SporengesThis policy explains what the Sporenges app collects, why, and the choices you have. It applies to the app and to this website.
Summary
In short: your messages and photos are encrypted on your phone before they are sent, so we cannot read them. Sporenges has no ads, and we do not sell your data. The app has no advertising or analytics tools. Voice and video calls are the exception: they run through a separate call service and are not covered by the chat key.
What we collect
| Information | Why | Who can see it |
|---|---|---|
| Account: email address, password, name, date of birth, gender | To create and secure your account and confirm your email with a 6-digit code. | Your password is handled by Firebase Authentication. Email, date of birth and gender are kept in a private part of your profile that only your account can read. Your name is visible to other users, and other users can find you by searching for your name. |
| Profile photo (optional) | So friends recognise you. | Other Sporenges users. |
| Messages and photos | To deliver your chats. | Stored encrypted. Only you and the person you are chatting with can read them. A photo’s encrypted file is removed from our server once your friend’s phone has received it. |
| Message details that are not encrypted: who sent it to whom, the time, whether it is text or a photo, delivered and seen status, which message a reply points to, and emoji reactions | To deliver and display messages, replies and reactions. | Our service. Never the text or the photo itself. |
| Friends, friend requests and your blocked list | To connect you with people you know and to stop people you blocked. | Your friends list is private to you. The person you ask sees your request. A block is kept private to you. |
| Online status, last seen and typing | To show when a friend is online or typing. | Your friends. |
| Call details: who called whom, when, and how the call ended | To ring the other phone and show your call history. | You and the other person. The call itself runs through a call service (see below). |
| Notification token | To send you push notifications. | Stored in your private profile. |
| Technical data: your IP address and basic connection information, which our providers see whenever the app connects | To run the service, keep it secure and limit repeated requests. For limiting requests we store only a one-way scrambled form of the address, never the address itself. | Us and our service providers. |
| Problem reports (only if you send one) | To find the problem. The email contains your app version, Android version and phone model. It never includes your account id or messages. | Us, by email. |
On your phone the app keeps a local copy of your chats, your settings and your encryption keys. Message text stored on the phone is kept in a locked (encrypted) form.
Private chats. If you hide a chat, the list of hidden chats and your private PIN stay on your phone only. The PIN is stored only as a salted, scrambled value, and none of it is sent to our servers. Hiding a chat changes only how it appears on that phone.
Permissions the app asks for
- Microphone and camera: only for voice and video calls.
- Notifications: to tell you about new messages and calls.
- Bluetooth: to use a headset during a call.
- Photos: you choose which photos to send; the app only receives what you pick.
How we use it
- To run Sporenges: sign you in, deliver messages and calls, and show your friends.
- To send notifications and to keep the service safe, for example by locking a chat PIN after 5 wrong tries and limiting how often verification codes can be sent.
- To answer your emails.
We do not use your information for advertising, we do not build advertising profiles, and we do not sell it.
Encryption and your chat PIN
Text messages and photos are locked on your phone before they are sent. Your phone makes a pair of keys. The private key stays on your phone. A copy locked with your 6-digit chat PIN is kept in your private profile so a new phone can restore it. Your friends only get your public key, which can lock a message for you but cannot open one.
Your PIN is never sent as you typed it, only a proof made from it. If you forget your PIN, nobody can recover it for you. You can set a new PIN, which gives you a new key, and old messages then cannot be opened on that phone unless you restore them from your Google Drive backup. Photos in a Google Drive backup are protected by a separate backup password that you choose; it is not your chat PIN, and nobody can recover it for you.
What is not hidden: to deliver messages, the service can see who writes to whom and when, and your profile name and photo. Voice and video calls use a separate call service and are not covered by the chat key.
Google user data (Drive backup)
Backup is optional and off until you turn it on. If you do, Sporenges asks Google for one permission only: the Drive app data folder (drive.appdata).
