Privacy notice · prototype

Coordinates stay client-side in ordinary operation.

The current client sends cell-derived rendezvous tokens rather than coordinates or raw map cells. Important inference and retention limits are stated below.

What is kept

Durable service dataAccount ID, display name, exact handle, friendship graph, public device keys, and blocks.Until deletion or operational and legal requirements apply.

Transient application dataOpaque presence tokens and encrypted Tip Hat envelopes.Presence-v3 equality material is bounded by its current/previous matching windows and never outlives the one-hour Hat session; match-seen evidence lasts 120 minutes; mailbox live keys last at most 24 hours. Provider backups and logs may retain copies longer.

Client-side dataPrecise location, raw geographic cells, private device key, and pairwise secrets.A compromised or unlocked device can expose this data.

Necessary outside metadataIP and timing metadata; push-provider routing metadata.Controlled by the relevant infrastructure provider.

What this means

JauntyHat's relational schema has no coordinates, geographic cells, raw presence tokens, or message-history columns. It retains one opaque Hat authority row per live device plus short-lived opaque probe and evidence commitments. The durable Hat row can reveal that device's cumulative Hat-session count and last authority-state update time; it contains no coordinates, H3, density, or match geography. Live presence and mailbox keys expire from the application namespace, but infrastructure backups, metrics, and logs may outlive those limits.

A malicious authorized friend can test chosen candidate cells within the directional per-account epoch budget, retain their own daily seed, collude with other mutual friends, or lie about their own location. Successful match evidence is retained for the target in-app for 120 minutes, but JauntyHat does not guarantee the target will open the app during that window. Repeated same-epoch publication traffic can reveal active-slot and cell-churn statistics, but not direct coordinates, H3 cells, or density. Before in-person identity verification, a malicious server can substitute a first-use manifest. A compromised active endpoint can expose current plaintext and local state. Network and push providers may observe routing and timing metadata. JauntyHat does not claim anonymity, untraceability, zero knowledge, perfect malicious-friend protection, or secure provider-backup deletion.

Your controls

Taking your hat off deletes indexed live presence. Removing or blocking a friend prevents authorized future communication and deletes reachable indexed ciphertext. A still-live notice that they found you remains visible; if they delete their account, it becomes a generic deleted-account notice with no account identifier. Revoking a device invalidates its registered public key and deletes reachable live state. Account deletion now removes application-owned state and blocks token-based resurrection; provider identity deletion and backup aging remain open.

Contact

Questions may be sent to privacy@jauntyhat.app. Security reports should go to security@jauntyhat.app without sensitive tokens, secrets, or precise location.