Tetracom Privacy Policy

Effective date: November 3, 2026

This is the privacy policy for Tetracom. It explains what information Tetracom collects, how it is used and shared, how long it is kept, and how you can delete it.

• Who we are
• Short version
• Your identity
• Messages
• Contacts, invites & reports
• Location
• SOS
• Notifications
• Ads
• Server logs
• Phone numbers & SMS
• Website & advertisers
• Who receives data
• Security
• On your device
• Children
• Retention
• Account deletion
• Your choices
• Changes
• Contact

1. Who we are

Tetracom is operated by TETRACOM LLC (“we”, “us”). The developer name on our Google Play developer account is David J Hansen.

• Website: https://tetracom.me/
• Privacy questions and requests: help@tetracom.me

This policy covers the Tetracom Android app, the Tetracom iOS app (for iPhone), the Tetracom Web App at tetracom.me/app, and the tetracom.me website, including the pages for advertisers. Where the apps differ, we say which app a statement applies to.

Tetracom is still a prototype.

2. The short version

• Message content is end-to-end encrypted on your device. Our server does not decrypt it.
• Our server does keep your identity, your contacts, and records of who sent messages to whom and when.
• We ask for your date of birth. We do not ask for your name, e-mail address, phone number or address book.
• Location for ads is off unless you turn it on. If you turn it on, the app sends your location to choose ads, and we keep it, rounded to about 1 km, with the record of each ad you are shown or tap.
• Advertisers see only grouped statistics. They never see your userid.
• We do not sell your personal data. We use no analytics or crash-reporting services.

3. Your Tetracom identity

To use Tetracom you register an identity. We ask for:

• a userid you choose (3 to 30 characters: a–z, 0–9, _ and -);
• a display name (also called a handle, 2 to 50 characters);
• your date of birth. It is required.

We do not ask for your real name, e-mail address, phone number or a password. There is no phone verification.

Encryption keys. When you register, our server creates an RSA key pair for you. It sends the private key to your app once, over the encrypted connection. Our server keeps only the public key. It does not store your private key. The Android and iOS apps then create a second key pair (X25519) on your device and send us only the public half. The Web App does not create this second key pair.

What we store for your identity: your userid, display name, date of birth, public keys, when you registered, your settings for location-based ads and read receipts, and the feature tag your app sends with each message. The feature tag is a fixed label set when the app was built; it is not the app’s real version (see Server logs). It is updated each time you send a message.

Terms record. If your app sends it when you register (the Android app does), we also store with your identity the version of the Tetracom Terms of Use you accepted and the time our server received it.

When you register, our server also writes your userid, display name and the Terms of Use version (if sent) to its log. Earlier versions of the server also wrote your date of birth to the log.

Your userid is public. It works like a username. It can be used to look up your display name, whether you are online, and your app’s feature tag. Your contacts’ apps receive your public keys so that they can encrypt messages to you. There is no public list or search of users. People add you by typing your exact userid.

More than one identity. The Android app can hold several identities. It asks our server how many messages are waiting for each of them. This lets our server tell that those identities are on the same phone.

4. Messages

Content is end-to-end encrypted. Voice clips, text, questions, locations and SOS messages are encrypted on your device before they are sent. Our server passes on and stores only the encrypted form. It does not decrypt it.

• Android and iOS apps: X25519 key agreement and AES-256-GCM, using the X25519 keys created on the devices.
• Web App: each message is encrypted with a new random AES-256-GCM key, and that key is encrypted with the recipient’s RSA public key (RSA-OAEP). This is the RSA key pair our server created at registration (see Your identity).

Relayed or queued. If the recipient is online, our server passes the encrypted message straight through and does not store it. If the recipient is offline, our server stores the encrypted message until it is delivered. It is deleted as soon as it is delivered, or after 24 hours if it is not delivered. One exception: a notice telling a contact that an identity was deleted can wait up to 30 days.

Queue limits.

• There is no fixed limit on the number of waiting messages. Each one is still deleted when it is delivered, or after 24 hours if it is not, as described above.
• For location messages, only the newest one from one sender to one recipient is kept.
• Connection checks (“pings”) are never stored.

Message records (metadata). For every message, our server keeps a record of the sender’s userid, the recipient’s userid, the size, the time sent, the time delivered, the time played (only if read receipts are on) and the status. Our server also sees the type of each message, such as voice, text or location. It does not see the content. These records have no time limit. They are deleted when the sender or the recipient deletes their identity.

