Privacy Policy

Effective Date: October 9, 2026 · Last Updated: October 9, 2026

Section 0. Overview and Basic Principles

0-1 This Privacy Policy explains what information Sackgram Labs, Inc. ("the Company") processes in the SACKGRAM app and how it is processed and protected. It has been written to be clear and is based on how the system actually works.

0-2 The Company does not own or operate its own database servers. Data needed to provide the service is stored on Google's cloud services (Google Cloud and Firebase, together "Google Cloud").

0-3 Key points:

• Phone numbers, email addresses, and real names are not requested or collected during registration.
• Messages, photos, videos, and files are end-to-end encrypted and are stored on Google Cloud only in encrypted form; neither the Company nor any third party can read their contents. Call audio is also end-to-end encrypted in transit and is not stored anywhere.
• The minimum metadata necessary to provide the service (such as connection information, sending times, and group names) is processed in a form the Company can read. A detailed list is provided in Section 1.
• Everplace room signboards are, by the nature of the service, designed to be public.
• The Company does not sell Users' personal information and does not use it for targeted advertising.

Section 1. Information Collected and Stored

1-1 Data processed by SACKGRAM falls into two broad categories:

• Covered by end-to-end encryption (the Company cannot read it):
  • Message text, and photos, videos, and files exchanged in chats, including their file names and formats
  • Call audio (encrypted in transit and not stored)
  • The encrypted copy of the key used for account recovery, and the key copy transferred when moving to a new device by QR code (Section 9)
• Not covered by end-to-end encryption (readable by the Company in order to provide the service):
  • Account identifier, SACKGRAM ID, public key, and age verification and terms agreement records (1-2)
  • List of connected Users and the nicknames assigned to them, list of groups and Everplace rooms joined, group names, and in-room profile names (1-3, 1-4)
  • Sending information for each message (sender, sending time, message type, attachment size, and read status) and call history (1-3, 1-5)
  • Account identifiers of participants in group calls and Everplace room calls, room names, and each participant's speakerphone and Voice Privacy status (1-5)
  • Everplace room join requests, report and action records, plan subscription and usage records, and notification tokens (1-4, 1-6, 1-8, 1-10)
  • Everplace room signboard information and posted photos (public data, 1-7)

Note: Google Cloud applies default encryption at the storage (disk) level. This is an infrastructure security measure separate from end-to-end encryption and does not limit the Company's system-level processing of data.

[Account Information]

• 1-2a Account identifier: A unique value generated at random when the app is first opened. It is not derived from personal information such as the User's phone number.
• 1-2b SACKGRAM ID: A unique name the User sets during registration. It is stored and managed to prevent duplicates.
• 1-2c Public key: A key made available so that other Users can send the User encrypted messages. The matching private key used for decryption is stored only on the User's device.
• 1-2d Age verification record: Only the age range and the verification result are stored, not the date of birth itself. (Where the Google Play Store's age signal is used, this includes the age determination result and the Google installation identifier.) The date of birth entered exists only on the User's device.
• 1-2e Terms and policy agreement record: Includes the time of agreement, language setting, and whether the Voice Privacy notice was confirmed.

[Messages, Media, and Files]

• 1-3a The contents, file names, and formats of message text and attachments are end-to-end encrypted, and the Company cannot read them.
• 1-3b The account identifiers of chat participants, the sending time and type of each message, and attachment sizes can be seen by the Company in order to deliver the service.
• 1-3c For groups, the group name, each member's in-room profile name, and the sender name are stored. This keeps the sender of earlier messages identifiable even after a member leaves.
• 1-3d Read status (read receipts): Processed to show the other person when a message was read. This can be turned off in settings; when it is off, the User's read status is not recorded and other people's read status is not shown.

[Friends, Groups, and Everplace Rooms]

• 1-4a Connected User accounts, the nicknames assigned to them, and the time each connection was made.
• 1-4b The member list of each group.
• 1-4c The customer list of an Everplace room, chat history (end-to-end encrypted), and join request information. The nickname and message written by someone who asks to join are sent and stored as plain text so that the owner can read them.

