Transparency
What we store.
For how long. Who sees it.
You don't have to trust us — you can check. In the app, your server file shows the key data our server stores about your account, at any time. Here we explain openly what is encrypted and what isn't, how long we keep data and which service providers are involved.
In the app
Your server file
Profile → Security → “View my data”. The file is read fresh from our database every time you open it — for your account only, over an encrypted connection.
Instant, no request needed
No email, no form, no waiting. The file is put together the moment you open it.
The core sections
Account and sessions with IP address, consents, security, profile, identities, location, messages as raw data, metadata, groups, calls, contacts, files, archive and devices.
With retention period
Every section shows how long it is kept.
Everything else on request
The file shows the core sections. For a complete copy of all data about your account (Art. 15 GDPR), email info@aicq.app.
Honest about large amounts
For each section the app shows the latest 500 entries — and always states the total.
Only for you
The request only returns the data of the signed-in account. Nobody else can pull up your file through the app. To stop constant requests, it can be opened at most 6 times in 10 minutes and 30 times a day.
See every section of the file
At the top
- Sign-up IP
- Messages (raw data)
- Chat partners
Account & sign-in
- Account
- Active sessions
- Consents
- Security & keys
Profile
- Profile record
- Sub-accounts
- Location
Communication
- Messages: metadata
- Group messages
- Groups & voice channels
- Calls
Contacts
- Friendships
- Blocked by you
Content & files
- Files & uploads
- Archive (file storage)
Devices
- Devices
What is not in the file — and why
- Passwords, keys and codes. Your password (stored only as a one-way hash), 2FA secret, backup codes, sign-in tokens and key material are never shown — not even to you. The file only states that they exist.
- Further data about your account. The file only shows the core sections. Everything else we store about your account, for example purchases, logs or support requests, is sent to you on request to info@aicq.app — complete and machine-readable.
- Your shop in the Market. You can see its details, items and messages with the AICQ team in the app under “My shop”. The complete copy on request includes them too.
- Chats and groups in your vault. The file does not show messages, chat partners, calls or groups from your vault — so the vault stays hidden there too. Friendships are still listed, just like in your friends list. The complete copy on request includes everything.
- Internal abuse signals. We do not show risk scores from abuse detection, so they cannot be bypassed.
- Logs outside the database. Our hosting provider's access logs (with IP address) are not in the database and are deleted there automatically after 7 days.
- Data at service providers. What goes to service providers for individual features is listed below under Service providers.
- What is only on your device. Your private keys for end-to-end encryption, the app's message store and your encrypted chat backup are only on your device. The server only keeps the key to your chat backup, so you can open it again after signing in — without the file on your device it is of no use.
Encryption
What is end-to-end encrypted — and what isn't
- End-to-endOnly the devices of the people involved can read the content — we cannot.
- Encrypted in transitEncrypted on the way. On our server, however, the content is not end-to-end encrypted; access is controlled by permissions.
- Service providerGoes to an external service for this feature.
