Privacy Policy

Stolo is an encrypted mesh communications app made by Stolo Systems Inc. (“Stolo,” “we,” “us”). This policy explains, in plain language, what information we handle when you use the Stolo app on iPhone, Android, macOS, Windows or Linux, and when you use this website — and, just as important, what we never handle.

Stolo is designed so that we cannot read your messages or see your location. That is how the system is built, not just a promise. The infrastructure we run touches three things, each explained below: encrypted mail we cannot open (our relay), routing metadata (our gateway), and the membership list of any network you join (our network directory).

The short version

• There are no accounts. Your identity is a key pair generated on your device and never sent to us.
• Message content, files, voice messages and shared positions are end-to-end encrypted between devices. We cannot read them.
• If you use our gateway or relay, they see routing metadata (such as your IP address, device identifiers and your display name in network announcements) but not content.
• If you create or join a network, our network directory stores your display name and device public key so the other members can find you. Leaving the network removes it.
• If you installed Stolo from this website rather than from the App Store or Google Play, it asks us at most once a day, while you have it open, whether a newer version exists. That request says nothing about you, and you can switch it off.
• No analytics, no advertising, no tracking, no data sales.

What stays on your device

Everything the app creates — your identity keys, your messages, your media, your contacts, your networks and your history — is stored on your own device. Message text, attachment names, contact names, group names and cached positions are encrypted at rest (AES-256 with an authentication tag) and attachments are sealed with an authenticated cipher. The key is generated on the device and kept in the iOS Keychain, the Android Keystore, or the macOS or Windows credential store; on Linux without a system keyring it is kept in a file readable only by your user account. It is never backed up to iCloud or Google and never leaves the device.

Your block list and any quarantined messages from unknown senders are stored locally only. Blocking someone tells no one. Declining a quarantined message sends a short “declined” receipt back to that sender over the mesh, not to us.

Backups you make

You can export a backup from the app. It is a file you keep — saved through the share sheet or a save dialog on your device — and it never passes through our servers. The backup is sealed with a passphrase of your choosing (at least 12 characters, strengthened with 600,000 rounds of PBKDF2). An identity backup contains your keys, display name, profile fields and block list. If you choose “include message history,” it also contains your full message database, attachments and settings. Anyone with the file and the passphrase can restore it, so treat both with care.

Our gateway

A fresh install is configured to connect to a Stolo-run gateway (gw.stolo.io) so that devices that cannot reach each other directly can still exchange traffic. You can turn it off or remove it in the app’s interface settings, and the app will not add it back. While you use it, the gateway acts as a transport node and necessarily sees:

• your IP address and connection timing, which we use to limit connections per address and keep the service up;
• device and destination identifiers (cryptographic hashes, not names) and the timing and size of relayed packets;
• your network announcements, which the mesh broadcasts unencrypted so that peers can discover you. An announcement carries your display name, your device identifier, your presence state, and signed proof of which networks you belong to.

The gateway does not see message content, files, voice messages or positions: those are encrypted between the sending and receiving devices. We do not keep connection logs beyond what is needed for operating and protecting the service.

Our relay (store-and-forward)

So that a message still arrives when the recipient is temporarily offline, Stolo operates a relay (propagation) node. By default a fresh install uses it with no setup. You should know exactly what it does:

• It holds end-to-end-encrypted message data that we cannot decrypt. A message is deleted as soon as the recipient’s device collects it, and in any case within 30 days; when the store is full, the largest and oldest messages are removed sooner.
• To route that mail it sees delivery metadata: the destination identifier, size and timing. It does not see message content, your name, or your location.
• It does not replicate its store to other relay nodes.
• You can turn the relay off in Settings, or point the app at your own relay node instead of ours. With it off, messages are delivered only while both devices can reach the mesh.

Networks and our network directory

Stolo lets you create a network — a private group with a fixed number of seats — and invite people to it with a link. To let members find each other across the mesh, membership is kept in a Stolo-run network directory (roster service). Joining or creating a network is optional; if you never do, nothing in this section applies to you.

When you join a network, your device sends the directory a signed contact card containing your display name, your device public key and identifier, and proof of membership in that network. When you create a network, the directory also records the network’s identifier, its seat limit and who owns it. Each request carries your device identifier and a signature, and the directory keeps a log of membership changes so that members can sync. The directory never receives your messages, positions, contacts outside the network, or the network’s name (that travels only in the invitation itself, device to device).

Leaving a network removes your entry from its membership list; the change log keeps a bounded history (at most a few thousand events per network) until it is trimmed. An owner who archives an empty network deletes everything the directory holds about it. You can also point the app at a directory of your own or disable it in the app’s configuration.

Location

Position sharing is off for every conversation until you turn it on for that person. A global precision control lets you lower the precision shared with everyone, or switch sharing off entirely; it can only reduce what a conversation sends, never increase it. Positions travel encrypted from your device to the peers you chose and are never transmitted to or stored on our servers.

On iPhone you can optionally allow location access in the background so sharing continues while the app is closed. On Android the app never requests background location; sharing runs only while the app is in use.