[Call Data]

• 1-5a The Company does not record calls and cannot intercept or collect voice conversations.
• 1-5b One-to-one calls: Under the default setting, audio is encrypted on the device and delivered through a relay server (Cloudflare), so the other party to the call cannot learn the User's IP address. The relay server only passes along encrypted audio; it cannot listen to the content and does not store it. Users can turn this protection off in settings; when it is off, the two devices connect directly for call quality (using Google's connection service to find each device's network address), and the other party to the call can learn the User's IP address. Connection information exchanged to set up the call is deleted from Google Cloud when the call ends, and if it is not cleaned up then, it is automatically deleted within 24 hours at the latest.
• 1-5c Group calls and Everplace room calls: Audio streams are delivered through a media server (LiveKit). Because the audio is encrypted on the device before it is sent, LiveKit's servers also cannot listen to the content. LiveKit receives participants' account identifiers, room names, and speakerphone and Voice Privacy on/off status, which it uses to show this information on participants' screens. When connecting, LiveKit also receives technical connection information (IP address, operating system and version, and device model).
• 1-5d Call records in a chat (caller, call outcome, call duration, and, for group calls, the maximum number of participants) are stored as unencrypted metadata. A User cannot delete an individual call record but can hide it from their own screen; it remains on the other participants' screens. When the room's Evaporation timer is on, call records disappear together with the room's messages when the timer runs out. They are also deleted when the chat or room itself is deleted.

[Notifications]

• 1-6a If the User allows notifications, the device's notification token (push token), together with the app-installation identifier it depends on, is stored, and notifications are delivered through Google's push notification infrastructure.
• 1-6b Push notifications contain only technical information such as room and call identifiers, and do not include user names or message content. Names shown on screen are matched on the device itself, and can be controlled with the "Hide room names in notifications" option in settings.
• 1-6c The owner of an Everplace room is notified when someone asks to join, and a customer is notified when let in. (No notification is sent when a request is declined.)

[Everplace Room Signboards (Public Information)]

• 1-7a The business name, description, contact details, address, announcements, business category, region, and main photos posted on a signboard are public data. Any SACKGRAM User can view them, and posted photos are not encrypted.
• 1-7b Signboard photos are converted to JPEG on the device and stripped of metadata (EXIF), including location information, before they are posted. Photos that cannot be converted are not posted.
• 1-7c When searching for signboards, the filters the User selects (country, region, business category and tags) are sent to the server as search conditions.

[Reports and Action Records]

• 1-8a When a signboard is reported, the reporter's account identifier, the reported signboard, the reason, any additional details, and the time are recorded. This record is not disclosed to others, and the reporter's information is not provided to the owner of the signboard.
• 1-8b When the Company takes action against a signboard or account, the time and reason for the action are recorded. (Reporter information is not included.)

[Account Recovery and Security Keys]

• 1-9a When a passkey is registered, the passkey's public identifying information and verification data (registration and last-use times) are stored. The passkey's secret data itself is kept only on the User's chosen device and password manager.
• 1-9b Conversation recovery: When enabled, an encrypted copy of the key used to decrypt conversations is stored on Google Cloud. This copy can be decrypted only with the User's passkey (fingerprint, face, or screen lock), and the Company holds no key that can decrypt it.
• 1-9c Moving to a new device (QR code): The old device encrypts the account key with a one-time key contained only in the QR code and stores it temporarily on Google Cloud, where the new device retrieves it. It is deleted immediately when the move is completed or after the confirmation code is entered incorrectly 5 times. A move that is not completed expires after a short time, and its record is normally deleted automatically within a day.

[Plans and Usage]

• 1-10a Subscription plan tier (Free, Trial, Silver, Gold), purchased product information, and expiration time are managed. Payments are processed through the app stores, and the Company does not directly collect credit card information.
• 1-10b Quantity data needed to provide the service is managed, including the number of connections, number of groups, number of invitation QR codes created, monthly cumulative Voice Privacy usage time, and monthly attachment upload volume.

[Device and Connection Technical Information]

• 1-11a IP addresses and connection information are collected in the course of communication and may be temporarily retained in system operation logs (see Section 6 for retention periods).
• 1-11b Google's security services (Firebase App Check / Play Integrity) are used to verify that the app is genuine. These services return only the results of app authenticity and device integrity checks and do not identify individual Users.

[Information Not Collected and Activities Not Performed]

• 1-12a The Company does not sell or rent Users' personal information to third parties and does not use it for targeted advertising.
• 1-12b The app contains no third-party advertising trackers, commercial analytics SDKs, or crash reporting trackers. Accordingly, there is no need to respond separately to "Do Not Track" signals from web browsers.
• 1-12c The Company does not collect Users' actual GPS location, device contacts (address book), or phone numbers.

