Privacy policy

Last updated: 10-29-2026

Sama Sama is being tested before its public release. It is made by me, Lucas Lukowski, an independent developer in Edmonton, Alberta, Canada. Questions about this policy, or requests about your information, can go to support@codertheory.dev.

The short version

What you write in the app is end-to-end encrypted. Your events, notes, chats, checklists, polls, costs, photos and files are encrypted on your phone before they leave it, and only the people you share them with can read them. The server stores them, but it cannot read them, and neither can I.

The server still needs some information to work, mostly who is in which space and when things were sent. This page lists all of it, who else sees any of it, and how long it is kept.

Who is responsible

I run the app on my own, so I am the person responsible for the personal information it holds, and the person in charge of protecting it under Quebec's privacy law (Law 25). You can reach me at support@codertheory.dev. Naming this formally is still open, so this part may change.

What the server can read, and why

• Your email address, if you sign up with email, or if Apple or Google share it when you sign in with them. It is used to send you sign-in codes and nothing else, and it is never shown to other people. You can remove it in Settings. If you sign in with Apple and hide your email, the server keeps Apple's relay address instead.
• Your sign-in methods: which ones you use (email, Apple, Google, passkeys), the account identifier each provider gives the app, the name you gave each passkey, and when each was last used.
• Your username, which other people use to find and add you.
• Your phones: an identifier for each phone signed in to your account, its model (for example "iPhone 16"), its public keys, and when it was last active, to the hour.
• A push token for each phone, so Apple or Google can deliver notifications. The notifications themselves are encrypted, and your phone decrypts them.
• Who shares with whom, but not what: which accounts and phones are in each shared space, event or chat, roles, who invited whom, contact requests and how you found each other, who you have blocked, your invite link, and when encrypted content was added and how large it is. This is needed to deliver things to the right people.
• How much storage you use, to apply the storage limit.
• Sticker pack purchases. Google Play or the App Store handles the payment, and the app never sees your card or payment details. The server keeps a record of the purchase on your account (which pack, the store's ID for the purchase, when it was bought, and whether it was refunded) so the pack works on all your phones.
• Reports you send. If you report someone, you choose which of their messages to include, and the report sends them as text, with anything you write about it, so that I can read them when I review it. This is the one place the server holds readable content. Reports carry text only. If a reported message had a photo or file, the report says that one was attached, but the file itself and the key to open it are never sent.

The server also holds your account's keys, but only locked with your recovery key, which only you hold, so it cannot use them.

The legal basis

Canada's privacy law (PIPEDA) asks for your consent and for collecting only what is needed. Almost everything above is needed to provide the app you signed up for: signing you in, delivering what you share, sending notifications, applying the storage limit and keeping your purchases. You consent to that by making an account, and you can take that consent back by deleting it.

Some things are your choice. An email address, signing in with Apple or Google, link previews, sharing your free and busy times, buying a sticker pack and sending a report are all optional, and the app works without them.

Crash and error reports are sent to keep the app working, and they carry nothing that identifies you. There is no setting to turn them off yet.

What the server cannot read

The content of anything you create or share: event details and replies, notes, chat messages, photos and files, checklists, polls, costs, your calendar availability, your name and profile photo, and the replies guests leave on an event's web page. Your phone's own calendars stay on your phone. Only a free and busy summary is made from them, and it is encrypted before it is sent.

On your phone, the app's data is kept in an encrypted database with its key in the phone's keychain, and it is left out of iCloud and Google backups. The one exception is your recovery key, which goes to your iCloud Keychain or Google's Block Store so you can get your account back on a new phone. Apple and Google encrypt it end to end there. On Android it is only sent when Block Store says the backup is end-to-end encrypted, and otherwise stays on the phone.

Services the app relies on

These services see what they need to do their part. None of them get your content in a form they can read.

