Privacy Policy
1. Who we are
u-mankind is an anonymous, text-only peer-support app for adults in Canada, outside Quebec. It is operated by u-mankind Ltd., a company incorporated in Israel (“u-mankind”, “we”). Our privacy contact is privacy@u-mankind.com. Your data is stored in Canada, in Amazon Web Services’ Canada (Central) region.
This policy explains what we hold about you, why, for how long, who else touches it, and what you can do about it. It is short because we hold little.
2. The short version
- You are anonymous. You never give us a name, email address or phone number.
- Conversations are end-to-end encrypted on your device. Nobody at u-mankind can read them, and no copy exists on our systems after delivery.
- What we do hold is metadata: that an account exists, which two accounts spoke and when, ratings, reports about behaviour, and safety records. Section 3 lists all of it.
- You can delete your account from the app’s Settings at any time. Section 9 says what is deleted, what we keep, and why.
3. What we hold, why, and for how long
| What | Why | How long |
|---|---|---|
| Your account: a random account id, its status, when it was created and last signed in, your admission tier (new accounts are probationary) and a count of your conversations as a seeker. | To run your account and apply the probation rule for supporters. | Until you delete your account. After deletion a record of the id, its status, any sanctions and its safety risk score remains (section 9). |
| Your consents: that you confirmed you are 18 or older, the method (self-declared), the version of this policy and the Terms you accepted, and when. | To prove the consents the law requires. | Until you delete your account. |
| Your passkey: its credential id, public key, the kind of authenticator that made it, a sign counter and backup flags, and when it was created and last used. The private key never leaves your device or your passkey provider. | To sign you in. | Until you delete your account. |
| Your device key: a public key created inside your phone’s secure hardware, a fingerprint of it, and the fact that we verified it. | To tie the account to a genuine device and limit how many accounts one key can create. | Until you delete your account. |
| A keyed hash of the network address you registered from (the full IPv4 address, or the IPv6 /56 prefix), computed with a secret key. The address itself is never stored or written to logs. | To notice bursts of registrations from one place, which is how abusive accounts arrive. | About 31 days. Your account’s own copy is removed as soon as it leaves probation. |
| Sign-in sessions. | To keep you signed in without passwords. | 30 days after last use, 90 days at most. |
| Live connection and waiting-list records: a connection id, your session, your role, and when you joined the queue. | To deliver messages and find you a match. | While you are connected or waiting, and at most 15 minutes after that. |
| Conversation records: the two accounts in a chat, when it started and ended, and how (time ran out, or someone ended it). | To run the chat, and to let you rate or report it afterwards. | The live record for 30 minutes after the chat starts; a record that you took part for 7 days, for ratings and reports. |
| Encrypted messages in transit. | To deliver them. | An undelivered message waits at most 15 minutes and is deleted the moment it is delivered. We cannot read it at any point. |
| Your encryption keys: the public halves of your identity, signing, one-time and fallback keys. | So the other person can encrypt to you. | Until replaced, or until you delete your account. |
| Ratings: the 1–5 score and tags a seeker gives after a chat, and a 24-hour record that prevents rating the same supporter twice. | Supporter standing. | Ratings you received are kept until you delete your account; ratings you gave stay with the supporter’s account. Their weight halves every 30 days, so recent chats matter most. |
| Blocks. | So you are never matched with someone you blocked. | Until you unblock them, or delete your account. |
| Reports: who reported whom, in which conversation, the reason chosen from a list, and the report’s status. Never message content. | Safety. | Kept. See sections 7 and 9. |
| Safety records: risk inputs and a score, strikes, restrictions, suspensions and bans. | Automatic enforcement. | Risk inputs count for 30 days; strikes for 365 days; records of sanctions are kept. |
| Server logs: request ids, routes, the reason a request was refused, and on some lines an account id. No network addresses and no message content, by design. | To operate and debug the service. | 14 days. |
The times above are when a record stops being used. The stored copy is removed by an automatic cleanup shortly afterwards, normally within two days.
4. What we never collect
Your name, email address, phone number, contacts, location, photos, identity documents, advertising identifiers, or anything typed in a conversation. The app contains no analytics or crash-reporting software from anyone. It does show ads on three screens (two while seeking support, one after a supporter's conversation); section 6 says exactly what that involves, and it does not change this list — the advertising identifier is switched off in the app.
