XMPP Privacy Policy

This policy explains what data we process when you use Telepath XMPP (the telepath.im messaging service and its related domains), why we process it, and the rights you have over it. We have tried to write it plainly. Where it uses formal terms, those terms come from the GDPR.

Telepath is built around a simple idea: we should not be able to read your conversations, and we should not keep anything we do not need. This policy describes the data that the service does process so that it can function at all — and how little of it we hold on to.

The short version

Registration is invite-only, and we never sell or share your data for advertising.
You can turn on OMEMO end-to-end encryption so that not even we can read your messages or files.
Messages stored on the server for syncing are automatically deleted after one month; uploaded files after 30 days.
We collect no email address and no real name. Your account is a username and a password.
You can export or delete your data at any time. The full text below explains how.

This summary is for convenience only; the sections below are what actually govern.

1. Who is responsible for your data
2. What data we process
3. Why we process it, and our lawful basis
4. How long we keep it
5. Who your data is shared with
6. International transfers
7. How we protect your data
8. Your rights
9. Children
10. Changes to this policy
11. How to contact us

1. Who is responsible for your data

The Telepath XMPP service is operated by FSKY, a non-profit tech collective established in Sweden ("we", "us", "our"). FSKY is the data controller for the personal data described in this policy.

The servers that run the service are located in the Netherlands. Both Sweden and the Netherlands are within the European Economic Area (EEA).

For any privacy question, or to exercise your rights, contact us at contact@telepath.im or over XMPP at admin@telepath.im.

2. What data we process

Account information

When you accept an invitation and register, we store:

Your username (the local part of your address, e.g. you@telepath.im).
Your password, stored only as a salted hash (we never store or see your password in plain text).
The invitation you used to register, including which existing user created it. We keep this so we can address abuse and understand how accounts enter the service.
An account activity timestamp recording when your account was last used, so we can identify dormant accounts.

Registration is invite-only. We do not ask for or store an email address, phone number, or real name.

Messages

So that your conversations stay in sync across your devices, the server keeps a recent archive of your one-to-one messages (XEP-0313 "Message Archive Management"). You can change what is archived — or turn archiving off entirely — from your XMPP client.

If you use OMEMO end-to-end encryption, anything stored in this archive is ciphertext that we cannot read. We strongly recommend it.

Group chats

Messages sent in group chats (MUC rooms hosted at room.telepath.im) are, by default, archived on the server so that participants can see recent history when they join. Presence information (who is online) is not logged. Anyone in a room can see the messages sent to it; if the room is public, that may include people you do not know.

Files and media

When you share a file or image, it is uploaded to our file-sharing service at hypertext.telepath.im (XEP-0363). Files can be up to 300 MiB. Anyone who has the file's link can download it for as long as it is stored, so treat a shared link as semi-public — unless you are sending the file inside an OMEMO-encrypted chat, in which case the file is encrypted on your device before upload and we only ever store ciphertext.

Profile, contacts, and settings

If you choose to set them, we store your profile and avatar (vCard / PEP), your contact list (roster), your bookmarks (the rooms you have joined), and your block list. This data exists to make the service work across your devices.

Connection and technical data

To run the service, keep it secure, and prevent abuse, our server and web-server software record technical logs. These can include IP addresses, timestamps, and connection or authentication events. We use these only for operating the service, diagnosing faults, and detecting abuse such as brute-force login attempts (which we also rate-limit automatically).

3. Why we process it, and our lawful basis

To provide the service you asked for — creating and maintaining your account, storing and delivering your messages and files, syncing your settings. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).
To keep the service secure and free of abuse — connection logging, rate-limiting, anti-spam, and moderation. Lawful basis: our legitimate interests in a safe, functioning service (Art. 6(1)(f) GDPR).
For optional features you choose to enable — such as mobile push notifications or voice/video calls. Lawful basis: your consent, given by enabling the feature (Art. 6(1)(a) GDPR).

We do not profile you, run advertising, or sell data. We have no commercial interest in your information.

4. How long we keep it

Data	Retention
Account information	For as long as your account exists.
Message archive (1-to-1 and group)	Automatically deleted after 1 month.
Uploaded files and media	Automatically deleted after 30 days.
Profile, roster, bookmarks, settings	Until you change or delete them, or delete your account.
Connection / technical logs	Kept short-term for security and then deleted (no longer than 30 days).
Account "tombstone" after deletion	Kept for 2 months to stop someone else re-registering your address. It does not contain your messages or profile.

When you delete your account, your messages, files, profile, and settings are removed according to the schedule above. The only thing retained is the tombstone described.

5. Who your data is shared with

We do not sell your data and we do not share it for advertising. Data leaves our servers only where the service itself requires it:

Federation. XMPP is a federated network, like email. When you message someone on another server, your message (its content, or ciphertext if encrypted, plus metadata such as addresses and timestamps) is delivered to that server, which is operated by a third party under its own policies.
Push notifications. If you enable push notifications on a mobile device, our server notifies an external push gateway (such as Apple's or Google's) so your device can wake up. We minimise what is sent, but the fact that a message arrived passes through that provider.
Voice and video calls. When a direct connection between callers is not possible, call media is relayed through our STUN/TURN server (turn.telepath.im). The relay can see the IP addresses of participants but does not store call content.
Bridged rooms. Some rooms may be bridged to other networks (for example a Discord gateway at discord.telepath.im). If you take part in a bridged room, your messages there are relayed to that other network and become subject to its operator's policies. Bridged rooms are identified as such.
Our hosting provider in the Netherlands, which provides the servers the service runs on, acting as our processor.

We may also disclose data if we are legally required to by a valid order under applicable law. We hold very little data and much of it can be end-to-end encrypted, so there is often little for us to give.

6. International transfers

Our servers and our hosting provider are within the EEA, so the data we store stays in the EEA. However, some of the optional flows described above can involve parties outside the EEA — for example a push-notification gateway, a federated server, or a bridged network may be located in another country. Where that happens it is an inherent part of how that feature or the federated network operates, and you can avoid it by not enabling the feature or not joining the bridged/remote room.

7. How we protect your data

Encryption in transit is required. All client and server-to-server connections must use TLS; unencrypted connections are refused.
End-to-end encryption is available. OMEMO lets you encrypt messages and files so that only you and your recipient — not the server — can read them.
Passwords are never stored in plain text. They are kept only as salted hashes.
Abuse protections. We rate-limit and throttle repeated failed logins to resist brute-force attacks.
Open configuration. Our server configuration is published openly so anyone can verify how the service is run.

8. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Rectify data that is inaccurate or incomplete.
Erase your data ("right to be forgotten") — you can delete your account at any time from your client, or ask us to.
Restrict or object to certain processing.
Port your data — receive a copy in a portable form.
Withdraw consent for any feature you enabled on that basis, at any time.

To exercise any of these, contact us at contact@telepath.im or admin@telepath.im. We will respond within the time limits set by the GDPR and we will not charge you for it.

If you believe we have mishandled your data, you have the right to lodge a complaint with the Swedish supervisory authority, the Integritetsskyddsmyndigheten (IMY) — imy.se — or with the data protection authority in your own country.