| What | Protection | Details |
|---|---|---|
| Text of your direct messages | End-to-end | Based on the Signal approach (Double Ratchet, ECDH P-256, AES-256-GCM). Forwarded and edited messages, and chats with an older app version without Signal, use a fixed key pair per chat (ECDH P-256, AES-256-GCM) — also end-to-end, but without the Double Ratchet. The server only stores the encrypted text; the keys are created on and never leave your devices. You can turn off end-to-end encryption for a chat (tap “E2EE” in the chat): new text messages in that chat then reach the server without it — encrypted in transit, but technically readable by us — until one of you turns it back on. You both see this right away from the red, open lock and in the chat; each such message shows an open lock. |
| Local P2P chat | End-to-end | Runs directly between two devices (WebRTC, encrypted) and is not stored. Our server helps set up the connection; STUN servers only see IP addresses. If no direct connection works, messages travel end-to-end encrypted via our server. |
| Photos, videos, voice messages, files | Encrypted in transit | Encrypted on the way and stored in non-public storage — not end-to-end encrypted. |
| Metadata in direct chats | Encrypted in transit | Polls, lists, file names, small preview images, transcripts and summaries are stored with the message entry and are not end-to-end encrypted. The server also sees who writes to whom and when — otherwise no message could be delivered. |
| Group and event chats | Encrypted in transit | Text and media are stored on the server without end-to-end encryption. Access is controlled by database permissions. |
| Business conversations (QR code, guest access) | Encrypted in transit | Encrypted in transit and stored with access protection, but not end-to-end encrypted — so the guest and the team can read along on any device. In the app and on the guest page, only the guest and the channel’s team see the conversation — including the photos and videos either of them sends in it. The server sees who writes when and the name the guest writes under. Messages from older app versions stay end-to-end encrypted. For “Translate”, see the next rows. |
| Market | Encrypted in transit | Listings (text, photos, video, price, city and status) are public: everyone in the app can see them. New listings are checked by an automated process (OpenAI, USA) before they appear. If you share a listing in a direct chat, the card is end-to-end encrypted like any direct message; in groups it is not. Whether a message looks like a scam is checked only on your device — nothing is sent to us. In chats about a listing, an account that is less than seven days old cannot send links in its first ten messages, and the app does not show links from them; for this it only asks the server whether the two accounts are less than seven days old (yes or no). |
| Shops in the Market | Encrypted in transit | The name, line of business, address, phone number, email, VAT ID and website of an approved shop, its location on the map and its checked items are public: everyone in the app can see them, even without an account. While a shop is paused, a link to its page shows only its name, line of business, town and its message. If the owner doesn’t open AICQ for 90 days, we pause the shop automatically (with a reminder 14 and 3 days before); for this we only keep the day the owner last opened the app. Our server looks up the spot for the address with Photon (komoot GmbH, Germany), sending nothing but the address. Every item is checked by an automated process (OpenAI, USA) before it appears; photos of 18+ goods are pixelated by the app before upload. If a shop photographs its items (on a table, a shelf or in a box, for example) so the AI can recognise them, the photo goes to OpenAI (USA) via our server; it is not stored — only the items the shop accepts, each with its cut-out as the photo. Messages between a shop and the AICQ team, including attachments, are seen only by the shop and our team. Offers and bundles are public like the items; an offer or bundle in a gold frame also highlights the shop on the map and the globe. Customers write to the shop through its business channel “Customer questions” (like business conversations) or in a direct chat — there end-to-end encrypted like any direct message. Whoever reports a shop stays unknown to the shop. |
| Street map | Encrypted in transit | The map comes from our own storage (map data © OpenStreetMap contributors), so no map service learns which area you look at. “My location” moves the map to your position; your position stays on your device. |
| Official warnings | Encrypted in transit | Our server fetches the warnings of German civil protection and the German Weather Service (NINA) from warnung.bund.de every five minutes; your device does not connect to the authorities for this. For the notice about your city, our server compares the city in your profile with the warning areas — your location is not transmitted. We show the texts unchanged. |
| Voice and video calls | Encrypted in transit | Routed through our call provider LiveKit (USA), encrypted on the way (DTLS-SRTP). Not end-to-end encrypted and not recorded. |
