Privacy Policy
Last updated: 31.10.2026
Data we collect
- From your Google account (at sign-in, with your consent): name, email address, profile picture and Google account ID. We request no other Google data.
- Content you send: messages, files, images and voice recordings.
- Technical data: read status, online status (active / idle / offline), timestamps and server logs (IP address) for security.
- Settings: theme, language, sound and status mode; a conversation’s theme, which all of its participants see.
- Plan and usage: your plan and counts of files sent, downloaded and stored, used to enforce plan limits.
- Payments: paid plans are sold by Paddle as merchant of record. We never receive card details — only subscription status, amount and Paddle customer ID.
How we use it
- to create your account and sign you in;
- to let other users find you by your exact email address and message you;
- to deliver messages and store your conversation history.
- to send service notifications (by email and in the extension): approaching your storage limit, a reminder when you haven’t signed in for a long time, account deletion warnings. We send news and offers only until you opt out — via the link at the bottom of the email or in the extension settings.
We do not sell Google data, use it for advertising or share it with third parties. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who sees your data
Other DenCloud users see your name, email and photo when they find you by email or share a conversation with you. Messages and files are visible only to the participants of that conversation, and files in “My files” only to you. Files are stored under random, unguessable links. Service administrators can access files solely for security, abuse review and technical support.
Files in “My files” are private. If you share a file by link, anyone with the link can view and download it until the link expires or you stop sharing. We keep view and download counts; we do not link viewers’ IP addresses to the link.
Group polls are visible to the group’s members. In anonymous polls they can’t see who voted for what. Polls are not end-to-end encrypted.
End-to-end encryption
If you turn on encryption, messages, files and voice notes are encrypted in your browser in conversations where every participant has it enabled. We store only ciphertext, your public key and your private key encrypted with your password (and recovery code). Your encryption password and recovery code never leave your device, so neither we nor administrators can read encrypted messages or recover your password. We can still see metadata: who messaged whom and when, message type and file size.
Where data is stored
- Account and messages: our server (dencloud.app), in a MySQL database.
- Files, images and voice notes: Backblaze B2 cloud storage, delivered via the Cloudflare CDN. These services process data only on our instructions.
- In the browser the extension stores only your sign-in token and settings (theme, language, sound, status).
The extension does not read the web pages you visit, your browsing history or other tabs. The microphone is used only while you record a voice message.
Retention and deletion
Data is kept while your account is active. You can request deletion of your account and data at [email protected] — we complete requests within 30 days.
In Settings (“Manage account”) you can temporarily close your account — you disappear from search and your data is kept until you sign in again — or delete it permanently. Before deletion you can request a backup: we email you a download link to a ZIP archive (your files and chats); the archive is kept for 7 days and then deleted for good. End-to-end encrypted content can’t be included in the backup.
If you don’t sign in for 12 months, your account is deleted automatically together with all messages and files. Before that you get a warning by email and in the extension 30 and 7 days in advance; opening the extension once is enough to keep the account. Accounts with a paid plan are not deleted automatically. After deletion, others will see “Deleted user” in their direct chats with you.
Security
Connections are encrypted (HTTPS/WSS). Your sign-in token is stored only in your browser, and you can sign out at any time.