Privacy policy

The short version

We collect nothing. Yonder has no server, no account, no analytics, no advertising, no tracking and sends no crash reports. What you write stays on your phone and on the phones you send it to (in a group, also on the phones of people who join later, unless the admin turns that off). The only internet use is the map, while you are online.

Who is responsible

Sam Zoutay, the developer named on Yonder's Google Play listing. Because no data ever reaches us, we cannot look at, hand over, correct or delete anything on your behalf; you control it on your phone (see Your choices).

What is kept on your phone

Your keys (the file is additionally encrypted with a key in the phone's secure hardware where available) and your previous encryption keys for a while after you replace one, so older messages still open; your name and photo; your contacts' public keys, names and photos; your chats and everything in them: messages, photos, voice notes, files, drafts, reactions, edits, stars and each chat's settings; your groups and what running them needs (members, the admin's choices, how far earlier messages came for you, the names of earlier writers who have left); messages waiting to be sent; sealed messages and file pieces you carry for others; who you blocked and who told your phone it is blocked; who you sent your last check-in to; your settings. And working records that help the mesh and show you how it does: a short memory of the Yonder phones you met (their public-key id, name, when, how often, signal), which phones proved themselves on a verified link and what each can open (ids only), the Wi-Fi Direct devices seen nearby, the Wi-Fi Direct address and device name of each contact's phone you have linked with over Wi-Fi Direct (so Yonder can connect to it by itself) and whether Android connects your two phones without asking, a battery diary (the phone's charge level over the last days), a diagnostic log of radio events (the names of phones linked and why links changed; when Android refuses Yonder something, this phone's model and Android version) and, after a crash, a crash report. These stay on the phone: logs leave it only if you share them yourself. Besides Android's own encryption of the app's storage, Yonder encrypts its message database (SQLCipher, AES-256) with a random key that the phone's secure hardware keeps sealed; Erase everything destroys that key first. On a phone where this cannot work, Settings → Storage says the database is not encrypted, and why.

What other phones can see

While Bluetooth runs, Yonder phones nearby see that a Yonder phone is there and, unless you are Hidden, your name. While Wi-Fi Direct runs (it can be switched off, and it pauses while you are Hidden), Android shows your phone to Wi-Fi Direct devices nearby under its Android device name and Wi-Fi Direct address, as it does for any phone that uses Wi-Fi Direct, and Yonder adds a small record to Wi-Fi Direct's service discovery, which any device nearby can read: that it is a Yonder phone; for mesh groups (below), whether it wants or hosts one, whether its Bluetooth is off, whether it can join a group (newer Android), a random number that changes at least each time Yonder starts, and, while it hosts or may host a group, that group's network name and password; while it is in a mesh group, or has stepped out of one to meet phones nearby, a short code made from that group's password, by which the group's phones recognise each other's records (to anyone without the password it looks random). Contacts finding each other (Wi-Fi Direct): while your phone has something for a contact that no link reaches, or answers such a contact, the record also carries up to three short codes that change every 15 minutes, made from a secret only you and that contact share (each phone works it out from the two phones' keys; it is never sent), so only that contact's phone recognises them; whether your phone is free to link; and, while it calls, a random number (new every 15 minutes) from which the contact's phone makes the private group. To reach a contact whose phone it remembers, your phone may instead host a private group whose name and password the two phones work out from that secret and the time alone (new every 15 minutes; nothing is announced for it): devices nearby see a group with a random-looking name, and only a phone given or knowing its password can join it: your contact's, or another contact within Bluetooth reach whom your phone gives it for a fast link, as for any group it hosts. Whichever of the two phones hosts it within those 15 minutes, the name is the same, so someone who sees both host it could tell that those two phones belong together. To anyone else the codes look random and do not say who you are or who your contacts are; nothing in your record matches theirs. Someone who copies a code from the air and repeats it near your contact's phone within about 45 minutes could see that phone start answering. There is no name or identity in the record. When two phones connect over Wi-Fi Direct, devices nearby can see it happen and the two phones' Wi-Fi Direct addresses; when your phone connects by itself to a contact's phone it remembers, it does so again each time something waits for them, so someone watching over time could notice the same two phones connecting. Other devices that use these radios can see the same. Yonder does not use the Wi-Fi network your phone is on: it tells it, and the phones on it, nothing.

