Gribobo Privacy Policy

Effective date: 4 November 2026

In short

Gribobo does not collect your data. There are no ads, no analytics, no trackers and no crash reporting in the app.

Your account and messages are kept by the Matrix server ("homeserver") you choose when you log in, not by the Gribobo developers.

Messages in encrypted chats can only be read by the people in the chat.

About this policy

This policy explains what happens to your data when you use the Gribobo app ("the app") on Android, Windows, Linux or the web. "We" means the Gribobo developers. "You" means the person using the app.

Gribobo is a client for Matrix, an open network for secure chat. Like email, Matrix has many independent servers that talk to each other.

Your homeserver

When you log in, you choose a homeserver: for example matrix.org, gribobo.chat (once available) or a server you or someone else runs. Your account, your messages, your files and your profile live on that server, and its own privacy policy and terms apply.

matrix.org is run by The Matrix.org Foundation. Its privacy notice: https://matrix.org/legal/privacy-notice/

When the gribobo.chat server becomes available, this policy will be updated to describe it before it opens.

What the app sends, and when

The app only sends data to your homeserver, and only when it is needed for what you do:

• Your user name and password when you log in.
• Messages, photos, voice messages, files and stickers when you send them.
• Your display name and profile photo when you set them.
• Chat settings such as favourites, chat folders, pinned messages and muted chats, and which room is your "Notes to self", so they work on all your devices.
• The list of people you block, so blocking works on all your devices. The people you block are not told.
• Messages you schedule with "Send later", if your homeserver can deliver them later. In encrypted chats they are encrypted on your device first, and your homeserver keeps them, unreadable to it, until the chosen time.
• To-do lists you send to a room, and the ticks you make on items of a list, as messages in that room. In encrypted rooms they are encrypted like any other message. Your homeserver can see that a tick belongs to a list and which list message it is for: this label is what keeps ticks from causing notifications.
• Polls you send to a room, and your votes, as messages in that room. In encrypted rooms they are encrypted like any other message. Your homeserver can see that a vote or the end of a poll points at another message, and which one.
• Notification rules on your account that turn off notifications for those ticks and for poll votes. In encrypted rooms the vote rule also silences other events that point at a message in the same way, such as the steps of verifying a device.
• If you report a room, the reason you write, sent to your homeserver's admins (not to the room's admins).
• If you are a room's admin or moderator: changes you make there (room name, topic, roles, muting, removing or banning someone, deleting messages). Like in any Matrix app, these are room events that everyone in the room can see.
• Encryption keys of your device, so others can send you encrypted messages.

In encrypted chats (the default in Gribobo), the content of messages, photos, voice messages and files is encrypted on your device before it is sent. Your homeserver cannot read it. Some information cannot be encrypted, because servers need it to deliver messages: who is in a chat, who sent something and when, the size of files, display names, profile photos and room names.

Stickers come from the app's built-in pack. The sticker picture itself is uploaded unencrypted (like in other Matrix apps), so a server can see which sticker was sent, but not your messages.

Federation: other servers

If you chat with people on other homeservers, copies of the chat (encrypted where applicable), your user name, display name and profile photo are stored on their servers too. Those servers may be in other countries and are subject to their own laws and policies.

Stored on your device

The app keeps some data on your device so it works quickly and securely: your session, encryption keys, a copy of recent messages, messages scheduled with "Send later" until they are handed to your homeserver or sent, reminders you set on messages (only which chat and message, and when; never the message itself), and your settings (language, message disguise style, the name you give for positive messages, notification choices).

In the web version this is kept in your browser's storage for app.gribobo.chat. Clearing that site's data in your browser logs you out and removes it.

When you record or play a voice message, the recording or a decrypted copy is kept for a moment in the app's temporary folder (in the web version: in memory only). It is deleted once the recording is sent or deleted, and when the message is hidden again, the chat is closed or the app goes to the background.

If you set a PIN, only a scrambled version of it (a salted PBKDF2 hash) is stored, on your device only. The PIN never leaves your device.

Logging out removes your session, its encryption keys, and any scheduled messages and reminders still waiting on the device. Uninstalling the app removes everything the app stored.

