Privacy

In force since 4 November 2026.

This is a translation. The Portuguese version is the legally binding one.

Here we say what the orwell.pt server stores and what it can see even with encryption.

Who is responsible

The controller of your data is Duarte Bivar. For anything about your data, write to orwell.eu@proton.me, in Portuguese or in English.

What we do not ask for

To create an account we do not ask for your email, phone number, real name, age, address or a payment method. Your password never leaves your device.

What the server stores

• Messages, posts and files, encrypted, for 30 days. The server stores them without being able to open them, so they reach whoever was offline. After 30 days, it deletes them.
• Your public key and the keys that let others invite you.
• Your profile, encrypted, for the channels you are in.

What the server sees, despite the encryption

• IP addresses. The server sees the address of whoever connects to it. By default, it does not keep an access log.
• When you are connected, and which channels you are in. It does not know what was said.
• The approximate size of what you send.
• In a call, who is talking to whom. Sound and picture are encrypted.

When you report

A report is the exception to the encryption: the person who reports gives us, already decrypted, the text of other people. If you were reported, your data came from the person who reported you.

What we keep.

• The reason and the note.
• The reported messages and their context, with the author, the day, the time and the author's signature. Of attachments, only the name, type and size.
• The address of the account that reports and of the reported account, and the channel and the room.
• The app version, and the day and time of the report.
• Your name and your email, if you give them. They are optional.
• Your confirmation that you report in good faith.
• The address of the channel founder, when there is a copy for them.
• The decision and the review requests.

Legal bases.

• For what the Digital Services Act (DSA) obliges us to do, the basis is Article 6(1)(c) GDPR: compliance with a legal obligation.
• To keep the report for 90 days after it is closed, and for the copy to the founder, the basis is Article 6(1)(f) GDPR: legitimate interest.

Who receives it.

• The founder of the channel, when they are in the channel, gets a copy without the name of the person who reported. In a small conversation, they can guess who it was.
• The authorities, only when the law obliges us: with a court order, or when there is a danger to the life or safety of someone.

For how long.

We keep each report for 90 days after we close it, or while a suspension or a review is open. After that, the server deletes it.

Your rights

You can ask for access to your data, its correction and its deletion, as far as no legal obligation forbids it. You can object to what we do on the basis of legitimate interest. Write to orwell.eu@proton.me. You can complain to the CNPD, the Portuguese data protection authority (Comissão Nacional de Protecção de Dados). About decisions on reports, you can also complain to ANACOM.

Third parties

There is no advertising, no traffic analytics and no tracking cookies. When you click a YouTube video inside a conversation, the player comes from Google, and Google learns your IP address. Before you click, nothing is requested.

What you can delete

When you delete your account, the app deletes it from your device. When you delete a message, the app asks the devices of the people who received it to delete it. Whoever already read it, already read it.

If your community uses its own server, run by another entity, this page does not speak for it.