Transparency
Requests from authorities
SeTalk complies with the law and keeps the minimum. This page counts every request for user data we receive from authorities, and says what we could hand over.
Updated October 11, 2026.
This page is updated by hand whenever we receive a request.
Our commitment
If we are ever legally required to hand over data, we will publish what was asked and what we provided, as far as the law allows.
What we could hand over
Only what we have. Our account service keeps, for a SeTalk account, exactly the record shown on the home page:1
Kept by the service
- Username
- the name you chose
- Account created
- date
- Subscription valid until
- date
- Invoices
- plan, amount, status and dates
- Authenticators
- how many, and when added
- Security events
- last 10, with dates
- Last account recovery
- its date and the deadline to contest it; they stay on the account until a contest clears them or the account is deleted
- Second-factor failures
- a count of failed codes, without IP; reset by a correct code, deleted with the account
Kept only to sign you in
- Password and recovery codes
- only as one-way hashes
- Authenticator secret
- encrypted, with the key kept outside the database
- Active sessions
- only a hash of the token, until they expire
- After an account recovery
- the previous password hash and authenticators, for 72 hours, so the owner can undo it
Never asked, never kept
- Phone number
- not asked
- not asked
- Real name
- not asked
- Contacts
- not kept
- Messages
- not kept
Passes through, not stored
- IP address
- used in memory, for up to an hour, to limit attempts; never written to the database or to the account service's logs
Our relay servers carry messages end-to-end encrypted: they pass on sealed packages they can't open, so we can't hand over the content of your messages.2
Other places where traces of your use exist, and that we describe in the threat model:1,3
- the relay servers see the IP address of the phones that connect to them, unless you use Tor;
- our payment page (pay.setalk.app) has the plan, the amount, the times and the status of each invoice, without your username, and sees the IP address of the browser that opens it;
- Cloudflare, which sits in front of setalk.app, sees the connections to the site.4
The account service's logs don't record your username, session tokens, IP address, the content of requests, account or invoice identifiers, or amounts.1
See the full record on the home page · Read the threat model
Requests log
No requests received so far.