Privacy

Halo · Effective 5 November 2026

Halo cannot read your chats and does not know who you talk to. There are no accounts, no phone numbers, no contact uploads and no message history on any server. Halo collects no data: nothing about you is kept anywhere but on your phone.

What stays on your phone

“Panic wipe” in Settings erases all of it, including the keys in the Keychain, which iOS can otherwise keep after an app is deleted, and your iCloud backup if you made one.

Optional backup to your iCloud

Backup is off unless you turn it on (Settings › Backup, iPhone only). When it is on, Halo encrypts your profile, the profiles of the people you chat with, who you blocked and your messages on your phone, with a key made from a recovery key or passphrase that only you keep, and saves the result in your own iCloud Drive. It never goes to us. Apple stores it but cannot read it, with or without Advanced Data Protection, and neither can we: we never see your recovery key or passphrase, so if you lose it, the backup cannot be opened by anyone. Your encryption keys are never in a backup, so after restoring on a new phone your chats come back to read, and to keep talking with someone you meet them nearby again. Turning backup off deletes it from iCloud.

Notifications

When a message reaches your phone directly, Halo opens it on the phone and shows who wrote and what; nothing is sent anywhere. When a message waits at the relay while Halo is closed, the relay asks Apple to show “New message” and nothing else, because it cannot read the message. For that, your phone gives the relay its Apple push address (on Android, its Firebase Cloud Messaging address) for the inbox addresses of your chats, each with a random reference for the chat; the relay keeps them for three days. Your phone matches that reference to the person’s name and photo, which it keeps for this alone, so the notification can say who wrote. Muted chats are never registered. You can turn notifications off in iOS Settings at any time.

Bluetooth

Halo uses Bluetooth to find people nearby and to carry chats between phones directly. Every message is end to end encrypted (X25519 key agreement in person, then the Double Ratchet with XChaCha20-Poly1305). Turning on “hidden” stops your phone from advertising itself.

Halo Pro and the relay

With Halo Pro, a chat continues over the internet through our relay. The relay only ever holds sealed, padded envelopes under random-looking addresses that change every day. It deletes each envelope when it is collected, and after 7 days at the latest. It cannot open them, and it does not store IP addresses or keep request logs.

View-once photos travel the same way: sealed on your phone with a key only the recipient gets, held by the relay until they are fetched once (then deleted), and for 7 days at the latest.

Relay use is paid with anonymous tokens (blind signatures). The part of the service that issues tokens checks the App Store’s signed proof of your subscription and keeps nothing: not the proof, not a count, not when you asked. The part that carries messages sees only tokens. Neither can connect a subscriber to a conversation.

Invites

An invite is a link whose secret part (after the #) is never sent to any server, ours included. The friend’s chat request and the chat’s first few messages travel sealed through small one-time boxes on the relay, which hold at most a handful of envelopes and delete everything after 24 hours. No account, no list of invites and no record of who invited whom is kept anywhere.

When a friend you invited writes in the chat, you earn a week of Pro. To make each phone count only once, ever, the friend’s phone asks Apple (App Attest and DeviceCheck) or Google (Play Integrity) to vouch for it, and Apple or Google keeps one bit for that device saying it has counted. That bit says nothing about who invited whom. The relay checks the answer, signs your week, and keeps only a random number per week so the same week can’t be used twice.

Purchases

Subscriptions are sold and processed by Apple alone, through the App Store, under Apple’s privacy policy. Halo uses no billing service in between and receives no name, email or payment details.

App updates

Halo downloads its own updates from our update server, which keeps no logs and stores nothing about the phones that ask. Every update is signed by us, and the app refuses any that isn’t.

What we do not do

Children

Halo is not directed at children under 13.

Contact

Questions: moimaere@gmail.com. If this policy changes, this page changes with it.

The full technical design is public in Halo’s privacy architecture document.