Comuniq-Chat Privacy Policy
Version 2026-10-28 · Applicable throughout the European Union
1. Introduction
This policy explains how we process your personal data when you use the Comuniq-Chat app and the comuniq.chat website, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the Digital Services Act, Regulation (EU) 2022/2065 (DSA).
1.1. Privacy principles
- We do not use your data for advertising, we do not sell it and we do not build profiles.
- We only store the data strictly necessary for the service to work securely.
- Your conversations belong to you: messages and files travel directly between phones, end-to-end encrypted, and never pass through our servers.
2. Data controller
| Owner | [FULL NAME OR COMPANY NAME] (Theia Island · theiaisland.com) |
|---|---|
| Tax ID | [NIF/CIF] |
| Address | [POSTAL ADDRESS] |
| Contact and data protection | comuniq@theiaisland.com |
3. Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR): creating and maintaining your account and providing the service you accept when registering.
- Legitimate interest (Art. 6(1)(f) GDPR) in security: linking each account to a single device to prevent duplicate accounts, impersonation and abuse. You may object by writing to us.
- Legal obligation (Art. 6(1)(c) GDPR) where a competent authority requires it under the law.
4. What personal data we use
4.1. Account data (on the server)
| Data | Purpose |
|---|---|
| Username | Identifying you to your contacts. It is visible to users of the Wi-Fi network you are on. |
| Device identifier, obtained automatically: the IMEI if Android allows the app to read it and, otherwise, a hash of the hardware identifier of the security module (Widevine). Stored encrypted. | Ensuring one account per device and preventing fraud and impersonation. |
| Public identity key | Encryption and identity verification. The private key never leaves your phone. |
| Phone make and model, app version | Technical support and security. |
| Date, version and language of your acceptance of this policy | Proving that you accepted the terms (Art. 7(1) GDPR). |
| IP address (as a temporary hash only) | Limiting registration abuse; discarded within 1 hour at most. |
4.2. Messages and files
We neither receive nor store them. They are end-to-end encrypted and stored only on the participants' phones, encrypted with a key protected by the device's security chip.
4.3. What we do not process
Your phone number, your address book, your location, your communication metadata (who you talk to or when) or browsing data.
5. How we protect your data
- End-to-end encryption with forward secrecy (ephemeral ECDH P-256 with mutual authentication and AES-256-GCM).
- Private keys generated and kept in the phone's secure hardware (Android Keystore).
- Messages and files encrypted in the phone's storage.
- Server reachable only over HTTPS; device identifiers encrypted; signed user certificates to prevent impersonation; restricted and audited administrative access.
- The shared password of the "comuniq" Wi-Fi network only groups nearby users: the confidentiality of your conversations does not depend on it.
6. Who can access your data
- Other users: they see your username and public key when you are on the same Wi-Fi network.
- Hosting provider, as processor (Art. 28 GDPR): [PROVIDER AND SERVER COUNTRY]. If the server were outside the European Economic Area, the transfer relies on an adequacy decision or the European Commission's standard contractual clauses (Art. 46 GDPR).
- Authorities: only if a legally valid order requires it. Since we do not have your messages, we cannot hand them over.
We do not share or sell data to third parties.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability (Arts. 15-22 GDPR) by writing to comuniq@theiaisland.com and stating your username. We will reply within one month at the latest. You may also lodge a complaint with the data protection authority of your country (in Spain, the AEPD).
8. Deleting data
- You can delete your account at any time from the app (menu ⋮ → "Delete my account"): it is removed from the server immediately and all your messages, files and keys are deleted from the phone.
- If you uninstall the app without deleting the account, the server data is kept so that you can recover your username on the same device; you can ask us by email to erase it.
- The audit log of registrations and deletions (username and date, without device identifiers) is kept for 12 months. We would only keep other data, blocked, if required by law.
9. Minors
Comuniq-Chat may only be used from the age of 16, the highest age set under Art. 8 GDPR across EU Member States. If you know a minor has registered, write to us and we will delete the account.
10. Automated decisions and cookies
We do not make automated decisions with legal effects. The website uses no cookies or trackers; the app contains no advertising or third-party SDKs.
11. Changes to this policy
If we change it materially, we will let you know in the app and, where necessary, ask for your acceptance again.
12. Questions
For any privacy question: comuniq@theiaisland.com.