• Railway hosts the server, its database and its file storage. It holds everything the server holds, as listed above, and the encrypted files, which it cannot open.
• Cloudflare serves the event guest page and the links that open the app, keeps the encrypted backups (it cannot open them), and runs the domain's DNS. It sees the IP address and the address asked for when someone opens one of those links. The server's own traffic does not go through Cloudflare.
• Resend sends sign-in code emails, so it sees your email address, the code and the time.
• Apple Push Notification service and Firebase Cloud Messaging (Google) deliver notifications. They see the phone's push token, the time, which space it is for, and sometimes the encrypted message, which they cannot read. On Android, the Firebase library also makes a Firebase installation ID for this install of the app and sends it to Google so notifications can reach it.
• Apple and Google handle Sign in with Apple and Sign in with Google, if you use them, so they know you signed in to this app.
• Google Play and the App Store handle payment for sticker packs.
• Sentry (Functional Software, Inc., United States) receives crash and error reports. A report holds technical details only: what went wrong and where, the app version, the phone model and OS, and on the server the kind of request. It holds nothing written in the app, and no name, email, username, account or phone ID, IP address, or link and invite addresses.
• Discord gets alerts about the server's health, with no personal information in them.

Link previews: when you send a link in a chat, your own phone fetches the page to make the preview, so that website sees your phone's IP address. The server is not involved. You can turn link previews off in Settings, under Privacy.

Your information is not sold, and it is not shared with anyone beyond the services above.

Where it is stored

Everything the server holds is stored and processed outside Canada, in the United States. The server, its database and Redis run in Railway's us-east4 region (Virginia), files are stored in Railway's San Jose region (California), backups are in Cloudflare's eastern North America location, and Sentry and Resend are in the US. The guest page and app links are served from whichever Cloudflare location is closest to the person opening them.

Law 25 asks for an assessment before personal information leaves Quebec. That assessment is not written yet.

Logs and IP addresses

Railway, which hosts the server, keeps its own log of every request for 7 days: the IP address it came from, the user agent (which app or browser sent it), the full address it asked for (which for an invite link includes the link), the result and how long it took. I can't turn that log off.

The server's own logs hold only the kind of request, which part of the server it reached, the result, its size and the time it took. They have no IP addresses, tokens or usernames, and they are kept for 7 days.

To limit how many sign-in attempts and similar requests can come from one place, the server keeps a count. It stores only a keyed hash of the IP address or email address, not the address itself, and deletes it when the limit's window ends: after 1 minute, 10 minutes, or 1 hour for requests for an email code.

No ads, analytics or tracking

There is no advertising, no analytics and no tracking in the app or on the guest page, and the app does not use an advertising ID or your location. Crash and error reports are the only diagnostics the app and the server send, and they are not linked to you. Sentry keeps them for 30 days.

Event guest pages

People without the app can reply to an event through its web page. Their name, reply, note and poll votes are encrypted in their browser with a key that only the event's hosts and guests hold. The key is in the part of the link after the #, which browsers never send to a server. The server stores the reply without being able to read it, until a host's phone collects it.

The page uses no cookies. It keeps two things in the browser's local storage: a random token, so the browser counts as the same guest, and the last reply sent, so it can be changed later. Both stay in that browser, not encrypted, until the browser's site data is cleared.

