Pully is a private messenger built so that there is as little to collect as possible. You don't give us a phone number, an email address, or your real name. Your messages are end-to-end encrypted, and the keys that read them never leave your device. This policy explains, plainly, what does and does not happen with your data.
Pully has no phone numbers, emails, or passwords. When you start the app, your device generates a cryptographic identity from a 12-word recovery phrase. That phrase and the private keys derived from it are stored only in your device's secure storage (the iOS Keychain / Android Keystore) and are never sent to our servers. We see only the corresponding public keys, which are random-looking identifiers not tied to your real-world identity.
To deliver messages and run the service, our servers necessarily process some information in a readable form. We keep this list honest rather than claim we see nothing:
If you enable notifications, we send your device's push token to Expo's push service, which relays a notification to your device. Push notifications carry a generic message (e.g. "New message") — never your message content.
Pully contains no third-party analytics, advertising, or tracking SDKs. We do not collect an advertising identifier and we do not track you across apps or websites.
If the app encounters an error, it may send us a diagnostic report containing the error message, a stack trace, your platform (iOS/Android), and the app version. These reports are anonymous — they carry no identity, account, or message content — and are sent only to our own servers, not a third party.
Messages are retained on our servers for up to 30 days on the free plan; on a paid plan, messages are retained for as long as your subscription is active. Disappearing messages are deleted sooner, per the timer you set. Undelivered data is removed once delivered. Some metadata (such as your connections) persists until you remove the connection or delete your account.
You can permanently delete your account from inside the app (Settings → Delete account). This removes your account and its associated data from our servers — your card, messages, connections, reactions, device tokens, and settings. Groups you created are handed to another member so they aren't destroyed for others. Because encryption keys live only on your device, any residual encrypted blobs are unreadable once your account is gone.
We use third-party infrastructure to run the service. These providers process only the encrypted and pseudonymous data described above on our behalf — they are not given the keys to read your content:
Pully is not directed to children, and we do not knowingly collect data from children under the age required by your local law.
Your private keys never leave your device. Messages and profile content are end-to-end encrypted using standard, published cryptography. Requests to our servers are cryptographically signed, so only the holder of your private key can act as you. No system is perfectly secure, but we designed Pully to minimize what could be exposed even in the worst case.
If we change this policy, we'll update the effective date above and, for material changes, surface a notice in the app.
Questions about privacy? Reach us at privacy@pully.talk.