Privacy policy

As of: 27.10.2026 · Translation for convenience; only the German version is legally binding.

In short: ytalk-ng contains no analytics, no tracking, no ads and no telemetry. The app talks to the Matrix homeserver you choose and – only if you turn on push notifications – indirectly to our push gateway. We don't run user accounts and we can't see your messages.

1. Controller

Dirk Wagner
c/o flexdienst – #22230
Kurt-Schumacher-Straße 74
67663 Kaiserslautern
Germany

Email: support@ytalk-ng.chat

2. The ytalk-ng app

2.1 Your Matrix homeserver

ytalk-ng is a client for the open communication protocol Matrix. When you sign in, you choose a homeserver – your club's, your company's or a public provider. Everything that makes up Matrix – your account, profile, rooms, messages, images, read receipts and typing notifications – is sent by the app to that homeserver and loaded from it.

This processing happens at your homeserver's operator, not at ours. That operator is responsible, and their privacy policy applies. Matrix is federated: messages in rooms with participants on other servers are also transmitted to those servers.

In end-to-end encrypted rooms, messages are encrypted on your device; homeservers then only see encrypted content and technical metadata (e.g. who sent something in which room and when).

You can turn off read receipts and typing notifications in Settings under privacy.

2.2 Data on your device

To work, the app stores on your device: your sign-in session (in the iOS keychain), encryption keys, cached messages and room data, and your settings. This data stays on the device. The exception is key backup, if you set it up: it is stored encrypted on your homeserver.

Signing out with “Log out and delete local data”, or deleting the app, removes this data from the device.

2.3 Images and photo library

Images you pick are uploaded to your homeserver. The app removes location data (GPS) from them first. The app only accesses your photo library to add an image when you explicitly save it; iOS asks for your permission.

2.4 Push notifications (optional)

Push notifications are off until you turn them on in Settings. Then:

iOS issues a device token for the Apple Push Notification service (APNs).
The app registers this token with your homeserver, together with the push gateway's address (default: push.nullserie.net, changeable in Settings).
When there is a new message for you, your homeserver sends the gateway: the device token, the app identifier, the room ID, the event ID and the unread count. No message content and no sender names (format event_id_only).
The gateway forwards this to Apple (APNs), which delivers the notification to your device.
On your device, ytalk-ng then fetches the message from your homeserver itself and decrypts it locally to show room and sender – and, if you turned on “show message text”, the text.

We run the gateway push.nullserie.net ourselves (software: Sygnal). It is contacted by your homeserver, not by your device, so it doesn't learn your IP address. It doesn't store this data permanently; only technical logs are created (time, requesting server, delivery result), kept only as long as needed for operation and troubleshooting.

The legal basis is Art. 6(1)(b) GDPR: you explicitly request delivery of notifications. Apple is responsible for APNs; Apple's privacy policy applies. When you turn push off, the app removes the registration from your homeserver and no more notifications are sent to the gateway.

2.5 App Store

Apple processes data under its own responsibility when you download and update the app. From Apple we only receive aggregated statistics (e.g. number of downloads) and – only if you agreed in iOS to share with app developers – crash reports without message content. We use them solely to fix bugs.

3. This website

The website ytalk-ng.chat is served via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data such as IP address, time, requested page and browser identifier to deliver the site and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Cloudflare is certified under the EU-US Data Privacy Framework.

The website sets no cookies, contains no analytics or tracking tools and loads no third-party content.

4. Emailing us

If you write to support@ytalk-ng.chat, we process your address and message to reply (Art. 6(1)(b) or (f) GDPR). The message is forwarded via Cloudflare Email Routing to our mailbox at Apple (iCloud). We delete the correspondence once your request is settled and no retention obligation applies.

5. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Contact support@ytalk-ng.chat.

For data on your homeserver, please contact its operator; we have no access to it.

You can also lodge a complaint with a data protection supervisory authority, for example the one where you live or the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate.

6. Changes

If what the app or the website processes changes, we update this policy and the date above.