Privacy Policy

Effective Date: August 26, 2026

Summary: Kozor is designed to minimize metadata and operate under a strict Zero-Knowledge cryptographic model. We do not sell personal data, track users across the web, use advertising trackers, or have access to the plaintext content of your messages, contacts, voice notes, or Vault credentials.

1. Architecture & Identity

Kozor does not require a phone number, email address, username, or personal identity verification to create an account.

Device-Controlled Identity: Your identity consists of cryptographic key pairs (Curve25519, Ed25519, and ML-KEM / Kyber-1024) generated entirely on your local device.
No Central User Directory: There is no central directory mapping real-world identities to public keys. Connections are initiated via direct, end-to-end encrypted invite codes or QR rendezvous tokens.

2. What We Do NOT Collect or Access

Message & Voice Content: All messages, voice notes, and file attachments are end-to-end encrypted on the sender's device (using PQXDH and XChaCha20-Poly1305) and can only be decrypted by the intended recipient. We cannot read, decrypt, or alter any message content.
Vault Data: Credentials, notes, credit card records, and files saved in your local Vault are encrypted under your hardware-derived Master Key (VMK) with SQLCipher. This data remains on your device and is never transmitted to our servers.
Contacts & Address Book: Kozor does not access, upload, or sync your device's address book or contacts.
Tracking & Ads: Kozor contains zero third-party advertising SDKs, zero analytics trackers, and zero behavioral profiling scripts.

3. Operational Data Processed by Relay Infrastructure

To deliver messages securely and reliably, our blind relay servers temporarily process limited operational data:

Encrypted Message Envelopes: Opaque ciphertext blobs routed through temporary directional mailboxes. Mailbox capability tokens are derived through cryptographic one-way hashing (HMAC-SHA256) and reveal no identity or conversation graph to the relay.
Temporary Message Retention (TTL): Undelivered encrypted envelopes are held in ephemeral relay memory for up to 72 hours, after which they are automatically and permanently purged. Once delivered and acknowledged by the recipient, envelopes are deleted.
Encrypted File & Voice Attachments: File and voice attachments are encrypted into 64KB SecretStream chunks on-device prior to upload. The server stores only encrypted chunks referenced by opaque blob IDs. Attachments are subject to automatic expiration (TTL) and quota management.
Push Notifications (Optional): If you choose to enable push notifications on Android, the app registers a generic Firebase Cloud Messaging (FCM) push token. Push notifications contain zero message content, zero sender names, and zero timestamps; they serve solely as a silent wakeup trigger for the app to sync via encrypted relay. You can disable push notifications at any time in Settings.
Connection & Network Level Data: When connecting to our relay or website, standard TCP/IP network metadata (IP address and port) is temporarily visible to the network stack to maintain the TLS connection. Server application access logs are configured to discard IP and connection records.

4. Data Storage & Security Barriers

Local Storage: All local database entries are encrypted using SQLCipher with 256-bit AES-GCM/CBC and Argon2id key derivation, protected by hardware-backed Android Keystore / iOS Secure Enclave where supported.
Discrete Padding Tiers: Wire payloads are padded to discrete block sizes (128B, 512B, 2KB, 8KB, 64KB, 256KB, 1MB) to prevent packet size traffic analysis.

5. User-Controlled Backups (.aegis)

Kozor allows users to export self-contained, authenticated backup files (.aegis containers) encrypted with XChaCha20-Poly1305 AEAD. These backup files are created and stored entirely under the user's control (e.g., on offline USB drives, external storage, or private cloud). We do not host, store, or have access to your standalone .aegis backup files.

6. Data Retention & Account Deletion

Because your identity and data exist locally on your device, deleting your data is entirely within your control:

In-App Deletion: Navigating to Settings → Reset & Purge Database immediately overwrites and deletes your cryptographic keys, all local conversations, and all Vault records.
Server Data: Undelivered relay envelopes expire automatically via TTL (max 72 hours).
For detailed account deletion guidelines and requests, visit our Account Deletion Page.

7. Children's Privacy

Kozor is not directed to children under the age of 13, and we do not knowingly collect personal information from children.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Effective Date" at the top of this page.

9. Contact Us

If you have questions regarding this Privacy Policy or our security architecture, contact us at:
Email: privacy@kozor.app