Permissions

• Internet: to talk to your homeserver (and, in the Linux AppImage, to check for updates).
• Camera: only when you tap "Take a photo".
• Microphone: only while you record a voice message, after you tap the microphone button. Recording stops when you send or delete it, or when you leave the app.
• Photos and files: only the items you pick yourself.
• Notifications: to tell you about new messages and about reminders you set. Android and your browser ask you before allowing it. On Android, Gribobo also sets your reminders again after the phone restarts.

The app does not access your contacts or location.

On Linux and Windows, "Start with computer" (off unless you turn it on) adds a start-up entry for your own user account, so Gribobo opens when you log in.

Links and outside services

Invite links use matrix.to, the standard Matrix link format. A personal invite link contains your user ID. If someone opens it in a web browser, the matrix.to page (run by The Matrix.org Foundation) is shown to help them open it in a Matrix app.

Links in the server tutorial open outside websites in your browser. Their own privacy policies apply.

"Create a new account" on the login screen opens your server's own sign-up page (for matrix.org: account.matrix.org) in a browser tab. When you are done, Gribobo is logged in by itself; for this it tells the server the app's name and its gribobo.chat web addresses. In the web version the matrix.org sign-up page (app.element.io) opens instead, and you come back to log in. The server's own privacy policy applies.

The web version of the app is served from app.gribobo.chat, which keeps no visitor logs. When it needs them, it loads some fonts (for example for emoji and some alphabets) from Google's font servers (fonts.gstatic.com), which can see your IP address.

Updates

On Linux, the .deb and .rpm packages also add the Gribobo package source (gribobo.chat/apt or gribobo.chat/rpm) and its signing key to your computer, so your system's normal updates can install new versions of Gribobo and check that they really come from Gribobo. When your system looks for updates, it asks gribobo.chat for the list of versions, as it does with its other sources. Removing Gribobo removes the source again.

The Linux AppImage asks gribobo.chat once a day for the number of the newest version, so it can tell you when an update is out. The request contains nothing about you or your account. Like any visit to a website, the server sees your IP address; gribobo.chat keeps no visitor logs. You can turn this off in Settings → About → Check for updates.

The other versions of the app do not check for updates themselves: Android updates through Google Play, and the web version is always the newest.

Notifications

No notification carries your messages. The notification on your screen shows a positive phrase (the message disguise), never the message, the sender or the chat name.

Android phones with Google services: when a message arrives, your homeserver sends a small wake-up signal to the Gribobo push gateway (push.gribobo.chat), which passes it to Google Firebase Cloud Messaging, which delivers it to your phone. The signal contains only the ID of the new message and of the chat, how many unread messages you have, and a random token that tells Google which phone to wake up. It never contains the message text or who sent it. Google can see that your phone received a signal, and when. Google's privacy policy: https://policies.google.com/privacy

Android phones without Google: the same signal goes through ntfy.gribobo.chat (or another UnifiedPush server you choose in the ntfy app) to the ntfy app on your phone, which wakes Gribobo. If your phone is offline, ntfy keeps the signal for up to 12 hours so it can still be delivered, then deletes it.

Computers (Windows, Linux) and web: no push server is used. While Gribobo is open (also when minimized), it shows a notification itself for messages it receives from your homeserver.

To make push work, the app tells your homeserver the address of the push gateway and your phone's token. The push gateway and the ntfy server keep no records of the signals they pass on, apart from short technical error logs that are deleted automatically.

You can choose the method or turn notifications off in Settings → Notifications, or in your phone's or browser's settings. Logging out removes the registration.

Security

End-to-end encryption uses the vodozemac library, the same encryption used by other Matrix apps, on Android, Windows, Linux and the web.

In the web version, your encryption keys are kept in your browser. Anyone who can use your browser profile could reach them, so log out on shared computers.

The message disguise and PIN protect what people around you can see on your screen. They do not replace the encryption described above.

Deleting your data

We cannot see or delete data on your homeserver. To delete your account or data, use your homeserver's options or contact its operator. Because of federation, other servers may keep copies of chats you were part of, and some may ignore deletion requests. Your user name can remain visible in old chats.

Data stored by the app on your device is removed when you log out or uninstall the app.

Children

Gribobo is not intended for children under 16. We do not knowingly collect any data, from anyone.

Changes to this policy

If this policy changes, the new version will be published with the app and on gribobo.chat, with a new effective date.

Contact

Questions about this policy: privacy@gribobo.chat