Matt Moss ("we," "us," or "our") operates the COPY mobile application (the "App") and the getcopy.app website. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
COPY is designed around a core principle: your conversations are yours. We built the App so that we cannot read, listen to, or access the content of your voice messages. This policy describes that architecture honestly and completely.
Display Name. You may optionally set a display name so your friends can identify you on their channels. This is stored on our servers and visible to people you share a channel with. You are not required to use your real name.
Voice Messages. When you record a voice message, the App encrypts it on your device before transmitting it to our servers. We store the encrypted audio file temporarily (see Section 3 for retention details). We cannot decrypt, listen to, or read the contents of your voice messages.
Support and QA Correspondence. If you email us for support, feedback, or to apply for a testing program, we receive your email address and the contents of your message. COPY Club QA applications may include the preferred name, iPhone model, iOS version, and testing interests you choose to provide. Do not send recovery words, private keys, pass codes, channel links, or message content.
Cryptographic Identity. When you first open the App, it generates an Ed25519 key pair on your device. The public key serves as your identity — there is no email, phone number, username, or password. Your private key never leaves your device and is stored using your device's secure storage (iOS Keychain / Android Keystore).
Push Notification Token. If you enable notifications, the App registers with Expo Push Notification Service, which issues a device token. We store this token on our servers to deliver notifications when you receive a voice message. You can disable push notifications at any time through your device settings, though this means you will not be notified of new messages until you open the App.
Channel Membership. When you join a channel via an invite link, we store your membership in that channel, including which slot number the channel occupies on your device and your role (owner or member).
Cosmetic Grant Metadata. When COPY gives you a starting skin or you claim a free skin through an in-app achievement, we store the skin and achievement identifiers with your cryptographic identity. This small record is readable account metadata and is used to maintain and restore those grants after reinstalling or recovering the same identity. Product analytics use aggregate, coded progress states and do not retain achievement or reward identifiers in Analytics Engine.
COPY Club and Apple Subscription Records. To verify and restore Club access, we receive Apple-signed transaction and subscription information. We store Apple app transaction and original transaction identifiers, product identifiers, purchase or Family Sharing status, subscription status, expiration and renewal information, verification timestamps, and the association with your COPY identity (including an app account token when supplied). We also store your Club member number and membership activation information. These records are readable service metadata, not encrypted message content. Apple manages your Apple Account and family membership; we do not receive your Apple Account password, email address, or family member list.
App Verification. We use Apple's App Attest to verify requests that connect Apple subscription access to a COPY identity. Our servers receive attestation and assertion proofs and store verification key identifiers and public keys, Apple's attestation receipt, enrollment digests, counters, verification status, and associated COPY identity and environment. We also store short-lived verification challenges. These records help prevent reused proofs and unauthorized transfers of subscription access.
Session Tokens. We issue short-lived JSON Web Tokens (JWTs) with a 24-hour expiration for authenticating your device with our servers. Separate Apple store verification sessions last no more than one hour and include your COPY identity, verification key identifier, store environment, purpose, and issue and expiration times.
Analytics Events. We record limited first-party operational and product-health metrics using Cloudflare Analytics Engine, including: that a message was sent, played, or acknowledged; push notification delivery attempts; message delivery latency; coarse onboarding completion; active skin choices; and coded unlock progress. Events use truncated device and channel identifiers where needed for aggregate rates, but never include message content, audio, display names, contacts, invite URLs or tokens, channel secrets, advertising identifiers, or an individual social graph. We use this data to monitor service health, debug delivery issues, and understand aggregate product usage. We do not use it for targeted advertising or to recommend message content.
Expo Diagnostics. The App uses Expo's built-in diagnostic reporting, which may collect crash reports, app launch times, and update delivery metrics. This data is processed by Expo (Expo, Inc.) under their privacy policy.
The App does not collect or require your legal name, email address, phone number, physical address, date of birth, payment card or bank account details, contacts list, location data, browsing history, device advertising identifiers, or any biometric data. If you voluntarily email us, we receive the sender address and correspondence described above, but it is not attached to your in-app cryptographic identity unless you choose to include identifying information. We do not create a user account in the traditional sense — your identity is your cryptographic key pair, generated entirely on your device.
If you choose "Allow website analytics" in the website footer, the getcopy.app marketing website loads Google Analytics 4 to understand visits and clicks through to the App Store. Google Analytics uses cookies and browser identifiers and processes page views, browser and device information, referring websites, approximate location, and App Store button clicks. Our click events identify the button's placement and App Store destination.