Read receipts. “Send read receipts” is off by default. When you turn it on, the Android or iOS app tells our server when you play a message. Our server records the time and tells the sender.

Groups. Contact groups are kept on your device. A group message is sent as a separate encrypted copy to each member. Our server sees these as separate messages.

Blocking. When you block someone, our server records who blocked whom and when. Messages from that person to you are dropped: they are not delivered, and their content is not stored. Our server log records each dropped message with both userids.

Reports. If someone reports you, their report can include an excerpt of a message you sent them, in readable form. See Reports.

5. Contacts, parents, channels, teams, invites and reports

Our server keeps the following in readable form. It is not end-to-end encrypted.

• Contact requests and contacts: who asked whom, the status and the times. An approved request is your contact link. Unanswered requests expire after 72 hours but stay in our database.
• Group name: if you ask to connect through a contact group, the group’s name is sent to our server and stored with the request.
• Parent links: which identity is linked as a parent of which, and when. See Children.
• Channels: name, owner, visibility, members, roles and invitations. Channel posts and the channel key are end-to-end encrypted.
• Teams: name, owner, members, roles and invitations, the team’s location-sharing settings, and whether each member is sharing. Never coordinates.
• Invites: the code, who created it, an optional label you type (for example a name), when it was used and by whom, and its expiry (30 days). Anyone with the code can see your userid, display name and the label. Expired invites stay in our database.
• Reports: when someone reports another user (in the Android app, with Report on a contact’s screen), we store the reporter’s userid, the reported userid, the category (for example spam or harassment), any details the reporter types (up to 1,000 characters), an optional excerpt of a message and its time (up to 2,000 characters, only if the reporter’s app includes one), and the time of the report. The people who run Tetracom review reports and add a status and their own notes. Our server log records the two userids and the category, not the details or the excerpt.

Tetracom does not read your address book. In the Android app, an invite is sent through your own text-messaging app. In the iOS app, you share it through the iPhone share sheet. You choose the recipient. Tetracom does not see the phone number.

6. Location

• Sharing your location with contacts (share once, live sharing, answering a location request, team location): your coordinates are end-to-end encrypted. Our server sees that a location message was sent, and to whom, but not where you are. If the recipient is offline, only the newest location is queued, for at most 24 hours.
• Live sharing on Android sends an update about every 15 seconds when you have moved at least 10 metres. It runs as a foreground service, with a notification (“Tetracom — sharing live location”) shown while it is on, so it keeps working when the app is not on screen. The Android app does not ask for background location permission.
• In the iOS app, team live sharing and an active SOS use the “Always” location permission, so they keep sending encrypted updates when the app is not on screen, until you turn them off.
• “Where am I” on Android shows your position on the in-app map. If you tap Open in Google Maps, or ask for directions, the app opens Google Maps with your coordinates (and, for directions, your contact’s). Google receives them.
• On Android, the app gets your location from Google Play services. On iPhone, the app gets it from Apple’s Location Services.
• Maps in the Android app and the Web App load map images from OpenStreetMap. OpenStreetMap’s servers see your IP address, your app or browser details, and which map area you are viewing.
• Maps in the iOS app use Apple Maps (MapKit). Apple’s map servers see your IP address and which map area you are viewing.
• Location for ads is explained in Ads.

7. SOS

• An SOS alert, and the location updates sent about every 30 seconds while an SOS is active, are end-to-end encrypted messages to the people in your Safety Circle. Our server handles them like other messages. It sees who they are sent to and when. It cannot tell that they are SOS messages.
• SOS audio (Android, off by default). If you turn it on and allow the microphone, an active SOS records audio clips: automatically every 15 seconds, or only while you hold the button. Each clip is end-to-end encrypted and sent to your Safety Circle. The recording file is deleted from your phone as soon as the app has read it for sending.
• In the Android and iOS apps, if the app is still setting up encryption with a circle member, a message or clip for that person waits on your phone, unencrypted, until it can be sent.
• The log of SOS alerts you sent is kept on your device only.
• Tetracom is not an emergency service. In an emergency, call 911 or your local emergency number.

8. Notifications

The Android app does not use Google’s push service. It keeps its own connection to our server. The iOS app does not use Apple’s push notification service; it receives messages over its own connection to our server.