Section 2. Purposes and Legal Bases for Processing

2-1 The Company processes information only for the following purposes:

• Providing the service: Delivering messages, connecting calls, maintaining friends, groups, and Everplace rooms, and applying subscription plans
• Operating the service safely: Diagnosing system errors, preventing abuse of the service, and protecting the service infrastructure through app authenticity checks
• Handling signboard reports: Reviewing reports of signboards that violate the rules and taking appropriate action
• Meeting legal obligations: Keeping age verification and terms/policy agreement records (1-2d, 1-2e)

2-2 The legal bases for processing personal data under the EU and UK GDPR are as follows:

• Performance of a contract (Article 6(1)(b)): Providing the service and applying subscription plans
• Legitimate interests (Article 6(1)(f)): Ensuring the stability of the service, preventing abuse, and handling reports of unlawful signboards
• Compliance with legal obligations (Article 6(1)(c)): Age verification and keeping agreement records
• The Company does not rely on consent as the sole legal basis for any processing.

2-3 An account cannot be created without the required registration items (SACKGRAM ID, password, and date of birth). Apart from the age verification process, there is no automated decision-making that produces legal effects for Users.

Section 3. Data Processors

3-1 To provide the service, the Company engages the specialist providers below to carry out certain data processing. These providers process data only under the Company's control and instructions:

3-2 Except as described in Section 5 (legal requirements), the Company does not provide Users' information to any third party other than the processors listed above.

Section 4. International Data Transfers

4-1 The Company operates the service as a U.S. company, and all information stored on Google Cloud is kept in data centers in the United States. The database is replicated within a Google Cloud multi-region in the United States, and encrypted attachments and signboard photos are stored in the South Carolina, USA (us-east1) region.

4-2 Audio for group calls and Everplace room calls is only relayed in real time through LiveKit servers located in the United States and is not stored on those servers. Audio for one-to-one calls is only relayed in real time through the Cloudflare data center closest to the User and is not stored. RevenueCat also processes subscription data on infrastructure in the United States.

4-3 The information of Users who live outside the United States is transferred over the internet to the United States for processing when they register and use the service. If you do not want your information transferred internationally, you may stop using the SACKGRAM app or delete your account. (In that case, you will not be able to use the service.)

4-4 Transfers of EU and UK Users' data to the United States are based on the Standard Contractual Clauses (SCCs) included in the data processing terms with Google Cloud/Firebase. Transfers to LiveKit, Cloudflare, and RevenueCat are likewise governed by the safeguards set out in each company's Data Processing Agreement (DPA).

Section 5. Disclosure to Third Parties and Legal Requests

5-1 Where a legal obligation arises, such as a valid court order or a lawful warrant from a competent investigative authority, the Company may disclose the minimum necessary information that it holds. Disclosure is limited to the metadata not covered by end-to-end encryption, as described in Section 1.

5-2 The actual content of messages, photos, videos, files, and call audio is end-to-end encrypted, and the Company does not hold decrypted originals. It is therefore technically impossible for the Company to provide that content, even at the request of law enforcement or a court.

Section 6. Retention Periods and Deletion

6-1 Messages and attachments are retained until the sender deletes them or until the disappearing message timer set for them expires.

6-2 Deletion and Evaporation: When the sender deletes a message or its timer expires, the data is deleted from all three places: ① the SACKGRAM app screen, ② the memory and storage of the sender's and recipient's devices, and ③ Google Cloud. If the recipient's device is not connected, the data is deleted as soon as it reconnects. Thumbnails and viewer copies temporarily created on the device are also deleted as soon as the app receives the change, and any open media screen closes automatically. Messages whose timer has expired are normally deleted from Google Cloud within 1 minute.

6-3 A User who receives a message can hide it on their own screen, but only the sender can actually delete it. Hidden messages are also deleted when their timer expires.

6-4 The expiry time of a disappearing message timer is calculated using Google Cloud's server time, not the clock on the User's device.

6-5 Connection information used to set up one-to-one calls is deleted when the call ends, and if it is not cleaned up then, it is automatically deleted within 24 hours at the latest.

6-6 Google Cloud system operation logs (which may include IP addresses and account identifiers) are kept for 30 days and then deleted automatically.

6-7 Signboard reports and records of actions taken are permanently deleted automatically 1 year after they are created. If a reporter deletes their account, their reports are deleted immediately.