What leaves your phone, and to whom

Only to other phones: over Bluetooth and Wi-Fi Direct to phones nearby, and through them to the people your messages are for. Nothing goes over the internet except the map (below). Yonder links with other Yonder phones nearby, whether or not you are contacts, so the mesh can carry messages; each link is verified and encrypted with keys made for that link alone (to a phone running a very old Yonder, your public keys and name go unencrypted). Over Wi-Fi Direct, phones link inside a Wi-Fi Direct group whose network name and password are made on one phone and given to the others: sealed to a contact; worked out on both phones from the secret only two contacts share, when they find each other as described under What other phones can see (nothing is given then); through Android's invitation, which shows your phone's Android device name, when you or someone else taps Connect and the other person accepts, or when a phone connects by itself to a contact's phone it remembers while something waits for that contact (only where Android has connected the two phones before, so it does not ask anyone, or, for a phone remembered by an earlier version where the private group cannot be used, to learn whether it does, stopping within 15 seconds if Android asks the other person; otherwise through the private group above); or, when a phone nearby has no Bluetooth, announced in the record above, which any device nearby can read (a mesh group; Settings → Network → Wi-Fi → Mesh without Bluetooth, which you can switch off). That password does not keep anyone off a mesh group; Yonder's own encryption is what protects your messages, as over Bluetooth. Inside a group, phones find each other with small announcements holding a random number and no name. Sent over these links: your public keys and, unless you are Hidden, your name; your profile photo to the people in your chats who ask for it, and a new name to those within reach; messages, photos, voice notes, files and shared locations, each encrypted for its recipient; delivery receipts and, if you allow them, read receipts and typing; reactions, edits and a chat's settings, sealed to that chat; check-ins you send, sealed to each person you choose (an SOS is handed to more carrying phones so it gets through, still sealed); a notice, sealed to that person, when you block or unblock them; in a group, photos and voice notes to each member, and, when someone joins and the admin allows it (on by default; the admin's choice is a signed note sent to members), the group's earlier messages, photos and voice notes your phone holds, marked as coming from your phone; and what the mesh needs to route: the ids of the phones you are linked to (to phones within reach, never relayed), unless you are Hidden or switch it off a signed list of the ids of phones you met in the last 48 hours (to phones you link to, never relayed), and whether you carry for others. A phone that carries a message can see whom it is for, when it was written, the sender's public key and its size, never its content. Anyone who knows someone's key could learn from a met list that you met them. To a contact linked to you directly, while Wi-Fi Direct runs on your phone: whether it can host or join a Wi-Fi Direct group, whether it hosts one (and for how many) or is someone's guest, and roughly how many of your contacts are around you (one; two or three; four or more), so the phone with more people around hosts and the others can join it.

Maps

While the phone has internet, the map downloads map pictures from OpenTopoMap and, in the Satellite look, the US Geological Survey, and keeps them so maps work without a connection; it also saves the area around you this way. Like any website, those services see your internet address and which areas are downloaded, which can reveal roughly where you are; Yonder sends them nothing else. Place search (Settings → Maps) sends only the words you search for to OpenStreetMap's Nominatim service, when you tap search. Without a connection, maps use only what is saved.

Location

Yonder reads your location only on this phone: to share a location you choose (encrypted for that chat), to show where you are on a map you open (by itself only when location is already allowed; otherwise when you tap the button), and, once you have used your location in Yonder, to save the map around you while online. On Android 12 and older, Android asks for the location permission (and Location switched on) before an app may look for Bluetooth or Wi-Fi Direct devices; Yonder reads no location for that. Android provides the position; on most phones that is Google Play services' location service, under Google's privacy policy.

