Section 01
Architecture overview
Private is built from a small number of well understood components. Every connection to our servers uses TLS 1.3. Stored messages and media are encrypted at rest with AES 256. Voice and video calls connect peer to peer using DTLS SRTP whenever the network allows.
Transport
TLS 1.3
Storage
AES 256 at rest
Calls
DTLS SRTP, peer to peer
Access to every record is checked by the database itself against the person asking, so an app bug cannot hand your data to someone else.
Section 02
Data we store and for how long
| Data | Detail | Retention |
|---|---|---|
| Account details | Email, display name, settings | Until you delete your account |
| Messages | Encrypted at rest (AES 256) | Until you or the conversation deletes them |
| Snaps | Encrypted at rest | Deleted automatically on expiry |
| Unused uploads | Files never attached to a message | Deleted automatically |
| Call credentials | Short lived relay credentials | Expire within minutes |
| Audit log | Sensitive staff and system actions | Retained for accountability |
Section 03
Staff access policy
Staff do not browse user content. Access to any user record is exceptional and controlled:
- Two person rule. A request needs approval from a second, independent staff member.
- Legal basis. Each request must record its legal basis, such as a valid legal order or your own support request.
- User notice. You are notified when your data is accessed, unless the law forbids it.
- Audit. Every request, approval and access is written to the audit log.
Section 04
Responsible disclosure
If you believe you have found a vulnerability, please tell us first and give us reasonable time to fix it. We will not take legal action against good faith research that respects user privacy.
Email security@pvt-app.com. Our machine readable policy is at /.well-known/security.txt.
- Do not access or change other people's data.
- Do not run denial of service or spam tests.
- Include steps to reproduce and the impact you observed.
Section 05
Security changelog
2026.10
Security Center and Security Academy published.
2026.09
Two person rule enforced for all staff data access, with user notice.
2026.08
Call credentials shortened to a few minutes and made single use.
2026.07
Automatic expiry of unused uploads.