Privacy Policy for Ketska

Effective date: 2026-10-02

Ketska is a proximity walkie-talkie: you talk to people around you and can leave short posts ("kets") on a map. This policy explains what data we process, why, where it is stored, and what choices you have. It was rewritten on the date above to match how Ketska actually works today.

1. Summary

• No registration. On first launch the app creates a random identity on your device. We do not ask for your name, e-mail or phone number.
• Optionally, you can secure that identity for recovery by linking Google or Apple sign-in, or by saving a backup code. Both are off by default.
• Your live position is shared only while you are on air, and never exactly: it is blurred on your device before it leaves it, or replaced by your city or country, depending on the privacy tier you pick.
• Voice talk is live only and is not recorded. Posts (text, photos, voice notes) are stored for a limited time and are checked automatically on our own servers. Voice messages you leave for a mutual contact — recordings, photos or emoji — are stored for 7 days and are private between the two of you.
• We run our own servers in Germany, the United States and Singapore. Some data is replicated across all of them so the app is fast everywhere.
• We do not sell personal data and we do not use advertising trackers.

2. Your identity and account

• Identity: a random identifier (UUID) plus a cryptographic key pair generated on your device. The private key never leaves your device; the public key is registered with us and proves it is you.
• Backup code (optional): a code shown in Settings → Account that contains your identifier and private key. It is generated on your device and is never sent to us. Anyone holding it can use your account, so keep it in a password manager.
• Google / Apple sign-in (optional): handled by Firebase Authentication (Google LLC). When you link or restore, the provider confirms your identity and we store only a pseudonymous account identifier issued for Ketska, plus the public key of the device you restore on. We do not receive your password or e-mail address: the temporary Firebase sign-in record is deleted immediately after the identifier is confirmed. Sign-in happens only at the moment you link or restore, not during normal use.

3. Data we process

• Profile: nickname, avatar settings, chosen activity label, chosen communication range and mode.
• Position: see section 4. Also the "on-air minutes" that feed the reputation indicator ("antenna") next to your avatar.
• Posts (kets): text, photos, voice notes, replies, votes and views. Photos are stripped of metadata (EXIF) and re-encoded before storage. Voice notes are transcribed automatically. Each post carries a location: your exact position only if you chose "exact location" for that post, otherwise a map cell of roughly 5 km.
• Social: friends, friend requests, blocked users, nudges, channel membership and channel notification settings, channels you created (name, description, optional map anchor).
• Voice messages: recordings, photos, emoji and automatic transcripts you exchange with a mutual contact, plus a receipt showing whether the other person played, read or saw a message. Photos are stripped of metadata (EXIF) and re-encoded before storage, exactly as on a post, and are screened for adult content (section 6). Only the two of you can access them; they are never public.
• Roundtables (kolečka): a post with a time attached. We store its title, description, start time, duration, how often it repeats, the time zone you scheduled it in, the optional channel it belongs to, the instances you cancelled, and the list of identities who said they will attend.
• Push token: the Firebase Cloud Messaging token of your device, used to deliver friend, channel, post and voice-message notifications.
• Network data: the IP address of your device, kept per identity for abuse prevention (rate limits and bans), and country/city derived from it for choosing the nearest server.
• Moderation data: reports you file or that concern your content, ban records, and automatic content checks (section 6).
• Technical logs: short-lived server logs needed for security and troubleshooting.
• Contact form (website): if you write to us through the form on ketska.com, we receive your message, the e-mail address you give us so we can reply, and the page language. The form is protected by Cloudflare Turnstile, which checks that you are not a bot.
• Contact form (in the app): if you write to us from Settings → "Contact Ketska", we receive your message, your identity, your platform and app version, your IP address and the app language. Two things are yours to decide: an e-mail address, which the form does not ask for by default — without one we still read your message but have no way to answer it — and an image you choose to attach from your photo library. An attached image travels with the message to our mailbox and is never stored on our media server or given a public address. We tell you on the form itself what will be attached before you send it.
• Bluetooth PTT button report (optional): if you pair a Bluetooth push-to-talk button and choose "Send" on the pairing screen, we receive the button's name, its Bluetooth service layout, the signals it sent while Ketska was learning it, your platform and app version. Nothing else is sent, and nothing is sent unless you tap "Send". Button presses during normal use never leave your device.

4. Your position

• Precise tier: your device shifts your position by a fixed random offset of a few hundred metres before sending it. Other users and our servers only ever see this blurred point.
• Approximate tier: the app does not send your coordinates at all; our server places you at your city, or your country, derived from your IP address.
• Without public mode: you are not shown to others on the map.
• Your live position is kept only while you are on air and expires shortly after you disconnect. It is not kept as a history.
• Posts are the one place a position is stored longer: the cell or exact point you chose for that post, for as long as the post exists (section 5).
• To show a place name in the app, the app asks the location services of your phone's operating system (Apple or Google) to turn coordinates into a name, under their privacy terms.

