Plothush
Effective 26 August 2026
Plothush is a messenger built so that the people running it cannot read your messages and cannot easily work out who you talk to. There is no sign-up. We never ask for your name, your email address, or your phone number, and there is nothing in your account to link it to you.
Your private conversations — one-to-one chats, group chats, files, photos and calls — are end-to-end encrypted. We hold the ciphertext and no key that opens it.
Some things are public by design, and we say exactly which below. Where we can still see something, we say so rather than round it down to zero. A privacy policy that overclaims is worse than none.
Plothush is operated by Ermir Ademi, trading as Plothush, the data controller for the purposes of UK GDPR, registered with the Information Commissioner's Office.
Contact: privacy@plothush.com — for any question about your data, or to exercise the rights in §12. We answer within one month, and usually much sooner.
Our relay runs on servers in London (eu-west-2). The software refuses to start in a region outside the UK and EU — that is enforced in code, not policy.
Creating an account generates a twelve-word recovery phrase on your device and derives your keys from
it. Your handle — something like @quiet-onyx-059 — is a hash of your own
public keys. It is not chosen, not looked up, and not connected to anything about you.
We collect no email address, no phone number, no name, no date of birth and no contact list. There is no password to reset, because there is no password.
If you lose your phrase and your devices, your account is unrecoverable — by you and by us. That is not a gap we intend to close.
Private messages · group messages · files and photos · one-to-one call audio and video · your contact list · who is in your groups
We cannot read your private messages. One-to-one chats use the same family of cryptography as Signal (X3DH plus a double ratchet). Group chats use a shared group ratchet that re-keys when membership changes. The keys exist only on your devices.
We cannot read your files or photos. Attachments are encrypted on your device with a fresh key that travels inside the encrypted message. We hold ciphertext. Photos have their EXIF data — including GPS location — stripped before they are sent, and are padded to fixed size buckets so the size of a file tells us less about it.
We cannot hear your calls. One-to-one call media is end-to-end encrypted (DTLS-SRTP), and the setup messages ride inside the encrypted channel.
We cannot see who is in a group. The relay holds no group roster and no member count. It does not even hold your read position — that stays on your device specifically so we cannot infer group size from it.
We do not know who sent a message. Your identity is sealed inside the encrypted payload. What reaches our servers is a destination and an opaque blob, and nothing else.
This is the complete list of what sits on our servers.
| What | Why | How long |
|---|---|---|
| Your public key bundle | So people can start a conversation with you | Until removed on request |
| A signed list of your devices | So a stolen device can be cut off | Until removed on request |
| Undelivered messages, sealed | So messages arrive when your phone comes back online | 30 days, then deleted; deleted on delivery |
| Group broadcast posts, sealed | So every member sees the same announcement | 30 days |
| Call setup data | To connect a ringing call | 5–10 minutes |
| Push notification tokens | To wake your phone (see §6) | Until you turn notifications off |
| Your encrypted backup, if you made one | So you can restore from your phrase | Until removed on request |
This store is encrypted on disk, which means a stolen server disk is useless to a thief. It does not mean we cannot open it. The key is held by the server, so the operator can read the routing information above — who has mail waiting, which devices belong to which handle. It cannot open your messages, which are separately encrypted with keys we never hold.
We never hold your contacts. Your contact list, nicknames and notes live on your device. When they sync between your own devices they travel encrypted, like any other message. There is no address-book upload and no permission request for one — the code to read your phone's contacts does not exist in the app.
We keep no IP logs. The part of the system that carries your messages never reads a client address at all. Eight endpoints read one for rate-limiting only, hash it immediately with a salt that is regenerated hourly, keep the hash in memory, and never write it anywhere. They are: anonymous sending, anonymous bundle lookup, anonymous five-word resolve, drop-box routing, fetching a device-pairing code, the two payment RPC proxies, and — added September 2026 — writes to the channels API, which is unauthenticated by design and was previously unlimited. A demand for our logs finds no IP addresses, because there are none to find.
Three honest limits, because "no logs" is not "invisible":
Call setup needs a server to tell your phone what its own public address is. That server is ours — it runs on the same machine as our call relay, so placing a call does not announce it to a third party.
If you turn on notifications, we register a token with Apple (on iOS) or your browser's push service. We store that token against your handle so we know which device to wake.
What we send them is deliberately empty. Every Plothush notification carries the same fixed text — "Plothush · Something new is waiting" — and a number. No sender, no preview, no message content, not even for the app itself. Your lock screen never shows who contacted you. For incoming calls we send an entirely empty payload. Apple learns that a Plothush notification was sent to a device at a moment in time, and nothing further.
Note the shape of this: Apple knows which token belongs to which device; we know which token belongs to which handle. Neither of us holds both halves alone.
Turning notifications off in the app removes every token we hold for you.
Plothush has a second, deliberately public half: channels, for creators broadcasting to an audience. This part is not end-to-end encrypted, and we are explicit about why — we cannot moderate what we cannot see, and a public publishing platform that no one can moderate is not one we are willing to run.
In channels, the following is stored in the clear and readable by us:
Private messaging is untouched by this. There is no path — no key, no endpoint, no operator tool — that reads a private chat. When someone reports a private message to us, we can only see what the person reporting it chose to attach as evidence.
Anonymous drop-box messages to an organisation are anonymous to that organisation, which is the point. Our relay can still resolve the routing token back to the sender. We do not do so as a matter of course, but it is technically possible, and you should know that before treating it as anonymity against us.
Group calling is switched off in this version.
Payment features are off by default and most people will never see them. Where you use them:
No analytics. No advertising, and no advertiser can pay to influence anything in Plothush. No tracking pixels, no third-party scripts, no fonts loaded from someone else's server — the app ships its own. We do not sell, rent or share personal data, because we do not have any to sell.
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Write to privacy@plothush.com and we will respond within one month.
Two things worth saying plainly:
Most of your data is not ours to give you. Your messages, contacts and keys live on your devices, not our servers. A subject access request to us returns very little, because there is very little.
You can delete your account yourself, from inside the app. It is at the bottom of the You screen, under Delete my account. It removes everything we hold for your handle — your key bundle, your device list, your notification tokens, your encrypted backup, and any undelivered messages addressed to you — and erases the app on that device. Your recovery phrase will not bring the account back, and nobody will be able to message that handle again. You do not have to ask us and we cannot refuse.
Some things survive deletion, deliberately: a deleted channel leaves a tombstone holding its name and nothing else, so nobody can impersonate it later, and moderation reports and their audit trail are not erased — otherwise "post something illegal, get reported, delete the channel" would destroy the evidence.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office (ico.org.uk).
Plothush is not intended for children under 13, and we do not knowingly hold data about them. Because we collect no personal information at all, we have no way to verify age — a limitation we would rather state than paper over.
If this policy changes materially we will say so in the app before the change takes effect, and the effective date above will move. Past versions stay in our public repository, so you can see what changed and when.