic "You have a new secure message" notice through Apple or Google. The notice never contains a sender or message text. Apple or Google learn that a notice was sent to your device.

If you use calls: we issue short-lived credentials for a relay (TURN) server. Call audio and video are encrypted between the two devices; the relay carries encrypted data only and can see network addresses.

If you turn on receiving text messages: your public sealing key and your phone provider's public key. When your provider forwards a text to our server, the server sees it for an instant, locks it to your public key so only your device can open it, and stores only the locked version until your device collects it or 14 days pass.

We keep no request logs and no record of IP addresses. Short-term counters used to stop abuse are held in memory only and are not written to disk. The company hosting the server may keep its own network records, which we do not control.

What our DNS server sees (protected DNS)

If you turn it on, the names of the websites your device looks up, and your network address, in order to answer. We keep no logs. A DNS server necessarily sees these names, as any DNS provider does.

Other companies involved

Have I Been Pwned (leaked-password check): only the first 5 characters of a scrambled (SHA-1) fingerprint of a password are sent. The password is never sent.

Telnyx (burner numbers): if you add your own Telnyx account, the app talks to Telnyx directly using your key. Telnyx's own privacy policy applies to your account, your numbers and your messages.

Apple and Google: they operate the app stores, push notifications and device software, and collect information under their own policies.

Your chosen DNS upstream and VPN server, if you use them, can see the traffic they carry.

Your choices and deleting your data

In the app you can erase your vault, erase all chats and keys (which also deletes your account and everything we hold for it on the relay), and remove your push address.

You can also email apexflowlabs@gmail.com to ask what we hold or to delete it. Because we hold so little and cannot link it to a person, we may need your account identifier to find it.

Legal requests

We respond to valid legal process for the data we hold. As described above, that is limited: we cannot read messages, we do not record senders and we keep no logs. We will not add secret access.

Children

The apps are not directed to children under 13 and we do not knowingly collect data from them.

Security and its limits

We use strong, published methods and describe them on our Security page. No system is perfectly secure, and we do not promise that. The chat encryption library we use has not yet had a formal independent audit.

Changes

If this policy changes, we will update this page and, for meaningful changes, tell you in the app.