We remove query strings and fragments from the page addresses we send to Google Analytics and send only the origin of the referring website. We disable Google signals and advertising personalization. We do not send COPY account identifiers, channel information, recovery words, or voice messages to Google Analytics, and we do not link website analytics to your COPY identity.
Website analytics are off until you opt in. You can withdraw permission using the same footer control. We save your choice in this browser; withdrawing stops future collection and removes the website's Google Analytics cookies. It does not erase data already sent to Google.
Google processes this data as our analytics provider. Learn more about how Google uses information from sites that use its services.
All voice messages are encrypted on your device before being transmitted to our servers, using the libsodium cryptographic library.
How it works: Channels use symmetric encryption (XSalsa20-Poly1305 via crypto_secretbox_easy). A shared channel secret is established when a channel is created and distributed to members through the invite link. The secret is derived into an encryption key using the BLAKE2b key derivation function. Message authenticity is verified using Ed25519 digital signatures (crypto_sign_detached).
What this means: Our servers store encrypted audio blobs that we cannot decrypt. We do not hold the encryption keys. Even if our servers were compromised, an attacker could not listen to your messages without obtaining the channel secret, which is shared directly between users and never transmitted to our servers in plaintext.
Key rotation: When a member leaves a channel, the channel secret is automatically rotated. All existing sealed keys are invalidated and redistributed to remaining members. Previous invite links stop working.
Voice messages are retained in encrypted form only as long as necessary for delivery:
Channel data (membership, metadata) persists as long as the channel is active. Channels with one or fewer members and no activity for 90 days are automatically deleted ("zombie reaping").
Cosmetic grant metadata persists with your active cryptographic identity so COPY can restore starting and claimed free skins. It is permanently deleted when you use Delete Account.
Club subscription and verification records currently have no automatic deletion period. Subscription associations, Club member numbers, verification key records, and records marking deleted identities remain after Delete Account to preserve subscription ownership history and prevent reuse of deleted identities or verification proofs. Delete Account removes complimentary access but does not cancel an Apple subscription. You can manage or cancel it in your Apple Account settings. To request deletion of retained records, contact us using the details below.
Verification challenges are valid for five minutes. Consumed challenges are deleted; expired challenges are removed during later challenge requests, rather than on a guaranteed deletion schedule. Retired verification keys retain identifiers and replay-prevention metadata, but their public keys and attestation receipts are cleared when retired.
Push notification tokens are stored as long as your device is registered. If a token becomes invalid (e.g., you uninstall the App), it is removed when our server detects the invalid token during the next delivery attempt.
App analytics data is retained according to Cloudflare Analytics Engine's standard retention policy (typically 90 days for raw event data).
Support and QA correspondence remains in the COPY team's email accounts while reasonably needed to review the application, operate the testing program, respond to the conversation, and maintain ordinary business records. It is not added to a marketing list. You may ask us to delete your correspondence, subject to records we must retain for legal, security, or abuse-prevention purposes.
Deleting your data: You can delete all your messages in a specific channel at any time from within the App. When you leave a channel, your membership data and any sealed keys associated with your identity are deleted from that channel. Delete Account permanently removes the profile, channel memberships, messages, push token, and cosmetic grants tied to that COPY identity. Because voluntary email correspondence is separate from your cryptographic identity, Delete Account does not delete it; contact us to request deletion.
We use the information described above solely to:
We do not use your information for targeted advertising or message-content recommendations. Website analytics help us understand how people find and use the marketing website.
We do not sell your information. We do not share your information with third parties for their marketing or advertising purposes.
We share limited data with the following service providers, to operate the App, website, and support:
| Provider | Data Shared | Purpose |
|---|---|---|
| Cloudflare, Inc. | Encrypted audio blobs, channel metadata, user identifiers, analytics events, Club subscription and app verification records, and email routing metadata and contents when you write to a getcopy.app address | Infrastructure: Workers (compute), Durable Objects (state), R2 (object storage), KV (key-value store), Analytics Engine (metrics), and Email Routing |
| Expo, Inc. | Push notification tokens, crash diagnostics | Push notification delivery (routed to Apple APNs and Google FCM), over-the-air app updates, diagnostic reporting |
| Apple Inc. | Push notification tokens (via APNs); subscription identifiers and purchase requests; App Attest verification requests | iOS push notification delivery, purchase processing and subscription status checks, app verification |
| Google LLC | Push notification tokens (via FCM), correspondence routed to the COPY team's Gmail inboxes, and the website analytics described in Section 1.5 | Android push notification delivery, team email hosting, and website measurement through Google Analytics 4 |
These providers process data under their respective privacy policies and terms of service. We do not transmit decrypted message content to any third party because we do not possess the decryption keys.
