Privacy policy

Controller

programmiert Web Entwicklung e.U., sole proprietor Bogdan Midler, Mahrweg 1, 1220 Vienna, Austria. Email info@programmiert.at, telephone +43 660 2398109. VAT identification number ATU81693838, company register number FN 643565w, Commercial Court of Vienna. Member of the Austrian Federal Economic Chamber, professional group for management consultancy, accounting and information technology. Applicable rules: the Austrian Trade Act (Gewerbeordnung), published at ris.bka.gv.at.

This policy covers the DenDen app on iPhone and Android, this website (www.denden-sec.com) and the shop on it.

What DenDen is

DenDen is a messenger for one family. Every message is encrypted on your phone before it leaves the device, and only the phone of the person you are writing to can decrypt it. Encryption uses MLS (Messaging Layer Security, IETF RFC 9420). Our server stores only encrypted data and holds no key for it. There is no unencrypted mode.

An account exists only with a code: an invite code that the person running your family's server issues by hand, or an access code from the shop. There is no open sign-up.

What we process

On our server:

• Your username (chosen by you; if you choose your real name, we know it by that route).
• A password hash that cannot be turned back into the password, and a one-way digest of your Key Card. The Key Card itself never reaches our server.
• Your public keys and your friend code.
• A push token for your phone so Apple (iPhone) or Google (Android) can deliver a notification. The notification always carries one of two fixed texts, "New message" or "New contact request", and never any content.
• Who is connected to whom: which accounts have accepted each other as contacts, with the time, and pending contact requests including the short note the sender attaches. That note is not encrypted.
• Encrypted messages waiting for delivery, with a timestamp and the sending and receiving device. We cannot read them. A delivered message is deleted from the server; an undelivered one after 30 days.
• An encrypted copy of your account key that only your Key Card can open.
• Your access: whether it is unlimited (for example through a family invite) and until when it is paid. No payment data is kept with your account.
• The version number of the app on your device (a value shared by everyone on the same build; no timestamp, no device model, no operating system version).
• An operations log of technical events (registration, contact acceptance, key upload, password reset, account deletion) with your random account identifier. It contains no content.

What we do not have: your email address, your phone number, your name (other than as a username), your location, your address book, the content of any message or call. The names you give your contacts stay only on your phone.

IP address: our server does not store IP addresses, neither in its database nor in logs. When you sign in, redeem a code or use the shop, it uses your IP address briefly in memory to fend off too many requests; once no request has come for a while, it discards it again. The providers our server and this website run on (Fly.io and Vercel, below) accept the connections, see IP addresses in doing so and keep their own connection logs, which we do not control.

What we can and cannot see, in one sentence: we cannot read what you write; we can see that your account and another account are connected and when messages travelled between them. No service that delivers a message to the right person can avoid that.

Calls

Voice calls run encrypted between the two phones and are relayed through a server we operate ourselves, so that your phone never reveals its IP address to the other side. That relay stores nothing and keeps no log. During a call it sees the IP addresses of both phones and the timing of the packets. Call signalling travels as encrypted messages; our message server can tell from the size of such a message that a call was set up, but not with whom or what was said.

On iPhone and Android, a call cannot make the phone ring when the app is closed or in the background: the person gets an ordinary notification saying "New message" and has 60 seconds to tap it and open the app. There is no separate call push.

On your phone

On iPhone, everything is stored in an encrypted database. Its key lives in your iPhone's Keychain, is bound to this device, and is not synced to iCloud. The encrypted database file itself can end up in your iCloud or computer backup; on another device it cannot be opened without the key.

On Android, your messages are kept in an encrypted database (SQLCipher). Its key is itself encrypted with a key from your phone's Android Keystore, which cannot be read out of the device. The app allows no Android backup: its data goes neither into a cloud backup nor to a new phone when you move devices.

Anyone holding your unlocked phone can read your messages; no encryption helps against that.

No server backup

We deliberately keep no backup of our database. If it is lost, your messages stay on your phone, but every conversation has to be started again on every phone and the app set up again. We say this now so nobody finds out later.

Your Key Card

During setup the app shows a recovery key once, the Key Card. Write it on paper. It never reaches our server, so we cannot recover it. Losing both the phone and the Key Card means losing access to the account.

Deleting your account

In the app: Settings > Delete account. The app asks for your password again. Your account is then deleted on the server: username, password hash, keys, friend code, push token, contact connections, the messages waiting for you, and the encrypted copy of your account key. The app then removes everything it stored on your phone.

What remains:

1. for 90 days, a record consisting of your random account identifier and the time of deletion, so that your contacts' phones learn that the account is gone and can close the conversation;
2. the operations-log lines carrying that identifier;
3. the messages your contacts already hold on their own phones, which are not with us;
4. encrypted messages you sent that a contact has not yet fetched: they are not deleted, only the note of which device sent them is removed, and each stays until that contact's phone fetches it or 30 days pass;
5. the record that a code you redeemed has been spent. Its link to your account is removed.

Your contacts' phones learn that your account is gone from our server alone; there is no proof of it from your phone. The username becomes free again immediately.

No advertising, no tracking

There is no advertising, no analytics software, no tracking and no sharing with data brokers. There is nothing to buy inside the app itself. Access comes from an invite or from a code bought in the shop on this website.

This website

• This website sets no cookies.
• It loads no fonts, scripts or other resources from anyone else's servers. There is no analytics, no tracking and no embedded third-party content.
• Three places talk to our own DenDen server (familymessenger.fly.dev, Frankfurt): the prices on the home page, the shop and the page for extending access.
• The shop keeps your order (including the key that lets only your browser open the code) and your language choice in your browser's storage, so it can show the code again after a reload. That key never leaves your browser. The extend page keeps only your language choice.

