Last Modified: August 17, 2017 (view archived versions)
Thank you for using Wickr! Wickr allows you to encrypt and send audio, video, voice, text messages and files, so that you can communicate safely, securely, anonymously — and easily.
We work very hard to preserve your privacy and security, and we do our best to be as transparent as possible in explaining how we use your data in providing our Services. Please contact us if you have any questions at email@example.com
Wickr Messenger (Wickr Me App)
Our Privacy Practices in Brief:
Wickr has to collect some information from you in order to provide our Services to you, but we do so in a highly limited, highly secure way.
- We can’t see information you send through the Wickr Me App. Your information is always disguised with multiple rounds of salted, cryptographic hashing before it is transmitted to our servers. Because of this we don’t know — and can’t reveal to others — anything about you or how you use the Wickr Me App aside from the limited information such as the date your account was created, the date of last use and the type of device on which such account was installed. Please see our Legal Process Guidelines for more details.
- Wickr does not log or store metadata associated with your use of the Wickr Me App.
- When you send end-to-end encrypted ephemeral files using Wickr Me, it is important to note that if you do not trust the person you’re talking to, do not open files coming from them or send them photos/files you do not want to be saved.
- Deletion is forever. When you delete a message, or when a message expires, our “secure shredder” technology uses forensic deletion techniques to ensure that your data is overwritten on your device so it cannot be recovered by us or anyone else.
- You control how long your messages are accessible to the recipients, through expiration, burn-on-read settings, and the recall feature which allows you to retract a message you sent. However, there is no magic pill for betrayal and we cannot prevent someone using a camera to take a picture of a message on a screen. Therefore, we strongly encourage you to only send private messages or sensitive information to people you know and trust.
- When you block someone from being able to contact you on Wickr Me, they are automatically added to the block list in your settings. To protect your privacy, they won’t know that you are blocking them when they send you a message.
- If you enabled message notifications for Wickr Me, you will receive notifications about incoming messages on your device’s home screen which will contain the sender’s name as you set it in your Wickr contacts. You can also enable message preview in Wickr settings for notifications, which will add the content of a message to the home screen notifications. Please note, if you don’t want other to see who is messaging you on Wickr Me, you can disable notifications in your device settings in which case you will continue to receive messages, but notifications will not appear on your home screen.
- You own your data. We do not share or sell any data about our users. Period.
What Information Does Wickr Collect and How Is It Used?
We are committed to limiting our collection of your information to what is necessary to provide you with our Services.
We only collect information from users who create Wickr Me accounts. You must create a Wickr Me account to use the Wickr Me App.
What We Don’t Collect
Equally important to us is the information we don’t collect. We will NEVER collect any location information or have access to the contents of the communications you send using the Wickr Me App. After messages are deleted (or after they expire), they are forensically deleted and are not retrievable by us or anyone else. (Remember, however, that if you send a Wickr message to another Wickr user, that message or related content might remain on their device even after you delete it from yours, depending on the value you set for the expiration or burn-on-read time of that message and whether the recipient took a screenshot of the message.)
We collect some very limited information from you after you download the Wickr Me App in order to allow you to create a Wickr Me Account, and begin using the Wickr Me App.
- Your Wickr ID: Your Wickr ID is how you allow others to contact you via Wickr Me. It does not have to be your real name or provide any reference to your identity. Like other information pertaining to your account, it is disguised with multiple rounds of salted, cryptographic hashing when we associate it with your Device Information (described below). The purpose of this cryptographic representation is to allow you to use our Services without our needing to know who you are.
- Your Password: We require you to have a password to use the Wickr Me App, but we never store your password on our servers and don’t store it by default in any form on your device. For your own security, we recommend that you use a long, unique password consisting of a mix of upper- and lower-case letters, numbers, and symbols.
Optional User-Provided Information
Within the Wickr Me App, we provide a few optional features for your convenience. Some of these features, described below, will ask for personal information. If you want to keep your use of Wickr Me as anonymous as possible, please read these sections carefully in order to understand how we associate information you provide with your Wickr Me account.
- Push Notifications: When setting up your Wickr Me account, we will ask if you want to receive notifications of new Wickr messages, software updates, and other administrative and technological developments. Push notifications are functions of devices operating system, so if you enable this feature, your devices operating system’s manufacturer will know that you are using the Wickr Me App, but will not know anything about how you use it or be able to see anything you transmit through it.