How long things are kept

• Your account, email address, username, sign-in methods and passkeys: until you remove them or delete the account.
• Email sign-in codes: a code works for 10 minutes and is deleted within about an hour after that.
• Sign-ins: a sign-in lasts 60 days without use. The record of a sign-in (a scrambled form of the token and some dates) is deleted 30 days after it expires. A sign-in that was ended early keeps its expiry date, so its record is gone at most 90 days after it ended.
• Phones: a phone that has not been active for 90 days is removed from the account. A removed phone's model is deleted 30 days after it was removed, when it drops off the account's list of recently removed phones, and right away if the account is deleted. What is left of the record (its ID, public keys and the dates it was added and removed) is kept with no end date, because what that phone wrote in shared spaces still names it and its keys are what show a message really came from it.
• Adding a phone: the encrypted data for a new phone works for 10 minutes. If the new phone never collects it, it is deleted within the hour after that. The server cannot read it.
• Push tokens: until Apple or Google say the token no longer works, or the phone is removed. A notification that cannot be delivered is dropped after 3 days.
• Shared spaces: what is in a space, and the record of who added what and when, stays as long as the space has members. Files that never finished uploading are removed after 24 hours.
• Calendar availability: until you stop sharing it, or delete the account.
• Guest replies: until a host's phone collects them, the link is reset, or the event is deleted.
• Reports: until 90 days after each one is resolved, including reports by or about a deleted account. A report that is never resolved is deleted a year after it was sent.
• Sticker pack purchases: until the account is deleted. A refund that arrives before anyone has claimed the purchase is kept, with no account, so the purchase cannot be claimed later. Its purchase date is deleted 30 days after the refund. The rest (the store's ID for the purchase, the pack and the refund date) is kept with no end date, because the App Store's proof of a purchase can still be sent after a refund and this record is what refuses it.
• Background job records (account, phone and space IDs): 7 days, or 30 days for ones that failed.
• Counts that limit sign-in attempts: 1 minute, 10 minutes, or 1 hour for requests for an email code.
• Logs: 7 days, both Railway's and the server's own.
• Backups: a copy of the database is made every night and kept for 14 days. The Sunday copy is kept for 98 days. They are encrypted with a key that I keep offline, and a lock on the backup storage stops them being deleted before then. Copies of files, which are still end-to-end encrypted, are kept for 30 days after the file is removed.
• Crash and error reports: 30 days.
• On your phone: until you sign out, delete the account or remove the app. A data export you make is a plain, unencrypted file. It is deleted from the phone as soon as you save or send it. On Android, sharing it with another app is the exception, because the app is not told when the other app has finished, so that copy waits for the 7 days. If you don't save it, it is deleted after 7 days. It is also deleted when you delete the account or the phone is removed from it.

Two things above are kept with no end date on purpose: what is left of a removed phone's record, and a refund that no one claimed. Each holds only what it needs to do its job, and nothing that names you. The people who can sign in to the server's admin are checked every three months, and anyone who no longer needs it is removed.

Deleting your account

You can delete your account in Settings, and it is deleted right away. If you no longer have the app, you can ask for it by email instead. Deleting your account explains both ways.

Deleting it removes your email address, username, sign-in methods and passkeys, keys, phones' sign-ins and push tokens, invite link, calendar availability, sticker pack purchases, blocks, waiting contact requests, and every space only you were in, with its files and guest link. The app then clears everything it kept on that phone, including your recovery key in iCloud Keychain or Block Store. Some things are kept:

• What you wrote in spaces shared with other people stays there, still encrypted, for those people, and shows as written by a deleted user. So do accepted contact requests and who made or invited people to a shared space.
• The account's ID stays as an empty record with only the date it was deleted: no email address, no username, and not the date it was made. Your username is free for someone else to take. Your phones' records stay too, without their models, as described above. What stays in shared spaces points to them.
• Reports are kept until 90 days after each one is resolved, or a year after it was sent if it is never resolved.
• The nightly backups still hold your email address, username and the rest of the account until they age out: up to 14 days for the daily copies and up to 98 days for the weekly ones. Copies of files from your deleted spaces age out of the backups in about 31 days.
• Railway's logs, which may hold your IP address and invite link, age out after 7 days, the counts that limit sign-in attempts within an hour, and sign-in codes within about an hour.
• A data export you saved, and a guest reply kept in a browser, stay where they are until they are deleted there.

Seeing and correcting your information

You can download a copy of everything you can read in the app with Export my data in Settings. It is decrypted on your phone.

In the latest version of the app, the export also includes what the server holds about you, in a file called server.json: your email address, username, sign-in methods, phones, sign-ins, blocks, spaces, purchases and the reports you made. If your phone can't reach the server when you export, that file is left out and the export says so. In that case, or on an older version of the app, email me and I will send it.

You can change your profile, email address and sign-in methods in Settings. For anything you can't change there, or any question about what is held about you, email support@codertheory.dev. I will answer within 30 days. If you are not happy with the answer, you can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

During testing

The test version uses a test server. Its data can be reset at any time, so please don't keep anything there that you would mind losing.

Children

This app is not meant for anyone under 16. It does not ask for your age.

Changes

If this policy changes, the date at the top will change.

The terms of use cover the rest of how the app works.

Open-source software

The apps and this site are built with open-source software. Open-source licences lists what this site uses, with each licence. The apps list theirs in Settings, under Help.