Privacy Policy

Last updated: October 2026 · Deutsche Version

LADON messenger is built on the principle that privacy is a fundamental right. This policy explains how we handle your data — spoiler: we collect as little as technically possible.

1. Who We Are

LADON messenger is an end-to-end encrypted messaging application, operated as a private project by Albert Gashi (Zürich, Switzerland). Contact: info@ladon.app

2. Waitlist & Newsletter

When you sign up for the LADON messenger waitlist, we collect:

Email address — to send you the confirmation email and future updates about LADON messenger
Status and dates — whether you have confirmed, when you signed up and confirmed, and when we last wrote to you
Two random codes — for the confirmation link and the unsubscribe link
Send log — for each newsletter, whether it reached your address

To stop mass signups, the server keeps the IP address of a signup request in memory for one minute. It is not stored.

We do not use analytics, cookies, or any third-party tracking in our emails or on our website. The logo in our emails is loaded from our own server (entry.ladon.app) when you open the email; the request carries nothing that identifies you.

You can unsubscribe at any time using the link in every email we send. Your address is then marked as unsubscribed and receives nothing further; it is deleted when you ask us to (see section 8).

3. Email Delivery

Emails are sent via Microsoft 365 (Graph API). Microsoft processes the email delivery on our behalf. No email content or subscriber data is shared with any other third party. When you confirm your signup, we receive a short notice with your address at info@ladon.app, which is also a Microsoft 365 mailbox.

4. The LADON messenger App

The app is built so that our servers learn as little as possible:

End-to-end encryption — messages are encrypted on your phone with a hybrid double ratchet (X25519 + ML-KEM-768) and signed with Ed25519 + ML-DSA-65. Only you and your contact can read them.
No account — no phone number, no email address, no name. Your identity is a key pair created on your phone.
Secret keys on your device — stored only in the iOS Keychain of this device. The keys of your identity, your conversations and your contacts are additionally sealed with keys held in Apple’s Secure Enclave. No secret key is part of a backup or leaves the device.
Messages on your device — kept only briefly, in an encrypted file that is excluded from backups: the app erases each message 30 minutes after it arrives, and all of them at once when you lock your phone.
Cover traffic — while the app is open, it sends encrypted dummy data at a constant rhythm, so network observers cannot tell when you are really writing.

What our servers process. All servers currently run on one machine in Switzerland.

Entry relay — receives your sealed requests through Tor. It sees only the address of a Tor exit, not yours, and cannot open the requests. It writes no access logs. To fend off abuse it keeps a counter per sending address in memory for two minutes — through Tor, that is the address of a Tor exit.
Exit relay — keeps, for each recipient, under a random ID, the public key bundle and the encrypted messages. A message is deleted once the recipient’s app confirms receipt, at the latest after 7 days. A key bundle stays while it is in use; after 7 days without activity the relay may drop it when it needs the space, and every restart clears it. It never learns who sent a message. It notes the time of the last pickup for 15 seconds, to avoid unnecessary push notifications. All of this lives in memory only.
Push relay — keeps the Apple push token linked to your random ID, in memory only, until the relay restarts, to wake your phone (see section 5).
Attachment relay — stores encrypted attachments on disk for 24 hours (at most 48 hours), whether or not they have been picked up. It cannot read them.
System logs — the relays’ logs contain no user IDs and are kept in memory for at most one day. Our monitoring server keeps its own logs for 7 days; in rare cases an error entry there can contain the IP address of a waitlist signup.

5. Push Notifications (APNs)

LADON messenger uses Apple Push Notification service (APNs) to wake your phone when a message is waiting:

Apple issues a device token for your phone. The app sends it, sealed, to our push relay, which keeps it in memory only.
Every notification is the same fixed text with no message content and no sender.
Apple may learn when a notification is delivered, but not who sent it or what it contains.

In polling-only mode (app settings) the app unregisters from APNs and sends no new token; it fetches messages on its own schedule. A token sent earlier stays in the push relay’s memory until the relay restarts.

6. Tor Network Routing

LADON messenger sends all its traffic through the Tor anonymity network. There is no direct connection: if Tor is not available, the app does not connect.

Your traffic passes through several Tor relays run by independent volunteers. They see encrypted traffic, not its content. Our servers see only the address of a Tor exit, not yours.
To reach Tor even where it is blocked, the app starts two kinds of bridges, obfs4 and Snowflake. If neither can start, it connects to Tor without a bridge. obfs4 bridges see your IP address, like any first Tor hop.
For Snowflake, the app contacts the Tor Project’s broker through the Fastly network and public STUN servers to find a volunteer proxy. These services see your IP address, but no content.
One exception you start yourself: the optional tip screen in Settings. Only when you tap “Show amounts” does the app contact Apple’s App Store directly, not through Tor, so Apple sees your IP address. Apple processes the payment; we do not learn who left a tip.

7. Website

The ladon.app website does not use cookies, analytics, or tracking scripts. We do not collect any data beyond what you voluntarily submit (e.g., your email for the waitlist). The website is hosted by Hostfactory (OptimaNet Schweiz AG, Seuzach, Switzerland), whose web servers may log technical access data such as IP addresses; we do not evaluate these logs.

8. Data Retention

Confirmed and unsubscribed waitlist addresses are kept until you ask us to delete them. If you do not confirm your signup, we send one reminder and delete the signup 30 days after it was made (for signups since 18 August 2026; earlier unconfirmed signups are kept until deletion is requested).

When we delete an address, we keep it together with the date and the reason in a removal log for 90 days, so that the deletion can be traced; then it is gone. You can request complete deletion of your data at any time by contacting info@ladon.app.

9. Your Rights

Under the Swiss Federal Act on Data Protection (FADP/DSG) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

Access your personal data
Rectify inaccurate data
Request deletion of your data
Withdraw consent at any time
Data portability

To exercise any of these rights, contact info@ladon.app.

10. Security

Connections are encrypted with TLS, and the app only accepts our servers’ pinned keys. The full source code of the app and the servers is public under the AGPL-3.0: github.com/LADONmessenger/ladon-messenger. No independent firm has audited it yet.

11. Changes

We may update this policy from time to time. Material changes will be communicated via our newsletter or on our website.

12. Contact

For any privacy-related questions or concerns:
info@ladon.app