This website is delivered by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. To get the pages to you, Vercel processes access data, including your IP address, and records it in server logs. The legal basis is Article 6(1)(f) GDPR (our legitimate interest in delivering the website). Vercel is certified under the EU-U.S. Data Privacy Framework, so the transfer to the USA rests on the European Commission's adequacy decision (Article 45 GDPR). More in Vercel's privacy policy.

Shop and payment

In the shop you buy an access code for 30 or 365 days and pay in crypto. The payment is handled by the payment processor NOWPayments: you pay on its payment page. For the NOWPayments invoice we send the price in euros, the chosen coin, a random order number and the description "DenDen, 30 days" or "DenDen, 365 days". We do not send your name, your email address or your DenDen username; the shop does not ask for them.

NOWPayments is operated by FD Transfers LLC, based in Saint Vincent and the Grenadines, outside the EU. Sending it the details above is necessary to process your payment (Article 49(1)(b) GDPR).

On its payment page NOWPayments collects data itself, according to its privacy policy among other things technical data such as IP address, language, country and browser type, plus the address you pay from. That is governed by NOWPayments' privacy policy.

On our server we keep, for an order:

• the order number (a checksum of a secret only your browser knows), the plan (30 or 365 days), the price at the time of the order and the chosen coin;
• the country you pick in the shop, for VAT, without any name;
• the NOWPayments invoice number and the state of the order (pending, paid, underpaid, expired, failed, refunded);
• the time you ticked the two confirmations about the immediate start and the right of withdrawal;
• the code you bought, sealed with a key from your browser. We cannot open it;
• for each payment: amount, coin, euro value at receipt and the transaction identifier (hash) on the blockchain. A transaction hash names no person, but a public blockchain explorer can link it to the paying address.

Not stored: your name, your email address, your IP address, your wallet address, your username. Your IP address is used briefly in memory only, to fend off too many requests.

Redeeming a code

You redeem an access code when you register, in the Android app, or on the page for extending access, where you type a username and the code without signing in.

We never store the code itself, only a checksum of it, together with its value in days, whether it came from the shop or from us, when it was made and until when it is valid. When it is redeemed we note on which account and when, and extend the access on that account. A shop code belongs to exactly one order. This means an order can be linked to the account its code was redeemed on.

Recipients and locations

• Fly.io (Frankfurt am Main, Germany): runs our message server, the shop server and our call relay. Its network accepts the connections to our server and sees IP addresses in doing so.
• Vercel Inc. (USA): delivers this website, as above.
• Supabase (region eu-central-2, Zurich, Switzerland): hosts the database.
• Apple (Apple Push Notification service): delivers the "New message" and "New contact request" notifications on an iPhone and holds the push token for that.
• Google (Firebase Cloud Messaging): delivers the same notifications on an Android phone and holds the push token for that. As with Apple, no content is transmitted.
• NOWPayments (FD Transfers LLC, Saint Vincent and the Grenadines): handles payments in the shop, as above.
• Our own relay server for calls, as above.

Legal basis, processors and transfers

We process your data in order to provide the service you use and to handle an order. The legal basis is Article 6(1)(b) of the GDPR (General Data Protection Regulation; performance of a contract). The brief processing of your IP address in memory, to fend off overload and abuse, rests on Article 6(1)(f) (our legitimate interest in running a service that works).

We keep shop orders and payments as bookkeeping records because § 132(1) BAO (the Austrian Federal Fiscal Code) requires it. The legal basis for that is Article 6(1)(c) GDPR (legal obligation).

The providers that run our servers, our database and this website process data on our behalf under their data processing addenda, which form part of their respective terms of service. The database is hosted by Supabase in Zurich, Switzerland. Switzerland is covered by an adequacy decision of the European Commission, so a transfer there needs no additional safeguards. For Vercel in the USA, the adequacy decision on the EU-U.S. Data Privacy Framework applies, under which Vercel is certified. For NOWPayments, see "Shop and payment".

How long we keep what

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Write to info@programmiert.at and we answer within one month. You can delete your account yourself at any time in the app, under Settings, Delete account.

No data protection officer has been appointed.

You may complain to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at.

If something happens

If we learn of a breach of the protection of your data, we report it to the Data Protection Authority within 72 hours where it presents a risk to you, and we tell you directly where that risk is high. We will write what we know and what we do not know.

Changes

Every change to this policy is recorded here with the date and the wording it replaced.

• 16 October 2026. Moved to www.denden-sec.com. The policy now also covers the Android app, this website and the shop; new are the sections "This website" (with Vercel as the hosting provider), "Shop and payment" and "Redeeming a code", storage on Android, calls on Android, Vercel and NOWPayments among the recipients, keeping bookkeeping records under § 132 BAO and two rows in the retention table. The second fixed notification, "New contact request", is now named. The section "Independent review" is removed. Replaced: "This policy covers the iPhone app DenDen"; "An account status for your account. It is set to active for every account. No payment data of any kind is stored" (now: "Your access"); "The app is free and there is nothing to buy in it" (now: nothing to buy inside the app itself; access through an invite or a shop code). Where only the iPhone was named, the text now says "phone", except where something applies to the iPhone only.
• 12 September 2026. Controller named in full, Supabase location stated, sections on legal basis, retention, rights and breaches added.
• 5 September 2026. First version.