| Push notifications | Encrypted in transit | Contain the sender's name or UIN (for groups their name, for business conversations the name of the business or channel and of the guest, for Market notifications the listing's title and price, when a friend changes their UIN their name and new UIN) but no text from chats. Notifications about your shop contain the beginning of the AICQ team's message for a question, the reason for a rejection or block and, for a handover, a reminder before the automatic pause and the pause itself, the shop's name. Delivered via Google (Android) or Apple (iOS). |
| Chat backup | Device + server | The backup file is encrypted with AES-256-GCM and stays on your device. Its key is stored in your account on the server — the two only come together after you sign in. |
| Archive (folders, text files, photos, videos) | With password: on device | Without a password: encrypted in transit and stored in non-public storage — not end-to-end encrypted. With a password (you set it yourself, from 3 characters): names, texts, photos and videos are encrypted on your device with AES-256-GCM before they reach the server. The key is derived from your password (PBKDF2, 600,000 rounds); the password itself is never stored. Without it nobody can read the contents — not even us. A long password protects much better than a short one. |
| Translate | Service provider | Only for messages that are not end-to-end encrypted (for example after encryption was turned off in a direct chat), and only when you tap “Translate”: the text (up to 500 characters) is sent in plain text to MyMemory (Translated S.r.l., Italy). End-to-end encrypted private messages are never translated. |
| Translate in a business chat | Service provider | Only when you tap “Translate” on a message — the first time only after a notice: exactly that one message is sent in plain text via our server to OpenAI (USA), together with the language you want. We don’t store the translation; for the cost brake we note the time and cost, and the account for 2 days only. |
| Turn a voice message into text | Service provider | Only when tapped — for recipients only if the sender allowed it. The recording is sent to OpenAI (USA); the transcript is stored with the message without end-to-end encryption. |
| Summarise a transcript | Service provider | Only when tapped: the transcript text is sent to an AI service (Anthropic or OpenAI, USA). The summary is stored with the message. |
Retention periods
How long we keep what
Automatic clean-up jobs tidy the database regularly. Your server file also shows the periods for its core sections.
Account & sign-in
| Data | Kept for |
|---|---|
| Account, profile, contacts, settings | Until you delete your account |
| Previous UIN after a change (which account or identity it belonged to) | Blocked for 90 days — no one else gets it during that time, and your friends can still find you with it. After that only the block remains, without any link to you; special numbers (VIP numbers, numbers with fewer than nine digits) stay recorded until our team releases them. When an account is deleted, its UIN is blocked the same way — we remove the link to the account by the following night at the latest |
| Active sessions (device, IP address, last activity) | Until you sign out on that device |
| Sign-up (IP address, device, check results) | 90 days |
| Sign-in attempts (IP address, email only as a hash) | 24 hours |
| Consents (type and version, time, device, hash of the IP address) | Until you delete your account |
| Guest access without sign-up (including consent, key and the photos and videos you sent as a guest) | At the latest about 24 hours after the last conversation ends, about 2 hours if there is none — or immediately with “Delete access” |
| Taking a guest chat into the app (encrypted package with access data and conversation — we never know the code or the secret) | At most 30 minutes: deleted as soon as the app collects it, locked and deleted after five wrong codes, otherwise at the latest one hour after it expires. A new code replaces the old one |
| Signing in to the Partner Portal (UIN, confirmation number, hash of the secret, browser and operating system, times) | At most one day — that a browser signed in stays in the activity log for 14 days |
| Partner package of your business (until when, bought or granted by us, history) | Until the business is deleted — a purchase with coins also as a purchase receipt |
| Announcements from our team that you hid | Until we delete the announcement — at the latest with your account |
| Purchase receipts (product, time, purchase ID, price for coins) | Up to 10 years after the end of the year of purchase (statutory retention) — after an account deletion without your user ID |
Messages & content
| Data | Kept for |
|---|---|
| Direct messages including metadata | Until both of you have deleted them — at the latest with either account |
| “End-to-end encryption” setting per direct chat (off or on, who switched it last and when) | Until either account is deleted |
| Group and event messages | Until they are deleted — at the latest with your account |
| Self-destructing messages | Once read |
| View-once photos and videos | A few minutes after opening |
| Chat images no message refers to any more | 30 days |
| Scheduled messages | Until delivered |
| Stories | Until they expire, at most 90 days |
