Privacy policy

Last updated: 2026-10-10

Who is responsible: Mathilde Gilles, a private individual in France (see the legal notice). Contact: support@yapnest.fr.

Yapnest is a chat app. It is a client for XMPP, an open messaging standard. Yapnest has no analytics, no tracking and no ads. Your messages do not go through us.

The short version

• Your account, contacts and messages are on the XMPP server you sign in to, not on a server of ours.
• The app keeps a copy on your device.
• Messages in one-to-one chats are end-to-end encrypted with OMEMO, unless you turn it off.
• Push notifications go through a small relay we run. It handles your device token and your account address, and nothing about your messages.
• GIF search and link previews contact other services. You can turn both off.

Your XMPP server

When you sign in, the app connects to the server of your account. That server is run by someone else. It stores your account, your contact list, your messages (possibly as an archive) and the files you upload. It also sees who you talk to and when.

The server’s operator is responsible for that data. Read their privacy policy. Yapnest cannot see or change what your server does.

On your device

• The app keeps a database for each account: messages, contacts, settings, and your OMEMO encryption keys.
• Your password and sign-in details are kept in the Keychain.
• Files you send or receive are kept on the device.
• The app’s notification and share extensions use the same storage, so they can show and send messages.
• Signing out deletes the messages and keys stored on the device for that account. Messages on your server stay there.

Encryption

Yapnest uses OMEMO. With OMEMO, only you and the devices of the people in the chat can read a message. Your server cannot.

• It is on by default in one-to-one chats. You can turn it off for a chat.
• In group chats it is on only in private rooms, where only members can join and each member’s address is visible. Other rooms are not encrypted.
• OMEMO does not hide who talks to whom, when, or how much. Your server sees that.

Uploaded files

Files go to the upload service of your XMPP server. They are encrypted first when OMEMO is on for the chat. If it is off, the upload service can read them. Your server decides how long files are kept.

Push notifications

To tell you about a new message when the app is closed, the app uses Apple’s push service (APNs) through a relay we run, at push.yapnest.fr.

• The app sends the relay your device’s push token and whether it is a test or a production build. The request also carries your account address.
• The relay answers with an opaque code. The app gives that code, not the token, to your XMPP server. Your server never sees the token.
• When your server has a new message for you, it tells the relay. The relay asks Apple to wake the app. The alert has no content: not the sender, not the text. The app then fetches and decrypts the message itself and shows the notification.
• The relay has no database. The code carries the token and your address, sealed with a key that only the relay has.
• The relay’s log records only that a device registered or a push was sent, and errors. It never records your account address or your device.
• Apple receives the push token and the empty alert, under Apple’s own privacy policy.

Link previews

A link preview shows a title and image for a link. The app loads the linked page from your device, so the site sees your IP address and that the link was opened. Nothing goes through us.

• For links you send, previews are on unless you turn them off for the chat.
• For links you receive, the app asks you per chat first.
• In Settings you can turn link previews off for everything.

GIFs

The GIF picker uses KLIPY. When you open it or search, the app sends KLIPY your search words, your language and the page it wants, then loads the pictures from KLIPY. KLIPY sees your IP address. The app uses no cookies and no cache for this, and sends no user ID. A GIF you pick is downloaded and sent as an ordinary file in your chat.

KLIPY’s own privacy policy covers what it does with this. In Settings you can turn the GIF picker off.

Location, camera, microphone, photos

• Location: only when you choose to share it in a chat. The app reads your position then and sends it as a message to that chat. It is not collected otherwise. Maps are drawn by Apple Maps.
• Camera and microphone: only when you take a photo or video to send. The microphone records the sound of a video.
• Photos: the app saves a photo or video to your library only when you ask it to.

You can turn each permission off in your device’s settings.

What we do not do

• No analytics, no crash reporting and no advertising code in the app. It uses open-source libraries for XMPP, OMEMO and its local database.
• No tracking, and no sale of data.
• We do not read your messages.

Why we use this data, and the legal basis

Under the GDPR, we handle the little data we get (push token and account address) because it is needed to give you the notifications you ask for. That is the performance of a contract with you (Article 6(1)(b)). Keeping the relay safe and working is our legitimate interest (Article 6(1)(f)). For features that need a permission or an outside service, such as location, camera, GIFs or link previews, you start the feature yourself, and that is your consent (Article 6(1)(a)).

How long we keep it

• The relay stores no records, and its logs name no one.
• Data on your device stays until you sign out or delete the app.
• Data on your XMPP server, and at KLIPY, Apple and the sites you link to, is kept as they decide.

Your rights

If you are in the European Economic Area, you can ask us for access to your data, to correct it, to delete it, to limit or object to its use, and to receive it in a portable form. You can withdraw consent at any time. To use a right, write to support@yapnest.fr. We answer within one month.

For data on your XMPP server, ask its operator.

You can also complain to the French data protection authority, the CNIL: cnil.fr/en/plaintes.

International transfers

Your XMPP server, KLIPY and Apple may be outside the European Economic Area. Their policies say how they protect data.

Changes

If we change this policy, we post the new version here with a new date.

Contact

support@yapnest.fr