5. Retention

• Live presence and position: expires automatically shortly after you go off air.
• Posts, replies, votes, transcripts: 30 days, then deleted automatically. On the map a post is visible for 48 hours, extended by votes up to 7 days. Attached photos and voice notes are stored on our media server and are deleted immediately when you delete the post or reply, when moderation removes it, or when you delete your account; anything else is removed by a routine cleanup no later than 30 days after upload.
• Voice messages: visible for 7 days, deleted automatically after 8 days together with receipts. Deleted immediately, recordings and photos included, when either of you deletes the conversation, removes the other as a contact or blocks them, or when an account is deleted.
• Roundtables: a one-off stays on the map until it ends, a repeating one for up to 90 days from its first occurrence; the attendance list is deleted with it. The post itself follows the 30-day rule above.
• Profile, identity keys, sign-in links, friends, blocks, channels: kept until you remove them or ask us to delete your account.
• Nickname reservation: 180 days after your last visit.
• Push token: 90 days after it was last refreshed.
• Reports and ban records: kept as long as needed for moderation.
• IP address records: kept for abuse prevention; see section 12 to have them removed with your account.
• Server logs: overwritten within days.
• Contact form messages: kept for up to a year on our servers, then deleted automatically. A copy, with anything you attached, also stays in our mailbox while we handle your request and for our records of it. Ask us and we delete both sooner.
• On your device: identity, keys and preferences stay until you log out, clear app data or uninstall.

6. Automatic checks of your content

To keep the map usable, posts are processed automatically on our own servers, not by outside services: voice notes are transcribed by an on-premise speech-to-text engine; photos are screened for adult content; text and transcripts are screened for profanity, which is masked in the transcript and bleeped in the audio. Nicknames are screened the same way. Content that fails these checks may be hidden and reviewed by a person. Voice messages are transcribed the same way so you can read them, but they are private between two contacts and are not screened or bleeped. A photo you send in a voice message is the one exception: like any other photo it is screened for adult content before it is stored, and it is refused if it fails.

7. Service providers

• Hetzner (Germany): hosting of all our servers, see section 8.
• Cloudflare: network proxy and cache in front of our API, website and map tiles; it sees your IP address and country, and its Turnstile check protects the website contact form from bots.
• Google LLC – Firebase: Cloud Messaging (push delivery), Authentication (optional sign-in only), and Analytics (section 9).
• Google and Apple as sign-in providers, if you choose to link them, and as the operating-system geocoding service that turns coordinates into place names on your phone.
• Live audio (self-hosted LiveKit), map tiles, avatars, transcription and content screening all run on our own infrastructure and are not shared with third parties.

8. Where your data is stored

We operate servers in Germany, the United States (Virginia and Oregon) and Singapore so that talking stays fast wherever you are. Live data (presence, identity keys, social state, bans and IP records) is replicated across all of these locations, including outside the European Union. Posts, media and the profile database are stored in Germany only. Push, sign-in and analytics data is processed by Google and Apple under their own terms, possibly outside your country.

9. Analytics

We use Google Analytics for Firebase in the app and Google Analytics on this website to understand usage: app opens, session length, which features are used (for example range, mode, channels, posts), device model, OS version, and country derived from IP. Analytics events do not contain your nickname, identifier or precise position. See Firebase Privacy and Google Privacy Policy.

10. What others can see

• While you are on air and visible: your nickname, avatar, activity label, reputation indicator and your blurred or approximate position.
• Your posts, with the location precision you chose, your nickname and avatar, for as long as they are live.
• People you interact with: your nickname and avatar on friend requests, invites and nudges.
• If you say you will attend a roundtable, your nickname and avatar are shown to anyone who opens it, and the organiser can see the full list.
• Public web pages: when you share a post, a channel or your profile card, the link opens a public page showing what the app would show (nickname, avatar, post text or transcript, photos, audio, place name; channel name and member count). Post and profile pages ask search engines not to index them.
• We do not sell personal data.

11. Permissions

• Microphone: to transmit voice and record voice notes.
• Location: for proximity matching and the map. Requested each time you go on air; not used in the background beyond keeping you on air.
• Camera and photo library (optional): to attach a photo to a post, a voice message or a message to us, or to scan a backup code.
• Notifications (optional): friend, channel, post and voice-message activity.
• Face ID / device unlock (optional): to protect showing your backup code.
• Bluetooth (optional): to find and connect a Bluetooth push-to-talk button. Never used to determine your location.

12. Your choices and rights

• Pick a privacy tier every time you go on air, or stay off the map entirely.
• Choose per post whether it carries your exact position.
• Link or unlink Google/Apple sign-in and show your backup code in Settings → Account; unlinking takes effect on our servers immediately.
• Delete your own posts and replies, delete a voice-message conversation (for both of you), block people, remove friends, leave or delete channels, disable notifications.
• Uninstalling removes your identity from the device. To have your identity, IP records, posts and voice messages deleted from our servers, write to [email protected], use Settings → "Contact Ketska" in the app, or contact the developer through the app store listing; we remove them across all regions.
• Depending on where you live you may have the right to access, correct, delete or export your data, or to object to processing. Use the same contact.

13. Children

Ketska is not directed to children under 13. If you believe a child provided personal data, contact the developer using the app store listing contact details.

14. Security

Your identity is proven with a private key that stays on your device; sessions are short-lived; traffic is encrypted in transit. We use reasonable technical and organizational measures to protect processed data. No internet-based service can guarantee absolute security.

15. Policy updates

We may update this Privacy Policy when the product or legal requirements change. The "Effective date" above indicates the latest version.