Privacy policy
Last changed 27 October 2026. Applies to the Spheres app and the servers it uses.
Spheres is a social network in which nothing has a public audience. What you write, post, send and say in a call goes only to the people in the sphere you chose, encrypted on your phone with keys that only those people hold. This page says, in plain words, what the app keeps, what the servers see, and what you can do about it.
Who runs it
Spheres is made by the SafeSelf project. The relay runs on Cloudflare in the European Union; the push server and the call relay run on a Scaleway machine in Amsterdam. Contact: through the project on GitHub.
What stays on your phone
Your identity keys, your contacts, every message, post, comment, reaction, album and flash, your profile, your settings, your call history and any notes from your side of a call. All of it is encrypted at rest on the phone. None of it is sent to us. Backups are files you make, encrypted with a passphrase only you know, and they stay where you put them.
What the relay sees
The relay carries sealed envelopes between phones and holds them until they are collected. It cannot read them and cannot tell who is talking to whom: mailbox addresses are derived from secrets only the participants hold. What it does see, because any server on the internet does:
| Seen | Why | Kept for |
|---|---|---|
| Your IP address and the time of each connection | To deliver | Not stored by us; Cloudflare's standard logs apply |
| Sealed envelopes, their size and when they arrived | To deliver | Until collected, then at most 30 days |
| Your public key bundle | So a contact can start an encrypted session with you | Until you delete it, or it ages out |
| A wake address per mailbox (a push endpoint) | So your phone is woken when something arrives; the knock carries no content | Until you delete it, or it ages out |
| Encrypted media blobs | To deliver pictures and clips | Until collected, then by the retention sweep |
On a play build, the wake goes through Google Play services: Google sees that a knock was sent to your phone and nothing else. On a foss build it goes through our own push server, or one you chose. The call relay (TURN) sees the addresses of both phones in a call and the shape of the traffic, never its content, and only when a direct path is not possible.
What we never do
No analytics, no crash reporting, no advertising network, no tracking of what you read or how long. No behaviour is read to decide what you see; the feed is in time order. The advertisement slot, when it carries anything, shows adverts chosen on your phone from a catalogue fetched whole, and reports nothing back. Nothing is sold, shared or used to train anything.
Notes from a call
If you turn it on, your own voice in a call is transcribed on your phone by its own speech recognition and turned into notes by rules, on the phone. The other person is not recorded. The transcript is never stored and never sent; only the notes are kept, on your phone, and sent to the other person only if you say so at the end of the call.
Children
Spheres is not designed for children under 13 and asks no age today. A guardian role that approves a minor's new contacts, and sees nothing else, is planned.
Deleting everything
Settings, Reset Everything deletes your identity, contacts and all content from the phone and tells the relay to drop your key bundle and your wake registrations. Mail still waiting in shared mailboxes cannot be singled out and ages out within 30 days. There is no account on our side to delete beyond that, because there is no account: your identity is a key pair on your phone. If you cannot reach the app, nothing of yours is on a server that we could act on except the bundle and the registrations, which age out on their own.
Your rights
Under the GDPR you may ask what we hold. The honest answer is the table above, and the relay cannot connect any of it to a name. Questions go to the project page.
Changes
This page changes when the app does. The date at the top says when.