Global compliance

Spojiti is built to meet the data-protection law of every market it serves by holding almost nothing to protect. This page states, per regime, what applies to us, what we do, and what we can and cannot produce when asked.

India, Digital Personal Data Protection Act, 2023

Spojiti is a Data Fiduciary that asks for no personal data at sign-up: no name, e-mail or location is requested, and no phone number is required or stored. To deliver messages it keeps random account and device ids, public keys, the push tokens that wake the app and sealed messages until they are delivered; the privacy policy lists everything it holds. Optional discovery keeps only a blinded fingerprint of a number its owner chose to make findable, and reads the contact book on the device only (see the Privacy Policy). Payment data for the web rail is processed by Razorpay under its own compliance; we receive a blind-signature token, not the buyer. Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 we publish a Grievance Officer (contact page), acknowledge grievances within 24 hours and resolve them within 15 days, and we retain what the Rules require for the period they require, from what we hold: the transaction records of the payment rail, the audit log of our own operators' actions, the random account and device records the service runs on, and the messages a user chose to send us in a report, deleted after 90 days.

European Union, GDPR, ePrivacy, DSA

Data minimisation is the design, not a policy: Article 5(1)(c) is satisfied by construction because no name, phone number or e-mail is collected, only random account and device ids and the push tokens that wake the app. Where personal data does arise, an IP address on a connection, a random account or device id, a push token, a payment record on the web rail, the lawful basis is Article 6(1)(b), performance of the contract, and retention is the shortest the purpose allows (connection logs: none persisted; payment records: kept as the accounting record). A report you choose to send us is processed on the basis of legitimate interest, Article 6(1)(f), keeping people safe, and deleted 90 days after it is filed. Our EU representative under Article 27 and our Digital Services Act point of contact are being appointed; until they are named on the Contact page, write to spojiti@spojiti.world. Data subject rights are honoured to the extent physically possible: access and portability produce the ciphertext and routing ids we hold, which we cannot link to a person; erasure is Delete my account everywhere in the app's Settings, which removes the account, its keys and devices from our relay and then erases the device. Transfers: an account lives on our infrastructure in one region; a message to someone whose account lives in another region is handed to that region to be delivered, and the blinded fingerprints that let people find each other by number are shared between our regions.

Where your data lives

Lawful requests, what we can and cannot produce

We answer every valid legal request, and every answer is bounded by what exists. We can confirm whether a routing id has connected recently and produce the ciphertext queued for it, sealed, undeliverable to us. We cannot produce a name, number, e-mail, contact list, call content, location or the identity behind an Echo pseudonym, because none of these exist on our systems, and the only message content we hold is what a user chose to send us in a report, deleted after 90 days. For an account that turned on discovery, we could confirm whether a number a requester already has belongs to it. We publish a transparency report twice a year listing requests received and what was produced.

Other regimes and standards