[OKTET]

Privacy Policy

Last updated: 20 October 2026

This policy explains what personal information Oktet collects, why we collect it, how we store it, who we share it with, and how you can have it deleted. We have tried to write it plainly. If anything is unclear, please contact us at [email protected].

Who we are

Oktet is a private app for friends and family. It is a small independent project, run by a sole trader based in New South Wales, Australia (ABN 21 160 303 234). In this policy, "Oktet", "we", "us" and "our" refer to that operator. The service is intended for people aged 18 and over.

What we collect and why

We only collect what we need to run the service. Specifically:

• Your phone number. We use it to create and sign in to your account. We verify it by sending you a one-time code by SMS. Your phone number is your primary identifier on Oktet.
• Profile information you choose to provide. A display name is required. You may optionally add a short bio, a profile photo, a location and a date of birth. Your date of birth, if you add it, is shown only to people you share a channel with (a one-to-one chat counts as a channel). Accounts made with an early version of the app may also hold a first and last name.
• Content you create. This includes the channels you create or join, and the messages, posts, responses, reactions, log entries, images and videos you send within them, as well as any reports you make and the people you block.
• Whether your account has been let in. Every new account is approved by hand; we record whether and when your account was let in, and by whom.
• Account and device identifiers. A user ID for your account, your active sign-in sessions, and a push notification token so we can send you notifications.
• Limited technical information. When you request a one-time sign-in code, we record your phone number, your IP address and the time, to help prevent abuse of the sign-in system. Our servers' technical logs also record IP addresses, for a limited time. We also use a crash and error reporting service for the app and our servers, so we can fix problems. We remove message content, request details and personal identifiers from these reports before they are sent.
• Purchases. If you buy Oktet, Apple handles the payment. Apple tells us how many copies were sold, not who bought them, and we never see your payment details.

We do not use any advertising networks, and we do not track you across other apps or websites. Oktet does not show ads.

Important things to know about your content

Oktet is not end-to-end encrypted. Your messages, images and videos are encrypted while travelling between your device and our servers and while stored, but not in a way that prevents us from accessing them. This means that, where it is necessary, we are able to access content, for example, to respond to a report of objectionable content, to enforce our Terms of Service, or to comply with a legal obligation or a request from law enforcement. We do not read your messages routinely or for any other purpose.

Automatic checks. When you post, reply or send a message, our server checks the text against a short list of words linked to serious harm, such as threats, slurs or child abuse. A match sends that item to us to review. Nothing is blocked or deleted automatically, and the check happens on our own server.

How we store and protect your information

We take reasonable steps to protect your information:

• Information is encrypted in transit using current transport security (TLS), and stored data is encrypted at rest.
• Access to the systems that hold personal information is restricted.
• Where your phone number appears in our internal technical logs, it is stored in a hashed (obscured) form rather than in plain text.
• Once a week we take a backup of our database. It is encrypted before it is stored, can only be opened with a key we keep offline, and is kept for 60 days.

No online service can promise perfect security. If we become aware of a data breach that is likely to cause you serious harm, we will take reasonable steps to address it and to notify affected users where appropriate.

Who we share information with

We do not sell your personal information, and we do not share it for advertising. We use a small number of trusted service providers to operate Oktet, and information is shared with them only so that the service can function:

• Railway — hosts our servers and database.
• Cloudflare R2 — stores the images and videos you upload, and our encrypted backups.
• GitHub — runs our weekly backup job; the backup is encrypted on GitHub's systems before it is stored.
• Twilio — sends the SMS one-time codes used to verify your phone number at sign-in.
• Expo — delivers app updates to your device, and push notifications together with the Apple Push Notification service.
• Sentry — receives crash and error diagnostics so we can identify and fix problems.

Some of these providers store or process information outside Australia, including in the United States.

We may also disclose information where we are required or permitted to by law, or to comply with a lawful request from law enforcement or a regulator (for example, the eSafety Commissioner or the Australian Federal Police).

How long we keep your information, and deleting your account

We keep your information for as long as your account is active. You can delete your account at any time from within the app, under System › Bios.

When you delete your account, it takes effect immediately: your profile disappears from the app, your posts are removed from channel feeds, and your messages and responses in shared conversations are shown to others only as a placeholder saying they were removed. Quotes of your messages in other people's replies, and a channel's latest-message preview, stop showing your words too.

About 90 days later, we permanently delete your account: your phone number, your profile, your log, every image and video you uploaded, and the words of everything you posted. If a report or an automatic flag about something you posted is still open, or led to action, we instead keep your account and everything you posted, hidden, until 2 years after that report, as evidence, and then delete them the same way. Reports you made stay on our records, no longer linked to you. Records of sign-in code requests (your phone number, IP address and the time) are deleted 2 years after each request, because Australian online-safety rules require sign-up details to be kept that long. Our encrypted weekly backups age out 60 days after the permanent deletion. The 90-day period exists so that we can meet legal and incident-handling obligations; it is not a recovery window, and account deletion cannot be undone.

Illegal content. If we find images or videos that may be illegal, for example child sexual abuse material, we remove them from the app but keep them, and the account they came from, securely for at least 12 months, or for longer if the law or the police require, even if the account is deleted. While that hold lasts, the account can't be deleted.

If you are the creator of a channel, you may need to transfer ownership of that channel to another member before your account can be deleted.

Your choices

• You can choose not to provide any of the optional profile fields.
• You can edit your profile information at any time in the app.
• You can block other users and report content from within the app.
• You can delete your account, and with it your personal information, at any time.

Children

Oktet is intended for people aged 18 and over. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If we become aware that an account belongs to someone under 18, we may remove it.

Changes to this policy

We may update this policy as Oktet develops. When we do, we will change the "last updated" date at the top of this page. Significant changes will be communicated within the app.

Contact us

For any questions about this policy or about your personal information, or to make a privacy complaint, contact us at [email protected]. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. To report objectionable content or abuse, contact [email protected].