| Market listings including photos and video | 30 days |
| Blocked Market listings (visible only to you) | Up to 6 months after the decision (the period for your appeal) — with an open appeal until it is decided |
| Appeals and notification records for a listing | Together with the listing |
| Reports about profiles, messages, groups, listings and shops | Until we have handled and deleted them — if the reported account or content is deleted, another 6 months |
| Notice of the outcome of your report | 6 months |
| Market saved searches | Until you delete them — at the latest with your account |
| Your shop: details from the application, message for a pause, the day you last opened the app (for the automatic pause), messages with the AICQ team including attachments, requests for more space | Until you delete your shop (in “My shop” under Settings) — at the latest with your account. If you hand it over, we delete the messages with the AICQ team and open requests for more space immediately |
| Your shop’s items including photo and check result | Until you remove them or delete your shop — at the latest with your account. A hidden catalogue (no confirmation after 30 + 14 days) stays stored |
| Your shop’s offers and bundles | Until you end them — a bundle also as soon as fewer than two of its items are left; at the latest with your shop |
| Customer questions for your shop (conversations in the business channel “Customer questions”) | Like all business conversations; deleted together with your shop (if the business only belongs to the shop, with the whole business). If you hand over your shop, the earlier conversations stay with you |
| Photos for recognising items | Not stored |
| Translations in a business chat | Not stored; for the cost notes we delete after 2 days which account asked for the translation |
| AI costs per shop (time, type, amount) | For our cost overview; the link to the shop ends when the shop is deleted |
| Handing your shop over to another account (who, to whom, when, outcome) | 30 days after the offer ends, accepted handovers one year. The contact details entered when accepting only until the handover is complete |
| Note that an account deleted a blocked shop | One year — during that time we don’t approve a new application automatically |
| Address lookup for shops: address and spot on the map (not linked to your account) | At most 400 days after the last lookup |
| Address lookup: who looked up an address and when (abuse protection) | 2 days |
| Archive (folders, text files, photos, videos) — separate for every UIN | Until you delete it — at the latest with your account |
| Business conversations including messages, photos and videos | Until the conversation ends, then for as long as the business has set (0 to 365 days, 30 days by default); if the business deletes the channel, immediately with it. A guest’s photos and videos already with their guest access, an account’s with the account |
Logs & abuse protection
| Data | Kept for |
|---|---|
| The app's automatic error reports | 30 days |
| Activity log (e.g. searches) | 14 days |
| Counters against spam and overload | 1 hour to 7 days |
| Automatic IP blocks after unusually many sign-ups | Active for 24 hours, deleted after 7 days |
| Call invitations | 24 hours |
| Group call participation | 6 hours |
| Moderation log | 365 days |
| Hosting provider's access logs (outside the database) | 7 days |
| Automatic database backups | 7 days |
No automatic deletion yet
| Data | Kept for |
|---|---|
| Waitlist on this website (email address) | Until you ask us to delete it |
| Security events, reports sent via “Report a bug”, review history of profile changes, suspension records | No automatic period yet |
| Access codes of business channels (also with a guest name set by the business) | Until the channel or the business account is deleted |
| Manual backups made before larger changes | Until we delete them |
Service providers
Who else sees data
We don't sell data and include no advertising or analytics libraries. For individual features we work with these providers:
| Provider | What for | Which data | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, real-time delivery | All your account data — your server file shows you the most important parts | Servers in the EU (Ireland); US-based provider |
| Google Firebase Cloud Messaging | Push notifications on Android | Device token, sender's name or UIN (for groups their name, for business conversations the name of the business or channel and of the guest), type of notification, for Market notifications the listing's title and price, when a friend changes their UIN their name and new UIN, for notifications about your shop the status of the application, for questions the beginning of the AICQ team's message, for a rejection or block the reason and for a handover, a reminder before the automatic pause and the pause itself the shop's name — no text from chats | USA |
| Apple Push Notification service | Push notifications and calls on iOS | Device token, sender's or caller's name or UIN (for groups their name, for business conversations the name of the business or channel and of the guest), for Market notifications the listing's title and price, when a friend changes their UIN their name and new UIN, for notifications about your shop the status of the application, for questions the beginning of the AICQ team's message, for a rejection or block the reason and for a handover, a reminder before the automatic pause and the pause itself the shop's name — no text from chats | USA |
