Privacy & Data Residency

Qendra is designed and built in the European Union. The application servers, relay, and encrypted account database sit in EU data centers. However, we currently use Cloudflare for edge protection and availability. At this time, no European provider offers an equivalent level of protection at a comparable cost.

We are actively exploring European alternatives. We are in discussions with providers such as Gcore and Myra, but their current terms of service do not yet allow chat applications that operate in the same privacy-preserving, end-to-end encrypted manner as Qendra.

We use European Alternatives as our guiding framework for evaluating and switching to EU-only infrastructure. Our long-term goal is to become fully Europe Only.

The application servers, relay, and encrypted account database are governed by EU law — the General Data Protection Regulation (GDPR), the ePrivacy Directive, and EU member-state data-protection rules. The Cloudflare edge layer is US-headquartered and therefore in scope of the US CLOUD Act, but it only ever processes TLS-terminated, end-to-end encrypted ciphertext — never plaintext, private keys, or message content. A CLOUD Act order to Cloudflare cannot produce readable messages.

We use the following sub-processors, in line with Art. 28 GDPR. The list is kept current; we will update this page before adding any new sub-processor that touches user-related data.

• Cloudflare, Inc. (US, with EU points of presence) — edge proxy, DDoS protection, TLS termination. Processes only opaque ciphertext and connection metadata (IP, timestamp, byte count) for the duration of a request. Transfer basis: EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.
• EU-based infrastructure provider — application servers, relay, encrypted account database. Data stays in the EU.

When you send a date + map pin appointment, the invite itself (date, time, coordinates, title, RSVP) is end-to-end encrypted — Qendra's server never sees it. The map tiles, however, are loaded directly from OpenStreetMap. OSM (a non-profit, EU-friendly project) therefore sees your IP address and which tile coordinates you load when viewing a map. Pick Approximate precision (~100 m) when you don't want the exact pin in any third party's logs.

The relay holds the minimum needed to deliver messages:

• An opaque account ID (a hash — never your email, phone, or name)
• Your public keys (ML-KEM-768, X25519, Ed25519, ML-DSA-65)
• Encrypted envelopes in transit only, auto-deleted the moment the recipient pulls them, and hard-purged after 14 days regardless of delivery state
• A bucketed arrival timestamp (not a precise one)

• No chat content. Messages are end-to-end encrypted and the server only sees opaque ciphertext.
• No message history. Once delivered (or after 14 days), envelopes are purged.
• No private keys, no recovery phrases. They never leave your device.
• No phone number, no email, no name. Sign-up requires none of these.
• No read receipts, no typing indicators, no presence. Those leak metadata, so they are disabled at the protocol level.
• No IP address logs beyond what the load balancer needs for the duration of a request.
• No analytics, no tracking, no advertising SDKs, no third-party cookies.

Because almost nothing identifying is stored, most GDPR requests are trivial:

• Right of access: the server can only return your account ID, public keys, and any envelopes still in transit. There is no profile, no history.
• Right to erasure: the in-app Lockdown wipe destroys local keys and cache instantly. Server-side, the 14-day TTL guarantees deletion of any residual envelopes.
• Right to portability: your 24-word recovery phrase is your portable identity. You can move it to any installation of Qendra.
• Right to object: there is no profiling, no automated decision-making, no marketing.

If a lawful EU court order arrived, the operators could only hand over what the server actually holds (account ID, public keys, any envelopes within the 14-day window). They cannot produce plaintext, message history, or private keys — those do not exist on the server.

Transparency is maintained via the Warrant Canary. If it stops being updated, assume legal compulsion has occurred.

Data controller: the operators of Qendra, reachable at privacy@qendra.nl for any GDPR request (access, erasure, portability, objection). Because the service stores no name, email, or phone number, please include your opaque account ID so we can identify the (minimal) record to act on.

Right to lodge a complaint: if you believe your rights under the GDPR are not respected, you can file a complaint with your national data-protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens.