Privacy at Engaz

In short

We keep only what the service needs to work. We do not sell your data, and there are no ads or third-party trackers.
Secret chats are end-to-end encrypted: the server cannot read them.
You can export your data or delete your account for good from Settings at any time.

Data	Why	Kept
Phone number, name, photo, about, username	To sign you in and so people know who they talk to	until you delete your account
Messages, photos and files	To deliver them and keep your chat history on your devices	until you delete them, or disappearing messages expire
Your business data (services, orders, customers)	For the business tools	until you delete it
Signed-in devices (sessions)	To keep you signed in; you see and end them in Settings	until you sign out or they expire unused
Login codes sent to your phone	To verify your number and stop abuse	7 days
When messages were delivered and read	For «Message info»	180 days
Cached link previews	To show previews quickly	30 days
Cached translations	So the same text is not sent for translation twice	90 days
Reports and app problems you send	To review and handle them	365 days after they are handled
Server logs	To find faults and attacks; they hold no message text, and codes and phone numbers are masked	short, set by the server operator
Backups	To recover from a failure; encrypted with an AES-256 key	a few weeks, then replaced

The people you message see what you send them. Others see your profile and last seen according to the privacy settings you choose.
Links to photos and files are signed and end after 7 days, so an old link someone finds does not open.
In a business account, employees see only the chats the owner gives them.
The service team does not read chats. When you report a chat, its last messages are attached to the report for review, and every admin action is logged.
Nothing goes to other companies unless you ask: the text of a message you tap «Translate» on, or a payment through the payment provider.

The connection between the app and the server is encrypted (HTTPS) on the official address.
The database and uploaded files are readable only by the server account itself, and backups are encrypted.
Limits on repeated attempts, alerts on unusual activity, and malware scanning of files when it is turned on.

Export your account information: Settings → Account → Request account info.
Delete your account with all your messages and files: Settings → Account → Delete account.
See and end signed-in devices: Settings → Account → Devices.

Questions about privacy, or a security issue to report: https://www.engaz.net/security