Privacy Policy for LottisCrypt

Effective Date: June 29, 2026

1. Introduction

This Privacy Policy applies to the LottisCrypt mobile application (the "App") for iOS and Android. LottisCrypt was built with a strict offline-first, zero-trust architecture.

2. Data Collection and Usage

I collect exactly zero personal data. LottisCrypt does not collect, transmit, distribute, or sell your data. I do not use analytics software, I do not track your usage, and I do not collect crash reports.

3. How Your Data is Processed

All cryptographic operations—including key generation, file encryption, and file decryption—occur strictly locally on your physical device.

• Your Keys: Your cryptographic keys (Identity Keys and Signing Keys) are generated and stored exclusively in your device's secure local storage (such as the Apple Secure Enclave / Keychain or Android Keystore). They never leave your device.
• Your Files: The files you choose to encrypt or decrypt are processed locally. We do not have access to your files, your keys, or the contents of your encrypted data.

4. Third-Party Services

LottisCrypt does not integrate with any third-party tracking, advertising, or data-harvesting services. There are no external servers involved in the core encryption or decryption processes.

5. Changes to This Policy

If we ever change this policy, we will update this page. However, our core philosophy will never change: we do not want your data.

Privacy Policy for LottisChat

Effective Date: June 29, 2026

1. Introduction

This Privacy Policy applies to the LottisChat peer-to-peer messaging and communication framework (the "Service") integrated into our mobile applications. LottisChat is built around absolute data minimization and real-time ephemeral routing.

2. Peer-to-Peer Signaling & Data Transience

To establish real-time audio, video, or data connections between devices, the Service utilizes an isolated, secure signaling infrastructure hosted at lottisch.at using the WebSocket Secure (WSS) protocol.

• Transient Handshaking: The signaling server acts strictly as a temporary network coordinator. It allows two devices to discover each other and exchange WebRTC metadata (such as local network IP addresses, routing offers, and answers).
• Zero Data Retention: All connection payloads are processed strictly within volatile server memory (RAM). This data is never written to permanent storage disks, never logged, and never inspected.
• Immediate Memory Purging: The moment a communication room hits its capacity (2 users) or a user terminates their connection, all session attributes associated with that room are instantly wiped from the server's volatile memory.
• Direct Media Streams: No communication content or media streams ever touch our server architecture. Once the initial handshake is completed via the signaling server, the media and text data flow entirely directly between you and your peer.

3. Data Collection and Tracking

No personal information is collected or tracked. LottisChat does not log metadata, communication timestamps, user IP addresses, hardware identifiers, or usage analytics.

4. Third-Party Dependencies

The LottisChat framework does not use external SDKs, commercial trackers, analytics platforms, or third-party cloud coordination services. The infrastructure is entirely self-hosted and independent.

5. Changes to This Policy

Any revisions to this document will be reflected here. The fundamental engineering model of this system will always prioritize total user anonymity and zero data persistence.

Contact Us

If you have any questions about the privacy structures of LottisCrypt or LottisChat, please contact us at:
fridolin.kerner@gmx.de