- ID Connection: To allow your friends to find you on Wickr Me without knowing your Wickr ID, you may choose to associate your other contact information — currently, just your phone number— with your Wickr ID. When you use this feature, we disguise your contact information with multiple rounds of salted cryptographic hashing for storage on our servers. This way, you can let your friends search for you on Wickr Me without revealing your contact information to us. If you use ID Connect to associate your phone number with your Wickr ID, we use a third party service Twilio solely to deliver a confirmation SMS to you, but that party will not receive any information about you other than your phone number, and the SMS message itself will contain no information except a confirmation link.
- Invitations: If you wish to invite others to use the Wickr Me App, you will be asked for permission to access your device’s contacts in order to invite them to use our Services. We never store your device contacts on our servers in any way. All invitations are generated locally on your device, without sharing any information with us.
- Contact Finder: Contact Finder allows you to search for contacts who have used ID Connect to associate their phone number with their Wickr accounts. If you use Contact Finder, the Wickr Me App will send a disguised representation of your contacts phone number to our servers, at which point our server will check that representation against our database to see whether that contact has an associated Wickr ID.
- Encrypting Cloud Data: The Wickr Me App will allow you to share files you have stored with cloud storage services Google Drive, Dropbox, and Box. The Wickr Me App will make encrypted copies of such files when sending as Wickr messages, which expire when the message self-destructs or is recalled. Cloud storage of your files on Google Drive, Dropbox and Box will be governed by these cloud storage services’ terms, conditions, and privacy policies, so please familiarize yourself with those documents before you use this feature.
- Crash Log: For the purpose of debugging and error correction as well as for system continuity, users might choose to send crash logs to Wickr when prompted by the app (Android). The logs do not contain any user personal information and they pertain only to the Wickr Me App. The process is voluntary and users can choose not to send their crash logs to us at any time. Participating in errors/crash reporting will help Wickr improve the quality of the app.
- Key Verification: To validate the identities of your contacts, the Wickr Me App offers a video key verification mechanism. You can send a validation request to one of your Wickr contacts when establishing connections. You will then be asked to record a short ID verification video, which will be used to validate your identity with your contacts. If the ID video verification you receive from any of your contacts does not appear authentic, you can decline to verify their identity, thus rejecting the connection. Your verification video is disguised with multiple rounds of salted, cryptographic hashing before it is transmitted to our servers, which renders it inaccessible to Wickr. If you decide to re-record your ID verification video, your previous video is automatically deleted from our servers. You can learn more about key video verification here.
- Avatar: You can set a public profile avatar, which will become visible to others on Wickr Me so please do not add avatar if you do not want it to be viewed by others users within the Wickr Me App.
Automatically Collected Information
Wickr collects two types of information automatically during your setup and use of the Wickr Me App: Device Information and Aggregate Usage Data.
- Device Information: The Wickr App will collect a hashed representation of both your mobile device type and your mobile device’s hardware ID during registration, in order to connect that information with your account and to tie your account to your device.
- Aggregate Usage Data: During the operation of our services, we also collect aggregate, anonymous information about basic usage statistics, such as the number of messages sent by all Wickr Me users daily, what types of messages our users tend to send (e.g., voice messages more often than text), and so forth. We never attempt to (and cannot) identify users associated with any of this information.
What Information Does Wickr Share with Third Parties?
We do not share any user information we have with third parties, with the exception of the third-party service with whom we share your phone number for the sole purpose of sending you an SMS confirmation if you choose to associate your phone number with your Wickr Me ID. Please note that the provision of a phone number is completely at the user’s discretion.
Please see our full Legal Process Guidelines, but here are the highlights:
We will always notify our users of any third party requests for their information unless we are legally prohibited from doing so. As soon as legally permissible, we will notify our users of requests for their information. We require a warrant before handing over the contents of communications; however, because of the nature of our technology, the contents of communications will be encrypted and undecipherable if obtained.
You Can Terminate Your Account
You can terminate your account at any time. Once terminated, your account will be irrevocably suspended, ensuring that nobody can use that Wickr ID again in order to prevent impersonation. If you wish to terminate your Wickr Me account, go to Settings, “Terminate Account” and verify by entering your password.