Permissions the app asks for

• Local network (iPhone and Mac) — to discover peers on the same Wi-Fi.
• Location — only for the position sharing described above.
• Microphone — only while you record a voice message.
• Photos and files — only when you choose something to attach. Stolo has no camera access.
• Notifications — to tell you about incoming messages and peers.
• Bluetooth (iPhone only) — solely to connect an optional RNode LoRa radio. Stolo does not scan for other phones over Bluetooth.
• Run in the background (Android) — the mesh runs as a foreground service with a persistent notification so your phone stays reachable; you can stop it from that notification at any time. The app may also ask to be excluded from battery optimisation for the same reason.

What we collect directly

• If you contact us through the form on our website, we receive what you enter there — your name, email address, organization (if you provide one), the type of use you select, and your message — so that we can reply.
• Licensing (legacy, iPhone only). Stolo is free and no longer asks you to activate it. An install that was activated under an earlier version may still renew its licence token with our licensing service, sending the token, a random install identifier generated by the app, and an Apple purchase receipt if one exists. The install identifier is not tied to your device hardware or your Stolo identity. New installs never contact this service.
• Update check (versions downloaded from this website only). If you installed Stolo from our download page — the Android APK, the macOS disk image, or the Windows or Linux builds — the app asks stolo.io for a small file listing the current version, so it can tell you when a new one is released. It asks at most once a day, only while you have the app open and connected, and never in the background. The App Store and Google Play versions never do this; those stores handle updates themselves. The request contains nothing about you: no identifier, no identity, no message data, and nothing about how you use the app. As with any web request, our server sees your IP address and the time you asked. Nothing is downloaded or installed automatically — if there is a new version, the app offers to open the download page in your browser and you install it yourself. You can switch the check off in Settings → About → Check for updates, after which it stops asking. That switch governs the update check only; the gateway, relay and network directory have their own controls, described above.

The app contains no analytics SDK, no advertising SDK, no crash reporting and no remote map tiles — the map is bundled with the app. Beyond the mesh peers you talk to, the only places the app connects to are the gateway, relay, network directory, licensing service and update check described above, plus links to this website that open in your browser. This website contains no analytics, tracking scripts or third-party embeds.

What we never collect

• Message content, files and voice messages. They are end-to-end encrypted from device to device. We cannot read them — not in transit, not on our relay, not ever.
• Your location. As above, it never reaches us.
• Your contacts, your phone number or your email address (unless you write to us).

We do not sell personal information and do not share it for advertising.

Third parties we rely on

We keep outside services to a minimum, and each processes data only to provide its service to us:

• Amazon Web Services — hosts our gateway, relay and network directory.
• Cloudflare — serves this website, hosts desktop downloads at dl.stolo.io, runs the contact form, and runs the legacy licensing service. Like any network provider, it processes technical connection data (such as IP addresses) to deliver and protect those services.
• Resend — delivers the email generated by the contact form to us.
• Google — hosts the mailbox that receives contact-form messages, and distributes the Android app through Google Play. What Google collects when you install from Google Play is governed by Google’s privacy policy. The Android app is also offered as a direct download (APK) from this website, which involves Google not at all and needs no Google account.
• Apple — distributes the iPhone app through the App Store and processes any in-app purchase made under earlier versions. What Apple collects is governed by Apple’s privacy policy. The Mac app is not sold through the App Store: it is downloaded from this website and signed and notarized by Apple, which means Apple checked it for malware but does not distribute it or see who installs it.

None of these receive message content or location data from us — we never have it to give.

Retention

• Relay: encrypted mail is deleted once collected, or after 30 days at the latest.
• Network directory: your membership entry until you leave; a bounded change log until it is trimmed; everything for a network is deleted when its owner archives it.
• Gateway: operational connection data only as long as needed to run and protect the service.
• Contact form: only as long as we need it to help you, and sooner if you ask.
• Your device: everything the app stores lives there and is deleted when you delete it.

Deleting your data

To remove yourself from a network’s directory, use Leave network in the app while your identity still exists; that is what lets the directory verify the request. Delete profile then wipes everything on the device. If you delete your profile without leaving first, the app queues the departures, but they cannot be confirmed once the signing key is gone, so an entry may remain in the directory until the owner archives the network or you write to us and we remove it. Any encrypted mail still waiting on the relay expires within 30 days and can no longer be decrypted by anyone.

Your rights and choices

You can ask us at any time to access, correct, or delete anything we hold about you — your directory entries, or any message you have sent us through the contact form. Use the contact form on our website and we will respond to reasonable requests regardless of where you live. You can turn off the gateway, the relay and the network directory in the app and run Stolo entirely on your own infrastructure. If you installed from this website, you can also turn off the update check at Settings → About → Check for updates, after which it makes no update requests.

Children

Stolo is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us through the website and we will delete it.

Changes to this policy

If we change this policy, we will post the new version here and update the effective date at the top of this page.

Questions?

Questions about privacy or this policy → use the contact form on our website.