Privacy policies are often long and hard to read. Here are the essentials in a few minutes, especially when it comes to your messages and the Social tab. The full version is at the bottom of the page.
With a match, a friend or in a group, the text is encrypted on your phone before it leaves. Only the people in the conversation can decrypt it: that's what end-to-end encryption means.
The key that decrypts your messages never leaves your phone. If the key of the person you're writing to changes, your phone warns you.
Before it is encrypted, an attached image is analyzed automatically, just once, to screen out nudity and violence. It is not saved to our servers on that occasion, then travels encrypted like the text.
Google and Apple, which deliver notifications, never receive the text of a message, nor the name or photo of who wrote it: at most a title like “New message”.
An encrypted message is erased from our servers 30 days after it is delivered, or after 90 days if it could never be delivered. From then on, it lives only on the phones. Deleted for everyone, it also disappears from the phones that received it — but the other person may have read it before.
Faced with a valid legal request, we can only provide who wrote to whom, and when. The content, we don't have.
Your conversations live only on your phone. Without the optional account backup, a lost phone takes the history with it: we can't rebuild it, since we never had it in the clear.
Be careful in public spaces. Public events, public groups and open gangs are not end-to-end encrypted: our moderation team can read them. Don't write anything private there. Who can read what in the Social tab
To detect encounters, your phone broadcasts an encrypted Bluetooth beacon, renewed every fifteen minutes. No name, no photo and no location go over the air, and detection never uses GPS.
The app never shows where or at what time you crossed paths with someone. If you consent, an encounter's location is rounded to about 100 m on your phone before it leaves. Your precise location only serves features you start yourself, such as sharing with someone close, your dynamic place — kept to the nearest 10 m for 24 hours, shown to no one — or “Going to meet”, whose locations our team can see, as a safety record. Your places in “Around my places” are set by you: the server rounds their centre and shows them to no one.
Not your name, your date of birth, your address, your address book, your browsing history, your full card number, or any print of your face.
We don't sell your data or use it for advertising: ProxiBlu shows no ads at all. A few technical providers work for us — text messages, emails, notifications, automatic analysis of photos and texts, without your identity —, some outside Quebec.
For Canada, your account and encounters are hosted in Montreal. Traffic is encrypted in transit; your email, phone number, description and contact details are also encrypted in our database. Every time our team views an account, it is logged.
Automatic analysis can refuse a photo, an image or a text when it is sent. You can ask why, and discuss it with a person on our team. A selfie requested by the team is compared by eye: no facial recognition.
| Data | Duration |
|---|---|
| Encrypted message, once delivered | 30 days on our servers, then only on the phones |
| Encrypted message never delivered | 90 days |
| Message without a match | 6 months |
| Match and conversation | Until you or your match remove them |
| Record of an encounter (who, when, the cell) | 6 months, then destroyed |
| Event, private or public | 7 days after it starts; a public event draft never published, 48 hours |
| Spontaneous activity | 24 hours after it ends |
| Dynamic place in “My places” | 24 hours, then its coordinates are erased within the hour; right away if you remove it |
| Places noted for “Find one or more people” | 30 days |
| Friend request left unanswered | 90 days |
| Deleted account | Profile, photos and contact details truly erased. A minimal investigation record is kept separately for 6 months, only to answer a legal request. |
Every retention period is in the full policy.
ProxiBlu is for ages 18 and up.
The full policy describes every piece of data, every provider and every retention period. This summary doesn't replace it: if they differ, the policy prevails.
Events, gangs, groups: who can read what
Not everything in the Social tab is protected the same way. The rule comes down to three levels, from most closed to most open.
End-to-end encrypted
Conversations with a friend or in a group, and the location you show a friend. As between matches, we can't read them.
Private, unreadable to us
Private event, gang you crossed via Bluetooth, private group: members only. Each text — name, description, message, poll question — is checked automatically once, when sent, then kept encrypted with a key our servers don't have. We know who is a member, and who answered what to the invitation. To erase a private event one week after it starts, its organizer's phone tells us the day — never its content.
Public and moderated
Public event, public group, open gang: visible to everyone around the place for an event, to members for the discussion of a group or open gang, and readable by our moderation team. Not end-to-end encrypted: don't write anything private there.
You choose who invites you
Two switches, behind the gear icon in the Social tab: whether to accept invitations to events and to gangs from people you crossed paths with. Your friends and matches can always invite you, and no one knows whether you turned them off.
Your address book stays with you
“Invite from my contacts” opens your phone's own picker and gives us only the person you tap: the app doesn't read your address book. If the person you invite has no account, we keep only a fingerprint of their number or email. An invitation sent via WhatsApp or another messaging app carries your link and your code, nothing from your profile.
Inviting someone without an account
By SMS or email, the person gets a personal link and sees the event on a web page. The key that lets them read it travels inside the link: it never reaches our servers.
Showing a match, introducing someone
Your match must approve each friend, one by one. Someone you crossed paths with can only be introduced to your friends if they allowed it — it's off by default —, and you never learn their answer. A friend you introduce accepts or declines each friend, and you see their answer.
“Find the gang”
The search goes through your encounters, even those your filters set aside, kept a few days without location for this sole purpose. If someone finds you this way, they see your public card, never the time or the place, and can only invite you.
“Find one or more people”
The places where you were, which you note yourself, are shown to no one and are erased after 30 days. If a search matches you, it appears under “Someone may be looking for you” without the person searching knowing it: you choose whether to answer.
Spontaneous activities
People who say they're coming are visible to everyone who sees the activity. Your presence is proven by your location, checked in at the start and the end, by a Bluetooth encounter on site, or by a participant whose presence is proven. An organizer's reliability is never shown as a percentage.
Polls
The question and choices follow the rule of their space. Votes, however, are recorded in the clear with the account that voted, even in a public space where others only see totals.
“What's happening”
Areas about a hundred metres across, shown only when at least three different people passed through: never one person's spot. Without your location consent, you don't count in it, not even in a total.
The whole Social tab explained