We Retain As Little Data As Possible, for the Least Time Possible
Data Retention on Wickrʼs Servers: Our servers store the encrypted messages that you send and receive only long enough to ensure their reliable delivery to each device associated to your account. Undelivered messages are deleted after 6 days. We retain certain account data (i.e., types of messages sent and account settings changes) which contain no PII for up to 6 days.
Data Retention on Your Device: All messages are stored in encrypted form on end users’ devices. You choose your own retention policy for your messages by choosing how long a message is viewable before it is deleted (via the expiration or burn-on-read time for sent messages, recall ability and manual deletion for your device). Deleted messages cannot be recovered.
We Are Serious About Security
We are concerned about safeguarding the confidentiality of your information. We provide physical, electronic, and procedural safeguards to protect information we process and maintain. For example, we limit access to this information to authorized employees who need to know that information in order to operate, develop, or improve our Services. No sensitive information is in the clear: we take reasonable efforts (as described herein) to ensure that everything we store is not retrievable by us or anyone else.
However, as security experts, we know that no security system can prevent all potential security breaches. Therefore, we have limited the potential implications of such a breach by designing our system so that in the event of a breach, we would have the least possible information about you.
Wickr’s network infrastructure and services are maintained in highly secure, strategically located data centers managed by Amazon Web Services (AWS). Learn more about AWS security policies here.
Children and COPPA
We do not maintain any personally identifiable information about our users or their communications. You can learn more about the information Wickr does and doesn't collect in "What Information Does Wickr Collect and How Is It Used?" section of this policy.
Wickr is not directed to children under the age of 13. If we learn that we have collected personally identifiable information from a child under 13, we will take appropriate steps to delete such information as soon as possible.
In an ongoing effort to improve our services and assist our customers with any questions they have about the use of the Wickr Me App, we have developed a comprehensive collection of the most commonly asked customer support questions and answers, which are available here. Any information provided to us by our users voluntarily when they request customer support (e.g., an email address, Wickr Me App version, or any other details related to user issue) will be used to respond to that individual request and may be logged as part of our effort to improve our customer service and solve any product-related issues. This user-provided information cannot be linked to our users’ Wickr Me accounts, unless users voluntarily include their Wickr Me account information in their customer service-related requests. We strongly discourage our users from disclosing their passwords to Wickr Me accounts to third parties.
A cookie is a small text file that is placed in visitors’ browsers to help us learn when users arrive at our site, how they use the site, when they leave, and when they come back. These cookies can never be used to identify user accounts within the Wickr App.
Here is an example of how we may use information collected via cookies: we may think that one of our new features would be very useful to the Wickr community, but cookies may tell us that very few users fully read that feature’s description on our site. That insight would prompt us to rethink the way we explain that product on our site or present it in an advertisement so that we can better communicate our services to our users.
To improve Wickr's products, website, or marketing, we may engage with various outside partners that have access to the limited data users voluntarily share with Wickr via web forms, cookies, or customer support and sales inquiries. We carefully select each of our partners based on Wickr’s commitment to user privacy and security. Our security team meticulously vets each prospective partner to ensure its policies and practices are on par with Wickr’s standards.
- To assist Wickr with improving our web content and advertising activities, we partner with Pardot, a B2B Marketing Automation Platform, and Salesforce.
- To accelerate resolution of the most frequent customer inquiries, Wickr’s support is automated in collaboration with Zendesk, a customer support platform.
- To deliver a confirmation SMS to our users opting in to connect with friends via ID Connect, we use Twilio.
- To host our website, we use Squarespace.
- To maintain high-security, fast and reliable service delivery worldwide, Wickr partners with AWS, a global infrastructure provider.
Each of these companies has its own policies for handling user data. Please review the respective privacy policies for Zendesk, Twilio, Pardot, Squarespace and AWS for a more complete understanding of their practices.
If you have additional questions regarding our privacy protection practices, please email us at firstname.lastname@example.org.
Users Outside the US
If you use our Services and reside outside the U.S., your information will be transferred to the U.S. and will be processed and stored there under U.S. privacy standards. By using our Services and providing information to us, you consent to such transfer to and processing in the U.S.
You are responsible for complying with any laws or regulations in your country that govern use of applications and services like Wickr Me.
Contact Us if You Have Questions
If you have any questions regarding privacy while using our Services, or have questions about our practices, please contact us via email at email@example.com.