Permissions

Nearby devices (Bluetooth) and Nearby Wi-Fi devices: to find Yonder phones and Wi-Fi Direct devices nearby and link to them,; Yonder reads no location for them. Location: on older Android versions the system requires it for finding nearby devices; it is used only as described under Location. Notifications: for messages, message requests, SOS check-ins and radio problems. Camera: only while the QR code screen shows Scan a code (frames are not kept), and when you take a photo to send, which your camera app takes. Microphone: only while you record a voice note. Running in the background, starting after a restart and battery exemption: so the phone stays reachable and keeps carrying. Network access (Android grants it without asking): for the map. Vibration (Android grants it without asking): to buzz when a message arrives while Yonder is open, if Vibrate is on.

What Yonder never reads

Your phone's contacts, your photos and files other than those you pick (picking uses Android's own picker, so Yonder never sees the rest), your other apps, your messages in other apps.

Encryption

Each message is encrypted for exactly one recipient with AES-256-GCM, under a key from both phones' encryption keys and, where both phones support it, a fresh one-time key for every message, and signed with the sender's identity key. Links between phones are verified (each phone proves its identity key for that link) and encrypted with keys made for that link alone. Honest limits: carriers see the metadata above; anyone holding your unlocked phone can read what is on it, except chats you lock, which are kept apart in Locked chats and open only with their PIN or your phone's screen lock (a lock in the app, not a second layer of encryption).

How long things are kept

Messages you carry: about a day (three days as a relay spot). The memory of phones you met: 48 hours. Wi-Fi Direct devices seen nearby: at most ten minutes after they were last seen, and never sent anywhere, except a contact's phone remembered for linking: until you remove or block that contact or tap Forget beside it (Settings → Network → Wi-Fi). Messages in a chat with disappearing messages: the time chosen for that chat, on both phones. Previous encryption keys: 180 days. Your own chats and contacts: until you delete them. Yonder makes no backups, and Android backup is switched off.

Blocking and hiding

Blocking works both ways: no messages between you, and neither is listed nearby for the other, nor linked in a Wi-Fi Direct group. Your phone tells theirs with one sealed notice, so their phone stops trying to reach you, and tells it again when you unblock. Anything they still send is dropped on your phone with no receipt; your chat stays until you delete it. Your phones still pass other people's sealed messages along unless you switch that off for blocked people. Hidden stops your name from being broadcast, pauses Wi-Fi Direct and ignores messages from strangers; it is not told to anyone.

Drafts and app lock

Unsent text is saved on this phone as you type and deleted when sent or cleared. The app lock uses your phone's screen lock through Android's own prompt; Yonder never sees your PIN or biometrics. It locks the screen; it is not a second encryption of the database.

Your choices

Everything Yonder holds about you is on your phone, where you can see it, change it and delete it: edit your profile in Settings, delete chats, photos and files, block, mute chats, go Hidden, switch off Bluetooth, Wi-Fi Direct, Connect automatically, Mesh without Bluetooth or carrying, forget a contact's remembered phone (Settings → Network → Wi-Fi), read receipts, typing and the met list, or erase everything (Settings → Storage → Erase everything on this phone, or uninstall). What you already sent to other phones stays on them.

Children

Yonder is not directed at children under 13, and we knowingly collect no data from anyone.

Changes

We update this policy when Yonder changes. If a change affects what Yonder keeps, what leaves your phone or to whom, or your choices, Yonder shows the policy again and asks you to agree before you continue. Other updates, such as clearer wording, are made without asking you again; the date at the top shows the latest.

Contact

Write to the developer at [email protected] (also shown on Yonder's Google Play listing).

This website

The policy above is the app's. This website is plain pages served from Yonder's own server: it sets no cookies, runs no scripts, loads nothing from anywhere else and has no analytics. Yonder's server keeps no record of who visits (no addresses, no browsers), except the address behind a failed sign-in to its admin pages, for security. It counts how many times each version of the app was downloaded, as a number only. Its address is yonderchat.app, Yonder's only official website.