In the Web App, if you turn on notifications, your browser gives us a push address and keys. We store them with your userid. The address belongs to your browser maker’s push service (for example Google, Mozilla, Microsoft or Apple). Each notification goes through that service. It says only that a new message arrived. It contains no message content.

We delete the push address when you turn notifications off, when the push service tells us it no longer works, or when your identity is deleted.

9. Ads

The Android app and the iOS app show an ad bar. The Web App shows no ads. Neither app contains an advertising company’s software, and the iOS app does not read or send Apple’s advertising identifier (IDFA).

House ads and advertiser ads. An ad is either Tetracom’s own (a “house ad”) or an ad from an advertiser. The app asks our server for an ad each time it connects to our server. The request includes your userid and your location-ads setting. Our server picks one approved ad. It uses your age (from your date of birth), the location your app sent (if any), and which ads were shown to you in the last 24 hours, to limit repeats from the same advertiser.

Location-based ads (Android: Settings → Location-based ads; iOS: Settings → Ads). The default is Off.

• Off: no location is sent for ads.
• Approximate (~1 km): your phone’s last known location, rounded to about 1 km, is sent with each ad request.
• Precise: your phone’s last known location, not rounded, is sent with each ad request.

The app sends a location only if you chose Approximate or Precise and gave the app location permission. The Android app reads and sends a location for ads only while the app is open; when it connects to our server in the background, it asks for an ad without a location.

iOS: App Tracking Transparency. The iOS app asks for Apple’s tracking permission (“Allow Tracking”) only when you choose Approximate or Precise. It does not ask when the app starts. If you do not allow tracking, or turn it off later in iPhone Settings, the iOS app treats location-based ads as Off and sends no location for ads. Either way, ad requests and ad view and tap reports still include your userid, as described here.

Advertisers can limit an ad to an area: a circle around a point, a shape they draw, or a named region. Our server compares the location your app sent with those areas, and can pick such an ad only if your location is inside its area. Without a location, you are shown only ads that are not limited to an area.

Our server does not store the location from an ad request in the database. But the location is part of the request address, so it is written to our server logs. Your setting (Off, Approximate or Precise) is stored with your identity.

Ad views and taps. When an ad is shown or tapped, the app reports it to our server. We store the ad, your userid and the time. For a tap, we also store which part of the ad you tapped. If location-based ads are not Off, we also store your location rounded to about 1 km (the app rounds it, even if you chose Precise). Together, these records show roughly where you were when you were shown or tapped each ad. They have no time limit. They are deleted when you delete your identity. Turning location-based ads off does not remove them.

Tapping an ad opens the advertiser’s web page in your browser (in the iOS app, in a Safari window inside the app), your phone’s dialer with their number, or directions in Google Maps (Android) or Apple Maps (iOS). Those then see your visit as usual. If an ad’s picture is stored on another website, your phone loads it from there, and that website sees your IP address.

What advertisers see. Advertisers never see your userid, your date of birth or your exact location. For their own ads, they see:

• how many times each ad was shown and tapped, the tap rate, and how many different users it reached;
• a breakdown by age group (18–24, 25–34, 35–44, 45–54, 55+ and unknown), worked out from users’ dates of birth;
• a map of where ads were shown and tapped, in squares of about 1 km.

For each ad, an age group or map square is shown only if it covers at least 5 different users of that ad. Smaller groups are hidden. The totals across all of an advertiser’s ads add up these per-ad counts, so a group in the totals can cover fewer than 5 different people.

Under 18. If your date of birth shows you are under 18, our server does not pick any ad for you, so you are never shown advertiser ads. The Android and iOS apps then show their built-in house ad. The app still reports when that house ad is shown, with your userid and, if location-based ads are on, your location rounded to about 1 km.

10. Server logs and technical data

Our servers keep logs. They can include:

• the address of each request, which can contain your userid and, for ad requests with location-based ads on, your coordinates;
• network details such as IP addresses, and the time of each request;
• your userid, display name and Terms of Use version when you register (logs written by earlier versions of the server also contain the date of birth);
• the reporter’s and the reported userid, and the category, when a report is filed;
• sender and recipient userids when messages are routed, queued or blocked;
• contact requests, parent links, invites and team changes;
• short pieces of requests our server could not understand.

