Privacy Policy
Effective: 01/11/2026
In short: we built #COMMS so that there is almost nothing about you for us to hold. We cannot read your messages, hear or see your calls, or see your photos, videos, files or locations. We never ask for your phone number or your e-mail address, and we cannot link your payment to your username.
1. Who we are
#COMMS is provided by COMSOVE GLOBAL OPERATIONS LIMITED, a company registered in England and Wales with company number 15666805, whose registered office is at COMSOVE Sphere Centre, Great Portland Street, London, United Kingdom ("we", "us"). We are the controller of the personal data described in this policy: we decide why and how it is processed. You can contact us about privacy at COMMS (username: comms).
2. What we never have
- The content of your messages, calls, photos, videos, voice notes, files and shared locations.
- Your phone number.
- Your e-mail address (except the one you give Stripe for your receipt, see section 6).
- Your address book or your contacts' details.
- An advertising profile of you. The app contains no advertising or analytics trackers.
Photos, videos, voice notes and files go directly from phone to phone and are never uploaded to our servers.
3. Sealed envelopes we cannot open
Some things pass through #COMMS only in sealed form. They are encrypted on your phone with keys that exist only on the phones involved. We hold no key and have no means to read them or to learn what is inside them.
| Sealed envelope | Why it passes through #COMMS | How long |
|---|---|---|
| A message or invitation for someone who is offline | To deliver it when they come online | Deleted on delivery; at most 7 days for messages and 30 days for invitations |
| Your encrypted contact backup, which only your recovery phrase can open | So you can restore your contacts on a new phone | Until you delete your account |
| A live location you share | To pass it to the people you share it with, in real time | Not stored |
Because we cannot open these envelopes and have no means of identifying anyone from what is inside them, we do not regard their contents as personal data in our hands. We still keep them only as long as stated above.
4. The few technical items #COMMS needs to work
To run the service, the system creates a few technical items. They say nothing about your private life: not what you say, and not what you share. The law nevertheless treats identifiers like these as personal data, so we list them here, with how long we keep them.
| Item | Why | How long |
|---|---|---|
| Your username | So others can invite you | Until you delete your account |
| Technical account data created by the app (the public parts of your encryption keys, a random device identifier) and your settings | To provide your account and deliver invitations and messages | Until you delete your account |
| Limited security records | To prevent abuse and impersonation | For as short a time as needed, at most 6 months after an account is deleted |
| Payment confirmation | To confirm your registration fee was paid | Deleted once your account is created, or after 30 days at most |
| IP addresses | To connect your phone and keep the service secure | Processed briefly; not stored |
5. Our website
hashcomms.com loads nothing from third parties and uses no analytics. Its only cookie remembers the language you pick. Our web host processes IP addresses to deliver the pages.
6. Payments
The one-time registration fee is processed by Stripe, which acts as an independent controller for payment data. Stripe collects your card details and e-mail address to process the payment and send a receipt; see Stripe's privacy policy. We never see your card details, and we cannot link your payment to your username. We keep the payment records the law requires, for example for tax.
7. Lawful bases
- Contract (UK GDPR Article 6(1)(b)): to provide your account, deliver invitations and messages, and connect calls.
- Legitimate interests (Article 6(1)(f)): to keep the service secure and prevent abuse.
- Legal obligation (Article 6(1)(c)): to keep payment and accounting records.
8. Who else is involved
- Our servers are located in the United Kingdom, and our website operates on our behalf.
- Stripe processes payments (see section 6). Stripe may transfer data outside the UK with the safeguards required by UK law.
- We do not sell personal data and do not share it for advertising.
9. Requests from authorities
We respond only to valid legal requests under UK law. We cannot hand over what we do not have: the content of messages, calls, media or locations, or your contact list.
10. Your rights
Under UK data protection law you may ask for access to, correction of or deletion of your personal data, and you may object to or ask us to restrict processing. You can delete your account at any time in the app (Settings → Delete account). To exercise a right, write to comms at COMMS app.
11. Children
#COMMS is not intended for anyone under 16, and we do not knowingly provide accounts to them.
12. Changes
If we change this policy we will publish the new version here with a new effective date, and for important changes we will also announce them on our website and, where possible, in the app before they take effect.