Privacy and legal notice

Legal notice

Publisher

This website and the FreeSpeech app are published by Thomas Gourgnier, in a personal capacity.
Contact: contact@rebisway.com

Hosting

OVH SAS — 2 rue Kellermann, 59100 Roubaix, France — www.ovhcloud.com

Intellectual property

© Thomas Gourgnier. FreeSpeech's source code is published under a free licence (see the documentation). The other contents of this site (texts, visuals, logo, layout) are protected by copyright: any reproduction without prior authorisation is prohibited.

This website

This website is static. It uses no cookies, no analytics, and no external fonts or scripts. Like any web server, the server hosting it may record the IP address and time of a request in its technical logs, for operation and security. Links to donation platforms (Liberapay, Stripe) and the code repository leave this site: their own policies then apply.

The FreeSpeech app

No account. We ask for no name, e-mail address or phone number. Your identity is computed on your device; the three phrases that generate it are never sent or stored by the app.

What a relay server sees. Your public identifier (fingerprint of your public keys), your correspondent's identifier, the time of messages and connections, the size of exchanges, and the IP address of the connection. It never sees the content of messages or files: they are end-to-end encrypted. It keeps no messages: a message for someone offline stays on the sender's device.

Logs and tracing. A server writes only technical metadata in its logs: never content, never a key or a notification token, with shortened identifiers; "who writes to whom" does not appear in normal operation. To diagnose a fault, its operator may follow a single identity for one hour at most; that trace stays in memory, stops by itself and leaves a mark. A private server also keeps the list of identities it allowed or invited. In the app, an optional "diagnostic journal", off by default, can be recorded on the device for a bug report: it holds no message, key or full identifier, and leaves only if you share it yourself.

On your device. History, contacts and keys are stored in an encrypted database. Received files are stored in the app's protected space. You can delete them at any time, including by uninstalling the app.

Notifications. On Android, the app uses Firebase Cloud Messaging (Google) to be woken up. A technical notification token is passed to the servers you use, which pass it to Google to send a wake-up. The wake-up does not contain the message: the app then connects to the server itself. You can turn this wake-up off in the settings.

Permissions. Camera and microphone (photos and videos you send), access to files you choose, notifications. These are used only for those features.

No analytics, no advertising, no sale of data. The app includes no statistics library and no ads.

Your contacts. What you exchange with them is yours. Like any message, once received it can be copied or forwarded by its recipient.

Third-party servers

You may use the reference server fs.rebisway.com or any other server, public or private. Each server operator is responsible for their own logs; the app lets you choose which ones you connect to.

Your rights

For any question or request about your data (access, deletion), write to contact@rebisway.com. Since we keep no accounts or user lists, we generally hold no data about you, other than what a server's technical logs record.