With each message, the Android app sends a fixed feature tag (“hv v0.6.2 ack”) and the iOS app sends “tcae1 v0.1.0-ios ack”. These tags are not the apps’ real versions. The Android app’s real version is sent only when you open Help from the Android app: the link includes your phone’s maker, model, Android version and the app version, so these appear in our logs.

While you are connected, our server keeps your IP address and your app or browser details (User-Agent) in memory. The people who run Tetracom can see them on an admin page. They are not stored in the database, and they are dropped when you disconnect.

There is no fixed retention period for logs yet.

11. Phone numbers and text messages

• The Tetracom apps never ask for your phone number.
• SMS relay (Android, advanced, off by default). You can set up your own phone, with the separate Tetracom SMS Gateway app, to send text messages for senders you allow. An allowed sender sends your phone an end-to-end encrypted instruction with a phone number and a text. Your phone sends the text through your mobile carrier, which sees the number and the text like any text message. Our server sees only an encrypted message. The gateway app’s job records do not keep the number or the text in readable form. Its log hides the last 4 digits of the number and shows the rest.
• Texts to a Tetracom number. Our server can receive text messages sent to a Tetracom phone number through Twilio. When it does, Twilio handles the message, and our server writes the sender’s number, the receiving number and the full text to its log. They are not stored in the database.

12. Website, advertisers and sign-up forms

• The tetracom.me website uses no analytics and no tracking cookies. It sets a login cookie only for the advertiser portal (kept for up to 30 days) and for the admin pages.
• The advertiser form and the iPhone and Windows waiting lists store what you type (company, contact name, e-mail, phone, region, budget and message, or just an e-mail address). They also store the IP address and browser details (User-Agent) of the request.
• Advertiser accounts store an e-mail address, a password (as a bcrypt hash, never in readable form), and optional company and contact names. Ad pictures uploaded by advertisers are public. Billing records hold credit amounts and prices. We take no card details.
• The advertiser dashboard loads map images from OpenStreetMap and program code from unpkg.com.
• There is no way yet to delete an advertiser account or a form entry yourself. E-mail help@tetracom.me to ask.

13. Who receives your data

Service providers. Service providers that process data for TETRACOM LLC, such as the company that hosts our server and Twilio (for text messages to a Tetracom phone number), must protect it in a way consistent with this policy.

Independent services. OpenStreetMap, Google, Apple, your phone’s speech-recognition service, browser push services, unpkg.com, advertisers and their websites and ad picture hosts, and your mobile carrier are independent services. They are not run by TETRACOM LLC and do not process data for us. Their own privacy policies apply to what they receive. We do not control how they protect it.

We do not sell your personal data. We do not use analytics, crash-reporting or advertising SDKs in the apps.

We may disclose information when the law requires it, or to report child sexual abuse material to the authorities.

Business integrations. Tetracom’s server has a feature that can send notices about messages and contact requests to a business’s own system. It is not in use: no business integration is set up. If we turn it on in the future, we will update this policy first.

14. Security

• Connections to tetracom.me use HTTPS (TLS). The apps connect to tetracom.me by default. The Android app lets you type a different server address. If that address starts with http://, the connection is not encrypted.
• Message content is end-to-end encrypted on your device. Our server does not decrypt it.
• The other information described in this policy is kept on our server in readable form. We do not add our own encryption to the database.
• No system is completely secure. We cannot promise that information we hold will never be accessed or disclosed without permission.

15. Data on your device

Android app

• The app stores your identities in its private storage on the phone: userid, display name, date of birth, private keys, contacts, parents, blocks and settings. The private keys are not kept in Android’s hardware-backed keystore.
• Messages you receive (text, locations and other content) are stored unencrypted in the app’s storage. The History setting keeps 20 per identity by default; 0 deletes them after reading. Received voice clips stay in the app’s cache until Android clears it.
• Messages waiting for encryption to be set up are stored unencrypted until they are sent.
• The app writes location coordinates to the phone’s system log.
• Crash reports stay on your phone. You can view, copy or clear them in Settings → Diagnostics.
• Backup to Google’s cloud is turned off for the app. Phone-to-phone transfer is not turned off: on Android 12 and newer, when you copy your apps and data to a new phone, the app’s data, including your identities and private keys, can be copied to the new phone.

iOS app

• Your private keys are kept in the iPhone’s Keychain, set to “this device only”. They are not synced to iCloud Keychain, and they do not move to another iPhone through a backup.
• The app’s files on the phone hold your identities (userid, display name, date of birth and server address), contacts, groups, parent links and the SOS log. Settings are kept in the app’s preferences. The app does not exclude these files from iPhone backup, so they can be included in your iCloud or computer backup.
• Messages waiting for encryption to be set up are stored unencrypted in the app’s files until they are sent.
• Messages you receive are kept in the app’s memory only. They are not saved to the phone’s storage.
• When you delete your identity in the iOS app, the app removes it from its list of identities and deletes its RSA keys. Its other files on the phone, such as its contact list, and its X25519 key are not deleted.

