vega

Privacy Policy

Vega is a private messenger. We collect the minimum needed to make the app work, and we don't sell, share, or use your data for advertising. Your direct messages are end-to-end encrypted.

What we collect

• Username. A public identifier you pick at signup. Required.
• Recovery email (optional). Used only to help you regain access if you forget your password and lose your 24-word recovery code. Never shared, never used for marketing.
• Password hash. We store a hash, never the password itself.
• Messages. Stored on our servers so they sync to your other devices. Direct messages are end-to-end encrypted — the server stores the ciphertext only, and we cannot read them. Group chats are protected in transit and at rest, but are not end-to-end encrypted; full E2E for groups is on the v2 roadmap.
• Media (photos, voice messages). Uploaded to private storage, restricted to the members of the conversation. Media files are not end-to-end encrypted in v1 (this is on the roadmap).
• Device tokens. Apple Push Notification tokens, so we can deliver push notifications. We do not include message content in pushes.
• Last-seen timestamp and online presence. Used to show your contacts that you're online. You can hide this in Settings → Privacy.
• Avatar (optional). If you upload a profile photo.
• Crash reports. Anonymous technical crash data via Sentry, to fix bugs. No message content, no contacts.

What we don't collect

• No phone number.
• No location or GPS.
• No address book / contacts upload.
• No advertising SDKs. No tracking across other apps or websites.
• No analytics on the content of your messages.

End-to-end encryption

Direct messages between two users are end-to-end encrypted with libsignal PQXDH — the post-quantum hybrid X3DH protocol developed by Signal. The server stores only ciphertext and cannot decrypt your messages.

In the app, open a peer's profile to see the "Peer's key" (the peer fingerprint) — a 16-character identity code. Compare it with the same code on your peer's device, out-of-band, to verify there is no man-in-the-middle.

Voice and video calls run over LiveKit. Call media is end-to-end encrypted with SFrame (AES-GCM) using a per-call key wrapped under your libsignal session, so neither Vega nor the media server can decrypt it.

Your own sent history. Signal-protocol ciphertext can only be decrypted by the recipient — so after a reinstall, your own sent messages would normally be unreadable to you. Vega also stores a second copy of each outgoing encrypted message — a self-envelope — sealed on your device with AES-256-GCM under a key derived from your 24-word recovery phrase. That key never leaves your device and we cannot derive it: whoever holds the phrase holds the history. If you sign in on a new device with just your password, the app will ask for the phrase before it can unlock your sent history.

Data retention and deletion

• Messages stay on our servers until you delete them, or until your per-chat auto-delete timer expires (1 hour / 24 hours / 7 days, if you set one).
• You can delete your account at any time in Settings → Delete account. This immediately removes your messages, media, contacts, and identity keys from our servers. The deletion is permanent and irreversible.
• You can export your account data in Settings → Download my data.

Third parties

Vega relies on a small set of infrastructure providers:

• Supabase (Postgres database, Storage, Realtime, Edge Functions) — our server backend.
• Apple Push Notification service (APNs) — to deliver push notifications.
• Sentry — anonymous crash reports.

We don't share user data with advertisers, data brokers, or social networks. These providers are bound by their own privacy terms and act only as processors for the data we send them.

Children

Vega's age rating is assigned by the App Store based on its content questionnaire. The app is not directed at children, and we do not knowingly collect data from minors.

Law enforcement requests

We respond only to legally binding requests that are valid in the jurisdiction where Vega operates, addressed to legal@vegamessenger.com. Informal requests are not a channel for disclosure.

Because messages and calls are end-to-end encrypted, their content is technically unavailable to us — we cannot produce it for anyone, including ourselves. The only data that can exist in response to a valid legal order is account metadata: username, registration date, and activity timestamps.

Changes to this policy

If we materially change this policy we will notify users via an in-app banner before the change takes effect.

Contact

Questions, requests, or privacy concerns: hello@vegamessenger.com