Privacy
Privacy policy
Last updated: 28 October 2026
OxiTalk is a Matrix chat app. Your messages go to the Matrix homeserver you sign in to and nowhere else. OxiSoft runs no servers for the app, collects no data, and the app has no analytics, no ads and no trackers.
Who we are
OxiTalk is made by OxiSoft. Questions about this policy: contact us.
This policy covers OxiTalk on every platform: iPhone and iPad (App Store), Android (Google Play and our F-Droid repository), macOS, Windows and Linux.
Your homeserver
Matrix is a decentralised network. To use OxiTalk you sign in with an account on a Matrix homeserver that you choose: your own, your company's, or a public one. Everything you send (messages, pictures, files, voice and video messages, reactions, your profile name and picture) goes to that homeserver, which passes it on to the other people in the conversation and to their homeservers. That is how Matrix works, and it is the only place OxiTalk sends your content.
Each homeserver is run by its own operator under its own privacy policy. OxiSoft does not run your homeserver and cannot see what you send through it. Please read your homeserver's policy too.
Direct chats and private rooms are end-to-end encrypted: the homeserver stores and forwards them, but only the people in the conversation can read them.
Calls
Voice and video calls use the call service (a MatrixRTC media server) that your homeserver offers. Call audio and video go through that service, end-to-end encrypted between the people in the call. OxiTalk does not use any other call server.
What the app keeps on your device
- For each account: the sign-in session, your encryption keys and a local copy of your chats, so the app opens quickly and search works in encrypted rooms. This store is encrypted; its key is kept in the system's secure storage.
- Pictures and files you opened, in a cache that is cleared after a time you choose in the settings.
- Drafts of messages you have not sent yet, in the same encrypted store.
- Your app settings, such as theme and notification choices.
- Diagnostic logs, only if you turn them on in the settings. They stay on your device unless you share them yourself.
Logging out of an account deletes that account's data from the device. Uninstalling the app deletes all of it.
What we collect
Nothing. OxiTalk has no analytics, no crash reporting service, no advertising and no tracking of any kind. OxiSoft receives no data from the app.
Data from the App Store and Google Play
Apple and Google run the stores you install OxiTalk from, under their own privacy policies. They give us download counts and, only if you allowed sharing with developers in your device settings, anonymous crash reports. This reaches us in summary form, without your name, Matrix ID or messages. You can turn crash sharing off in your device settings at any time.
Notifications
OxiTalk does not use a push notification service. Notifications about new messages are created on your device by the app itself, from what it receives from your homeserver while it runs. No message content passes through Apple, Google or OxiSoft for notifications.
Security
The app connects to your homeserver over HTTPS. Direct chats, private rooms and calls are end-to-end encrypted with the Matrix encryption protocols. Your encryption keys and the local copy of your chats stay on your device in an encrypted store, protected by the system's secure storage.
Deleting your data
- On your device: log out of an account to delete everything the app kept for it, or uninstall the app to delete all of it.
- On your homeserver: your account, messages and files are held by your homeserver, not by OxiSoft. You can delete messages in the app; to delete the account itself, use your homeserver's account deactivation or ask its operator.
- With OxiSoft: we hold no data about you from the app, so there is nothing for us to delete. If you wrote to us, contact us and we will delete that correspondence.
Your rights
Under the GDPR you have the right to access, correct and delete personal data, to object to its processing and to complain to a supervisory authority (in Poland, the President of the Personal Data Protection Office, UODO). For data held by your homeserver, contact its operator. For anything you sent to OxiSoft directly, contact us; we only use it to answer you.
Permissions
- Microphone: for voice messages and calls. Used only while you record or are in a call.
- Camera: for video messages and video calls. Used only while you record or have your camera on in a call.
- Notifications: to tell you about new messages.
- Photos and files: when you attach a picture or a file, or pick a profile picture, you choose it in the system picker. The app sees only the file you picked.
- Network and Bluetooth: to reach your homeserver, and to route call audio to a Bluetooth headset.
You can turn any permission off in the system settings. The rest of the app keeps working without it.
Children
OxiTalk is not directed at children. Whether children may use a homeserver is up to that homeserver's operator.
Changes
If this policy changes, we will update this page and the date above. The app's source code is public at github.com/oxisoft/oxitalk, so you can check what it does.