| LiveKit | Voice and video calls, voice channels | Audio and video during the call (encrypted on the way, not recorded), room and participant IDs, IP address | USA |
| OpenAI | Turning voice messages into text (only when tapped); automatic checks of new profile details, listings, shop items and group pictures for prohibited content; recognising the items on a shop’s photos (only when tapped); translating single messages in a business chat (only when tapped) | The recording; for checks the username, display name, bio and profile picture, or the listing’s text, city and photos, or an item’s name, quantity, description and photo, or the group picture; for item recognition the photo (in up to six parts) and the app language; for a translation the text of that one message and the language you want | USA |
| Anthropic (or OpenAI, depending on setup) | Summarising a transcript (only when tapped); analysis of error reports by our team | The transcript text; for error reports you send via “Report a bug”: description, device details, log and your UIN | USA |
| MyMemory (Translated S.r.l.) | Translation (only when tapped, never for end-to-end encrypted messages) | The text to translate, up to 500 characters, in plain text | Italy |
| komoot GmbH (Photon) | Spot on the map for a shop’s address (when applying) | Only the address (street and number, postcode, town, country); the request comes from our server, without your IP address | Germany |
| Google (Tenor) | GIF search | Search terms, IP address | USA |
| Cloudflare (Turnstile) | Protection against automated sign-ups | IP address, technical features of device and browser | USA |
| RevenueCat | In-app purchases | App user ID, purchase receipts from the app stores | USA |
| Google Play | Buying coins and Premium in the Android app | The purchase runs through your Google account; we receive the product, the purchase ID and, for coins, the price | USA |
Smaller technical requests
| Who | What for | What is transmitted |
|---|---|---|
| STUN servers (Nextcloud, sipgate, Telekom, 1&1 — Germany) | Setting up the local P2P chat connection | IP address |
| Relay server (TURN) | Only if no direct P2P connection is possible | The encrypted data stream is passed on; only IP addresses are visible |
| Google News | News in the news window | City or country and language — requested by our server, without your ID. The app loads article preview images directly from Google servers; Google sees your IP address when it does. |
| Google (favicon service) | Small logos of news sources | IP address, address of the source |
| LottieFiles, jsDelivr, unpkg | Animations, emoji images, map data | IP address |
| Apple (App Store) | Update notice on iOS | IP address, app ID |
| Google (Play Store) | Update notice on Android | App ID and version — via the Google Play services on your device |
| Have I Been Pwned (Australia) | Check by our team whether an email address appears in known data breaches | Only the first 6 characters of a hash — not the address itself |
Deletion
What happens when you delete
Deleting your account
In the app under Profile → Account → “Delete account”. Among other things, your profile, your messages (sent and received), files, friendships, groups you founded, your Market listings and saved searches, your shop with all items, photos and messages with the AICQ team, and your keys are deleted immediately. Instructions (German)
What runs out later
Some protection logs stay until their period ends, for example sign-up data (90 days) and the moderation log (365 days). Purchase receipts are kept for up to 10 years because the law requires it — without your user ID, only with the store's purchase ID. Automatic database backups are overwritten after 7 days. Messages in business conversations stay in the conversation until it ends and the business’s retention period has passed.
Individual content
Messages disappear from the server once both of you have deleted them. You can delete or switch off Market listings and saved searches, your shop’s items or the whole shop, profile details and location yourself at any time.
To be clear
A few tables do not have automatic deletion yet, and manual backups are not cleaned up immediately when an account is deleted. Both are listed above under “No automatic deletion yet”.
Our promise
What we never do
- Read your private texts. They are end-to-end encrypted; only your devices hold the key.
- Sell data. There are currently no ads in AICQ either. Should ads be added later, we will explain here beforehand how they work and which data is used for them.
- Include tracking or analytics services. The app contains no such libraries and this website sets no cookies.
- Ask for your phone number. You get your own AICQ number (UIN).
- Record calls. Audio and video are only transmitted, never stored.
- Make it hard to see your data. Your server file is free and needs no request.
As of 23 October 2026. This page describes the technical implementation. The legally binding text is the privacy policy (German). Questions: Support & contact.