5. Who else processes data
- Google. When you create an account, and when you sign in on a new device, the app asks Google Play to confirm that the device and the app are genuine (Play Integrity): the app sends Google a one-time challenge, Google returns a signed verdict, and our server checks it and keeps only the fact that the check passed. Your passkey is created and stored by Android’s Credential Manager and may be synced by Google Password Manager according to your Google account settings. Google processes this under its own terms, possibly outside Canada. If you email us, your message reaches us through AWS in Canada and is forwarded to a Google mailbox we use for support, so Google also processes that correspondence.
- Amazon Web Services, our hosting provider, in the Canada (Central) region. AWS holds the data on our behalf and cannot read your conversations either.
- Google AdMob. Serves the ads described in section 6. When an ad is requested it receives the device’s IP address and basic device and app information; it never receives anything about your conversations, and the app does not give it the advertising identifier.
- Nobody else. We do not sell or rent your data, we never use it to target ads, and we do not disclose it to anyone else except as section 8 describes for legal process.
6. Advertising
u-mankind is free to use and is paid for by ads. They appear on three screens only: while a seeker waits for a match, after a chat ends, and on a supporter's after-conversation screen. On the after-conversation screen the ad is shown only if the supporter chooses to watch it. There are never ads inside a conversation.
The ads are served by Google AdMob and are contextual, not personalised. The app sends no advertising identifier (it is switched off), no profile, and nothing about your conversations, which are end-to-end encrypted and never leave your device in readable form. What Google receives when an ad is requested is the device’s IP address and basic device and app information, which Google uses to serve and measure the ad under its own policy: how Google uses information from apps that use its services.
We can turn ads off, or change where they appear, without updating the app. We never use what you type, who you spoke with, or your ratings and reports to choose an ad.
7. Safety and enforcement
Reports are about behaviour and are chosen from a fixed list; they never include what was said. Ratings can carry safety tags. Reports and tags feed an automatic system: enough corroborated reports lead to a temporary restriction, then a time-limited suspension, then a permanent ban. Nobody at u-mankind reads conversations, because nobody can. If you believe a sanction was wrong, write to privacy@u-mankind.com and we will review it with the records we hold.
8. Where your data lives, and who can reach it
Everything in section 3 is stored in Canada. u-mankind’s staff access it from Israel to operate the service and to answer your requests. We may be required to disclose what we hold by a court or authority with jurisdiction in Canada or in Israel; in that case we can only hand over the metadata listed above. We cannot produce message content, for anyone, because it does not exist on our systems.
9. Deleting your account, and your other rights
- Delete in the app: Settings → Delete account. It takes effect immediately, signs you out, and erases the encryption keys on your device.
- Without the app: see u-mankind.com/delete-account.
- What is deleted: everything that identifies or serves your account — your passkey and device key, your encryption keys, sessions, profile and standing, the ratings you received, the blocks you placed, and your consent record.
- What we keep, and why: a marker that the account existed and was deleted, with its status, any sanctions and its safety risk score; reports and safety records about the account; and blocks that other people placed on it; and the ratings you gave and the reports you made, which stay with the other person’s account. These remain to prevent and investigate abuse. They are not linked to anything that identifies you. The retention period for these records is under legal review.
- Access: write to privacy@u-mankind.com to ask what we hold. Because accounts are anonymous, we can only answer for an account you can prove is yours, which today means signing in with its passkey. We answer within 30 days.
- Complaints: you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or to the Israeli Privacy Protection Authority.
10. Security
Conversations use end-to-end encryption with the Olm double-ratchet protocol (the vodozemac library), with keys generated on your device. Sign-in uses passkeys, not passwords. Every account is tied to a hardware-backed device key with attestation. Connections use TLS with certificate pinning; stored data is encrypted at rest; access inside u-mankind follows least privilege. There is no unencrypted path for a message, and no setting that turns encryption off.
11. Age
u-mankind is for adults 18 and over. Reports that a user may be under 18 are treated as severe, and corroborated ones lead to a permanent ban.
12. Changes to this policy
This policy carries a version number. New sign-ups always accept the current version. If we make a change that matters, we will show it in the app for you to accept.
Version 2 (October 2026): added section 6, Advertising, and named Google AdMob in section 5.
Version 2, revised October 2026: section 4 (What we never collect) and section 6 (Advertising) now count the supporter’s after-conversation screen among the screens that show ads; what an ad request receives is unchanged, so the version number is not.
Version 2, revised again October 2026: section 6 now says the after-conversation ad is shown only when the supporter chooses it; what an ad request receives is unchanged, so the version number is not.
13. Contact
u-mankind Ltd., Israel. Email: privacy@u-mankind.com.