6-8 Deleted immediately when the account is deleted (Settings → Delete account):

• Account profile and public key
• Friend list, and the User's entry in other Users' friend lists
• One-to-one chats and all data in them (messages, media, files, and call history), deleted immediately on both Users' screens
• Group memberships (if the User was the last member of a group, the entire group and its data are deleted)
• In Everplace rooms the User joined as a customer: chat history, files, join requests, and block and report records
• For Everplace rooms the User owned: the signboard, photos, and permanent QR link, and all customer relationship data for that room (chat history, media, call history, and pending join requests). The room's signboard is taken down and its customer relationships end, even if other members remain.
• Account recovery data (the public part of the passkey and the encrypted key copy)
• Plan and usage data stored on Google Cloud, notification tokens, and all invitation link data created or used
• Read status and blocking identifier data remaining in groups that still have other members
• The RevenueCat customer record. For Google Play subscriptions, automatic renewal stops from the next billing date, and amounts already paid are not refunded.

(Encrypted media files are normally fully removed from the servers within a few minutes of the deletion request.)

6-9 Retained as exceptions after the account is deleted:

• SACKGRAM ID: Kept permanently in a reserved state, no longer linked to any account, to prevent misuse by others.
• Messages and files in groups that still have other members: Kept in encrypted form, to preserve the other members' conversation history, until the group's timer removes them or the group itself is deleted.
• Age verification, terms agreement, and Voice Privacy notice records, and the record that the account was deleted: Kept separately for 3 years from the date of deletion as evidence of legal compliance, and then deleted automatically.
• Reports about signboards the User owned: Kept for 1 year from the date the report was received, and then deleted.
• Operation logs: Subject to the 30-day retention period described in 6-6.
• Google Play purchase records: Kept in accordance with Google's applicable laws and payment policies.
• Passkey data: Remains on the User's device and in the User's password manager, where the User can delete it.

6-10 Method of deletion: All electronic files are deleted from the Google Cloud system, and there is no backup from which the Company could restore deleted data.

Section 7. Your Rights and How to Exercise Them

7-1 Users may request access to, correction of, deletion of, or suspension of processing of the personal information the Company holds about them. Depending on the laws where they live (such as the GDPR or CCPA), Users may also have additional rights, such as the right to data portability and the right to object.

7-2 Most rights can be exercised immediately and directly through the app's menus (Delete account, turning off read receipts, hiding room names in notifications, and editing or deleting a signboard). Other inquiries and written requests may be sent to info@sackgram.com, and the Company will respond within 30 days of receipt.

7-3 Because SACKGRAM does not collect phone numbers or email addresses, it may be difficult to confirm that a requester is the legitimate owner of an account. If ownership cannot be established, the Company may be unable to process the request.

7-4 If you have a complaint about the Company's processing of personal information, you may lodge a complaint with the data protection authority where you live (for example, the Personal Information Protection Commission in Korea, or a data protection authority in the EU).

Section 8. Voice Privacy

8-1 Voice Privacy converts the voice in real time inside the device, before the audio leaves it. The Company does not collect or store on its servers either the original voice or the converted audio.

8-2 Whether Voice Privacy is on during a call is sent in real time to the other party to the call and shown on their screen (1-5c). For usage management, only the monthly cumulative usage time is recorded (1-10b).

8-3 This feature is a security feature that changes the tone of the voice; it does not fully anonymize a User's speech characteristics (such as speaking speed, accent, and intonation).

Section 9. Changing Devices and Account Recovery

9-1 Changing devices: If you still have your old device, you can securely move your SACKGRAM ID, account key, and conversation recovery key (if enabled) to a new device by scanning a QR code. Friends, room lists, and messages are downloaded again from Google Cloud on the new device. Your password and settings stored only on the device (such as theme and font size) are not moved; you set a new password on the new device.

9-2 Recovering an account after losing a device: If a device is lost, the account can be recovered only if a passkey was registered in advance. On a new device that uses the same password manager ecosystem, the account profile, friends, and room lists are restored after entering the SACKGRAM ID and completing biometric authentication. (Supported on Android 9 or later.)

9-3 Recovering conversations: Conversation recovery is turned on when a passkey is registered (currently offered on Android first). If it is on, existing conversations in the User's rooms are restored when the account is recovered. If it was off, or if the environment is not supported, the account profile is recovered but existing encrypted conversations are not, and encrypted conversations cannot be sent or received on the new device.