In addition to end-to-end encryption of all voice message content, we implement the following security measures:
No system is perfectly secure. If you believe your device or channel has been compromised, you can leave the affected channel (which triggers key rotation for remaining members) and create a new one.
COPY is not intended for children under the age of 13. We do not knowingly collect information from children under 13. Because the App does not require account registration or collect age-verifiable information, we rely on the age-gating mechanisms of the Apple App Store and Google Play Store, as well as this policy notice.
If you are a parent or guardian and believe your child under 13 has used the App, please contact us at the address below. We will take steps to delete any data associated with the child's device.
Depending on your jurisdiction, you may have certain rights regarding your personal information:
If you are located in the EEA, UK, or Switzerland, we process your personal data under the following legal bases:
You have the right to access, rectify, erase, restrict processing, and port your personal data, and to object to processing. To exercise these rights, contact us at the address below. We will respond within 30 days.
Data transfers: Your data may be processed on Cloudflare's global network, which includes servers outside the EEA. Cloudflare maintains appropriate safeguards for international data transfers, including Standard Contractual Clauses. If you enable website analytics, Google may also process website data outside your country. Google describes its safeguards in its international data transfer policy.
If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to opt out of its sale. We do not sell personal information. To exercise your rights, contact us at the address below.
Categories of personal information collected: Identifiers (device-generated cryptographic public key, push notification token, Apple transaction identifiers, app verification key identifiers, and an email address if you voluntarily write to us); commercial information (subscription and membership records); internet or electronic network activity (operational and website analytics events); website cookie identifiers and approximate location; correspondence you choose to send; audio information (encrypted, inaccessible to us).
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, delete, and correct personal information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for targeted advertising. To exercise your rights, contact us at the address below.
COPY's infrastructure runs on Cloudflare's globally distributed network. Your encrypted voice messages and service metadata may be processed in data centers outside your country of residence. Voice message content is end-to-end encrypted and cannot be read by Cloudflare or us without the channel secret held only on members' devices. Other information described in this policy, including service metadata, subscription and verification records, and voluntary support or QA correspondence, is not protected by COPY's message encryption and may be readable by the providers and recipients identified in Section 5.
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes that affect your rights, we will provide notice through the App. Your continued use of the App after changes take effect constitutes acceptance of the revised policy.
If we become aware of a security incident that compromises the confidentiality, integrity, or availability of your personal data, we will investigate promptly, take reasonable steps to mitigate harm, and notify affected users and applicable supervisory authorities within the timeframes required by applicable law (including, where required, within 72 hours under GDPR Article 33). Because voice message content is end-to-end encrypted and the encryption keys are not stored on our servers, the scope of data at risk in a server-side incident is limited to the categories listed in Sections 1 and 12.
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact:
If you are located in the EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
For transparency, here is a summary of the data described in this policy:
| Data | Stored? | Encrypted? | Retention | Who Can Read It |
|---|---|---|---|---|
| Voice message audio | Yes (temporary) | Yes (E2E, on-device) | Until all recipients play it, or 7 days max | Only channel members with the channel secret |
| Cryptographic public key | Yes | No (public by design) | Lifetime of the device identity | Anyone in your channels |
| Display name | Yes | No | Until you change or delete it | Channel members |
| Push notification token | Yes | No | Until invalidated or device unregistered | Us, Expo, Apple/Google |
| Channel membership | Yes | No | Until you leave or the channel is reaped | Our server (for message routing) |
| Analytics events | Yes | No | ~90 days | Us (via Cloudflare Analytics Engine) |
| Voluntary support and QA email | Yes | Not end-to-end encrypted by COPY; handled under the email providers' protections | While reasonably needed for the conversation, testing program, ordinary records, security, or legal obligations | The COPY team and its email providers |
| Club subscription and membership records | Yes | Not end-to-end encrypted | No automatic deletion period; see Section 3 | Us (via Cloudflare); Apple verifies subscription information |
| App verification keys, receipts and replay-prevention metadata | Yes | Not end-to-end encrypted | No automatic deletion period; retired keys handled as described in Section 3 | Us (via Cloudflare); Apple provides attestation |
| Verification challenges | Yes | Not end-to-end encrypted | Five-minute validity; deletion as described in Section 3 | Us (via Cloudflare) |
| Private encryption key | No (device only) | Yes (device secure storage) | Until removed through identity deletion/reset or device storage removal; uninstalling alone may not remove it | Only you |
| Message content (decrypted) | Never | N/A | N/A | Only sender and recipients |