- What we access: only the hidden app-data folder that Google creates for Sporenges in your own Drive. Sporenges cannot see, list, open or change any of your other Drive files.
- What is stored there: backup files made on your phone from your chats and photos. Photos in a backup are encrypted with a backup password that you choose.
- How we use it: only to create a backup and to restore it on your request. Nothing is read or processed on our servers, and no person at Sporenges can open it.
- Sharing: we do not share, sell or transfer this data, and we do not use it for advertising, profiling or to train any model.
- Access token: the short-lived Google access token is used by the app on your phone only to talk to Drive. It is not sent to our servers.
- Your control: turn backup off, or delete backups, in the app. You can also remove Sporenges’ access at myaccount.google.com/permissions and delete its hidden data in Google Drive settings under Manage apps.
Sporenges’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who it is shared with
We do not sell your information. We use these service providers to run the app, and they process data only to provide their service:
- Google Firebase (sign-in, databases, file storage, push notifications and server functions).
- Resend, to email you the 6-digit verification code. It receives your email address and the code.
- Agora, to connect voice and video calls.
- Google Drive, only if you turn on backup. The backup goes to a private folder in your own Google Drive that only Sporenges can use. We cannot open it. See Google user data above.
Other Sporenges users can see your name and profile photo, and your friends can see when you are online. We may disclose information if the law requires it. Our providers may process data in other countries, including the United States, where data protection rules may differ from those where you live. We rely on these providers’ own safeguards for such transfers.
How long we keep it
- Your account information stays until you delete your account.
- Encrypted messages stay until they are deleted. “Delete for everyone” erases the message content and photo from our servers at once. A small marker (no text, no photo) stays until the other person’s phone has received it, and is then removed; if their phone does not connect, we remove it after 30 days. “Delete for me” and “Clear chat” hide messages only for you.
- A photo’s encrypted file is removed from our server after your friend’s phone has received it.
- Email verification and recovery codes expire after 10 minutes, and we store only a scrambled version of them.
- A hidden-chat list and private PIN exist only on your phone, and are removed when you sign out or delete your account.
- Technical logs kept by our cloud providers follow those providers’ retention settings.
Delete your account and data
You can delete your account yourself: open Settings → Account → Delete account and confirm with your password. Full steps are on the Delete your account page. If you cannot use the app, email info@sporenges.cyou from your account email and we will help.
Deleting your account removes your profile and its private information, your friends and requests, your recent chats list, your profile photos and your sign-in. Encrypted copies of messages you already sent to friends may remain in their chats; we cannot read them. A backup in your own Google Drive stays in your Drive until you delete it there.
Security
- Messages and photos are encrypted on your phone before they leave it, and all connections to our service use HTTPS/TLS.
- Access rules on our databases and storage let each person reach only their own data and their own chats.
- A chat PIN locks after 5 wrong tries, and verification codes are limited in how often they can be requested and how many wrong tries are allowed.
- Secrets such as signing keys are kept in a managed secret store, not in the app.
No service can promise perfect security. If you find a security problem, please email info@sporenges.cyou.
Your choices and rights
- Change your name, photo and details in Edit profile.
- Turn notifications off, or mute one chat, in Settings or Chat info.
- Block people, and review who you blocked in Settings.
- Turn backup on or off, and delete backups from your Google Drive.
- Ask us for a copy of the information we hold, to correct it, or to delete it, by email. We answer within 30 days.
- If the law where you live gives you more rights (for example the right to object to or restrict processing, or to complain to a data protection authority), you can use them by writing to us.
Children
Sporenges is not meant for children under 13, and we do not knowingly collect their information. If you think a child has made an account, email us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top, and tell you in the app if the change is important.
Contact
Sporenges is made by Sorfenix and maintained by Prosenjit Pare.
Email: info@sporenges.cyou
Maintainer: prosenjit@prosenjitpare.com
Location: Bagerhat, Bangladesh