VURN doesn't ask for a phone number or email. Message, media, and call content is end-to-end encrypted; the server cannot read it. No analytics, advertising, or crash reporting SDKs are used.
| Data | Why | Retention |
|---|---|---|
| Username | Account identity, searchability | Until account deletion |
| Password — hashed with Argon2id | Login | Until account deletion (the plaintext is never stored) |
| Public keys (Curve25519 / Ed25519, master) | End-to-end encryption | Until account deletion |
| Account creation date (no time of day) | Account management | Until account deletion |
| Device push token (opaque FCM/UnifiedPush) | "You have a new message" signal | Until the device registration is removed |
| Usernames you've blocked | Block-list sync | Until you unblock |
| Encrypted profile blob + visibility preference | Profile (photo/about) | Until changed or deleted (the server cannot read the content) |
| Reports you submit | Moderation (OSA) | Content + sender's username + a hash of the reporter; may be retained indefinitely |
| Suspension status + reason + end date | Enforcement | For the duration of the suspension |
| Pending encrypted message envelope while you're offline | Delivery | Up to 14 days in Redis; deleted immediately once delivered and acknowledged |
| Encrypted media blobs | Media delivery | Up to 14 days, then automatically deleted |
| Refresh token record | Session | Random token id + user id + expiry; no IP/device info |
| Public channel posts + name/description/logo | Channel functionality (see below) | Until the channel is deleted — these are not encrypted, see the "Channels" section |
| That you voted on a channel (including direction) | Preventing repeat votes | Not by your account identity, but a one-way digest (hash) — see "Channels" |
VURN has two kinds of channels:
On Android, notifications go through Google's Firebase Cloud Messaging (FCM) infrastructure.
The payload is empty — just a "something happened" signal ({ t: 'message' | 'call' }). The content is decrypted on your device.
What this means: Google can see which device (via an opaque FCM token) gets a wake-up signal and when. Google cannot see the content, the sender's name, or the group. Outside Google Play, UnifiedPush can be used instead of FCM.
There's a diagnostic log you can turn on under Settings > Advanced. It's off by default. When enabled, events that help with troubleshooting (screen transitions, connection status, message/call/notification outcomes, errors) are kept in a ring buffer in an encrypted database on your device.
Production servers are hosted on Luki Digital Ltd's own hardware and are physically located in Turkey — a third-party hosting provider such as Hetzner, or any other third-party cloud provider, is not used.
This means your personal data is transferred outside the United Kingdom and the European Economic Area. Message, media, and call content is end-to-end encrypted, so it stays unreadable to the server operator regardless of hosting location. The limited account data kept on the server (the "What we collect" table above) may be subject to Turkey's legal access regime; this data is kept to the minimum scope and retention described in that table. In temporary cloud test environments (not production), third-party providers can see connection metadata.
You have the right to access, rectify, erase, object to processing, and port your data. You can delete your account instantly from within the app via Settings > Security > Delete my account; if you don't have access to the app, follow the instructions on the account deletion page. For other requests, contact info@lukidigital.com. Supervisory authority: the Information Commissioner's Office (ICO), ico.org.uk.
The service is not directed at anyone under 18. VURN is end-to-end encrypted and content moderation relies solely on user reports — this is why the age floor is set conservatively (see Terms of Use section 2). We do not knowingly collect data from children.
This policy may be updated; material changes are announced in the app.