Web App

• Your browser’s storage holds your identity, including your private key (not encrypted), userid, display name, date of birth and server address. It also holds your groups.
• “Export / back up” creates a file that contains your private key. Keep it secret.
• To remove everything the Web App keeps, clear the site data for tetracom.me in your browser.

16. Children

You must be at least 13 years old to use Tetracom.

Tetracom asks for your date of birth when you register. We do not verify it. If the date of birth shows an age under 13, our server refuses the registration and no identity is created.

If you are under 18:

• Our server does not pick any ads for you. The Android app shows its built-in house ad, and reports when it is shown (see Ads).
• If your identity has a linked parent, each new contact request you send waits until a parent approves it. Only then does the other person see it. If you have no linked parent, your requests go straight through.

Parent links. In the Android app, a child links a parent in Settings → Parental controls, for example by typing the parent’s userid. The child can unlink a parent in the same place.

A linked parent can see:

• the child’s approved contacts (userid, display name, and when they connected);
• contact requests waiting for a parent’s approval.

A parent cannot see message content. Our server does not have it.

If you believe a child under 13 is using Tetracom, e-mail help@tetracom.me and we will delete the identity.

17. How long we keep data

Deleted data may remain in logs and backups until those are removed.

18. Account deletion

You can delete your Tetracom identity in the Android app, in the iOS app (Settings → Delete account on server…), or by e-mail. Step-by-step instructions are on the support page: Delete your Tetracom identity and data. Before the iOS app deletes your identity, it tries to send each of your contacts an encrypted notice that the identity was deleted. Contacts who are offline at that moment do not receive it, because deleting your identity also deletes messages still waiting for delivery.

Deleting your identity removes from our server:

• your identity record: userid, display name, date of birth, public keys, settings and terms record;
• your contacts and contact requests, parent links, blocks, invites you created, and your channel and team memberships (and channels and teams you own);
• team invitations you sent or received;
• encrypted messages waiting for delivery to or from you;
• message records where you are the sender or the recipient;
• ad view and tap records with your userid (and location rounded to about 1 km, if it was sent);
• your Web App push address;
• records of notices to a business integration that name you (see Who receives your data).

Invites you used are kept, with your userid removed. Reports you filed, and reports about you, are kept with your userid removed; a report can still contain the details or message excerpt the reporter sent (see Reports). After deletion, your userid is free, and someone else can register it.

It does not remove:

• server logs (logs written by earlier versions of the server may also contain the date of birth you gave when you registered);
• database backups and copies;
• copies on other people’s devices, such as messages you sent them and your entry in their contacts.

We are updating Tetracom to delete more of this data.

19. Your choices

• Location for ads: Settings → Location-based ads → Off (Android), or Settings → Ads → Off (iOS). On iPhone you can also turn off “Allow Tracking” for Tetracom in iPhone Settings.
• Read receipts: turn off “Send read receipts” in Settings.
• Location sharing: stop live sharing, or stop sharing with a contact.
• SOS audio: leave it off, or turn it off.
• Web App notifications: turn them off in the Web App.
• Permissions: remove location, microphone or notification permission in Android Settings → Apps → Tetracom → Permissions, location or microphone permission in iPhone Settings → Tetracom, or permissions in your browser’s site settings.
• Contacts: block anyone, and unlink a parent link.
• Delete your identity in the Android or iOS app, or by e-mail. See the support page.

Turning a setting off stops new collection. It does not delete data already collected. Deleting your identity does that, as described in Account deletion.

20. Changes to this policy

We will post any change on this page and update the effective date at the top. If a change means we collect or share more data, we will post it here before it takes effect.

21. Contact

TETRACOM LLC
E-mail: help@tetracom.me
Website: https://tetracom.me/