9-4 Conversation recovery can be turned off under Settings → Account recovery. When it is turned off, the copy of the decryption key stored on Google Cloud is deleted immediately; after that, conversations cannot be recovered if the device is lost, and conversations cannot be sent or received on a new device. It can be turned back on at any time.

9-5 If a device is lost and no passkey was registered, no one, including the User and the Company, can recover the account.

9-6 Messages and media deleted by the sender or removed when their timer expired cannot be recovered under any circumstances.

Section 10. Children's Privacy (18 Years of Age or Older)

10-1 SACKGRAM is a service for adults aged 18 or older, and the Company does not knowingly collect or process the personal information of anyone under 18.

10-2 Whether a User is 18 or older is verified using the date of birth entered during registration. The Company does not require excessive personal information such as identity documents. (On some Android devices, the Google Play Store's age signal is used.)

10-3 If you become aware that a minor has created an account and is using the service, please report it to info@sackgram.com. After a verification process, the Company will terminate the account and delete the related information in accordance with Section 6.

Section 11. Security Measures

11-1 The Company applies end-to-end encryption to all conversation content and call audio. The private key needed for decryption is stored in secure storage on the device protected by the Android Keystore, and is excluded from device backups.

11-2 The databases on Google Cloud enforce strict access control rules (Security Rules) so that only an authenticated User can access their own data and the data of rooms they belong to.

Section 12. Changes to This Privacy Policy

12-1 When this Privacy Policy is amended, the "Last Updated" date at the top will be revised, and changes that materially affect Users will be announced in advance, before they take effect, through in-app notices or similar means.

12-2 This Policy may be provided in multiple languages. In the event of any inconsistency in interpretation between language versions, the English version shall prevail.

Section 13. Privacy Officer and Representatives

• Company name: Sackgram Labs, Inc.
• Address: PO Box 40401, North Charleston, SC 29423, USA
• Contact email: info@sackgram.com

Privacy Officer:

• Title: Chief Executive Officer (CEO)
• Contact: info@sackgram.com

EU and UK Representatives:

• EU representative (GDPR Article 27): Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria
• UK representative (UK GDPR Article 27): Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom
• EU legal representative (Digital Services Act Article 13): Prighter DSA GmbH (FN 503213 w), Schellinggasse 3, 1010 Vienna, Austria

To contact our representatives, please use the Prighter Trust Center: https://app.prighter.com/portal/18096734485

Section 14. Additional Information for Users in Brazil (LGPD)

14-1 For Users who reside in Brazil, the processing of personal data is also governed by the Brazilian General Data Protection Law (Lei nº 13.709/2018, "LGPD"). This Section applies in addition to the other Sections of this Policy.

14-2 The legal bases for processing personal data under Article 7 of the LGPD are as follows:

• Performance of a contract (Article 7, V): Providing the service and applying subscription plans
• Legitimate interests (Article 7, IX): Ensuring the stability of the service, preventing abuse, and handling reports of unlawful signboards
• Regular exercise of rights (Article 7, VI): Keeping age verification and agreement records
• The Company does not rely on consent (Article 7, I) as the sole legal basis for any processing.

14-3 Under Article 18 of the LGPD, Users who reside in Brazil may request the following from the Company:

• Confirmation of the existence of processing
• Access to their personal data
• Correction of incomplete, inaccurate or out-of-date data
• Anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the LGPD
• Portability of their data to another provider of a product or service, in accordance with the regulations of the ANPD
• Deletion of personal data processed with their consent, except in the cases provided for in Article 16 of the LGPD
• Information about the public and private entities with which the Company has shared their data (see the data processors in Section 3)
• Information about the possibility of not giving consent and about the consequences of refusing
• Revocation of consent, under Article 8, §5 of the LGPD

How to make a request and the identity verification process are the same as in Section 7 (7-2, 7-3).

14-4 Users who reside in Brazil have the right to petition the National Data Protection Authority (ANPD) regarding their personal data against the Company (Article 18, §1 of the LGPD).

14-5 As described in Section 4, the personal data of Users who reside in Brazil is transferred to and processed in the United States. This international transfer is made because it is necessary for the performance of the contract to which the User is a party (Article 33, IX of the LGPD, in connection with Article 7, V).

14-6 Data Protection Officer (Encarregado, Article 41 of the LGPD):

• Name: Eric Yi
• Title: Chief Executive Officer (CEO)
• Contact: info@sackgram.com