Privacy Policy

Last updated: April 8, 2026

Asphalon ("we", "our", "us") operates the Asphalon mobile application and the asphalon.com website. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

• Account Information: When you register, we store your username and hashed password on our Matrix homeserver (matrix.asphalon.com). No email or phone number is required to create an account.
• Optional Contact Info: You may optionally add a phone number or email to your profile for account recovery purposes.
• Messages: Your messages are stored on our Matrix homeserver. Messages sent in end-to-end encrypted rooms can only be read by the participants.
• Voice Biometric Data (Trust Key): If you enroll in Trust Key, a voice recording is processed on your device to create a biometric template (MFCC features). The template is stored locally on your device. The original audio is sent as an encrypted Matrix event to enable multi-device access.
• Behavioral Data: The app collects call behavior patterns (call timing, duration, speech cadence) locally on your device to power the deepfake detection AI. This data never leaves your device.
• Browser Activity: When using the built-in private browser, traffic is routed through our SOCKS5 proxy servers. We track bandwidth usage per IP address for enforcing free tier limits (500 MB/month). We do not log visited URLs or page content.

2. How We Use Your Data

• To provide and maintain the messaging service
• To verify your identity during voice/video calls (deepfake detection)
• To enforce free tier bandwidth limits on the private browser
• To process premium subscription payments
• To respond to support requests

3. Third-Party Services

We use the following third-party services:

• Apple In-App Purchases: For iOS subscription payments. Apple processes the transaction; we receive a receipt to verify your subscription status.
• Stripe: For international web payments. Stripe processes your card details; we never see or store your full card number.
• Payop: For payments in Russia. Payop processes the transaction on their platform.
• FormSubmit.co: For the contact form on our website. Your name, email, and message are forwarded to our support email.
• Google Cloud Platform: Our servers run on GCP infrastructure located in the US (us-central1) and Europe (europe-north1, europe-west1).

4. Data Storage and Security

Your account data and messages are stored on our self-hosted Matrix homeserver running Synapse, hosted on Google Cloud Platform. The database is encrypted at rest. All connections use TLS encryption. Voice biometric templates and AI model data are stored only on your local device.

5. Data Retention

We retain your account data and message history for as long as your account is active. Disappearing messages (premium feature) are automatically deleted after the set timer expires. Browser bandwidth usage counters are reset monthly. You may request account deletion at any time by contacting aleksandrowicz4932@gmail.com.

6. Your Rights

Depending on your location, you may have the following rights under GDPR, CCPA, or other applicable laws:

• Access: Request a copy of the data we hold about you
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a machine-readable format
• Correction: Request correction of inaccurate data
• Objection: Object to specific data processing activities

To exercise any of these rights, email aleksandrowicz4932@gmail.com.

7. No Sale of Data

We do not sell, trade, or rent your personal data to third parties. We do not serve advertisements. We do not use your data for profiling or targeted advertising.

8. Children's Privacy

Asphalon is not intended for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us at aleksandrowicz4932@gmail.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the service after changes constitutes acceptance.

10. Contact Us

If you have questions about this Privacy Policy, contact us at aleksandrowicz4932@gmail.com or visit our Contact page.