Privacy policy

Effective: October 28, 2026

Who we are

SIRF Ping (package one.sirf.ping) is published by SIRF (sirf.one). Contact: hello@sirf.one.
The app has no ads and no analytics or advertising SDKs.

When you start, the app creates an account with Google Firebase Authentication. No phone number or email is collected.
You choose a display name and receive a Ping ID. Your public profile (name, Ping ID and public encryption key) can be looked up by other SIRF Ping users who know your Ping ID. Profiles cannot be browsed or searched.
The account lives on your phone. It can be moved to a new phone only with the recovery key you create in Settings (see Backup below).

Messages, photos, voice notes and files are encrypted on the sender's phone with the recipient's public key and can only be decrypted on the recipient's phone. SIRF and our providers cannot read them.
While a message is waiting to be delivered, the server stores the encrypted message, the sender's and recipient's account IDs, and the time it was sent. The recipient's phone deletes it as soon as it is received. Messages that are never delivered are deleted after 30 days.
Encrypted files are stored on SIRF's server until the recipient downloads them, and for at most 7 days.
Your chats, files and private key are stored only in the app's private storage on your phone.

Group messages are encrypted separately for each member. Group names and member lists are kept only on members' phones; the server does not store groups.
Voice and video calls are end-to-end encrypted between the two phones. When a direct connection is not possible, encrypted call data passes through SIRF's relay (TURN) server, which cannot decrypt it. Call history is stored only on your phone.
The app uses the microphone for voice notes and calls, and the camera for photos and video calls, only while you are using those features.

Backup is off until you create a recovery key in Settings. The backup (contacts, groups, messages and your encryption keys; not files or photos) is encrypted on your phone with a key derived from your recovery key, which SIRF never receives.
SIRF stores the encrypted backup, an identifier derived from your recovery key and a one-way hash used to let you sign back in. Without the recovery key, nobody, including SIRF, can open the backup or restore the account.
Turning off backup or deleting your account deletes the backup from SIRF's server.

To wake your phone when a message arrives, the app stores a Firebase Cloud Messaging token. The push that is sent contains no message text, name or sender.

Google Firebase (Authentication, Cloud Firestore, Cloud Messaging) hosts the account, the delivery queue and push notifications.
SIRF's server, which relays push wake-ups, holds encrypted files and backups, and relays encrypted calls, keeps standard web server logs (such as IP address and time of request) for security and troubleshooting.
We do not sell personal data and do not share it for advertising.

You can block any contact; their messages are then discarded on your phone.
You can report a user to hello@sirf.one with their Ping ID. Because messages are end-to-end encrypted, we can only see message content you choose to send us. We may disable the Ping ID of accounts that abuse the service.
SIRF Ping is not intended for children under 13. Users under 18 should use it only with a parent's or guardian's permission.

In the app, go to Settings → Delete my account. This deletes your profile, Ping ID, push token, backup and any undelivered files from the server, and all chats, files and keys from your phone.
You can also delete a single chat, which removes its messages and files from your phone.

For SIRF's website and accounts, see the SIRF privacy policy.