P
Payra

Privacy Policy

We built Payra to protect your privacy. This policy reflects that commitment.

TL;DR Summary

  • ✅ We cannot read your messages — they're end-to-end encrypted
  • ✅ We collect minimal data (only what's needed to work)
  • ✅ We never sell your data or use it for ads
  • ✅ You can delete your account and all data at any time
  • ✅ GDPR and CCPA compliant

1. Introduction

PayraLab ("Payra", "we", "us", or "our") operates payralab.com and the Payra messaging application. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. We are committed to minimal data collection and maximum transparency. Last updated: March 17, 2026

2. Information We Collect

**Account Registration:** We require only a phone number to create a Payra account. We do not require your real name, email address, or any other personally identifying information. **Messages & Calls:** Message content is end-to-end encrypted. We cannot read your messages, see your media, or listen to your calls. We store only: - Encrypted message ciphertext (temporarily, for delivery) - Metadata about when messages were sent (not their content) - Phone numbers for contact discovery (hashed, not stored in plaintext) **Technical Data:** We may collect basic crash reports and anonymized usage statistics to improve the app. This data cannot be linked to your account.

3. End-to-End Encryption Guarantee

All messages, voice messages, images, videos, documents, and calls on Payra are protected by the Signal Protocol (X3DH + Double Ratchet). This means: - Only you and the intended recipient(s) can read your messages - Payra servers store only ciphertext — we technically cannot decrypt your messages - Even if our servers were subpoenaed or breached, message content cannot be recovered - Encryption keys are generated on your device and never transmitted to our servers

4. Cloud Backups

If you enable cloud backup (to Google Drive, iCloud, Dropbox, or OneDrive), your backup is encrypted with a key derived from your password using Argon2id. PayraLab does not have access to your backup encryption key. Your backup provider stores ciphertext only. If you lose your backup password, your backup cannot be recovered. This is by design.

5. How We Use Your Information

We use the minimal information we collect to: - Deliver messages to the correct recipients - Provide account recovery via phone number verification - Send transactional notifications (if enabled) - Improve app performance via anonymized crash reports - Comply with legal obligations We do NOT: - Sell your data to third parties - Use your data for advertising - Build a profile of your interests or behavior - Share your data with governments without a valid legal process

6. Data Retention

- Message ciphertext: Deleted from servers after delivery confirmation (or after 30 days if undelivered) - Account data: Retained until you delete your account - Anonymized analytics: Retained for 90 days - Legal hold data: Retained as required by applicable law When you delete your account, all associated data is permanently deleted within 30 days.

7. Your Rights (GDPR & CCPA)

You have the right to: - **Access**: Request a copy of your personal data - **Rectification**: Correct inaccurate data - **Erasure**: Delete your account and all data ("right to be forgotten") - **Portability**: Export your data in a machine-readable format - **Objection**: Opt out of data processing where applicable - **Restriction**: Limit how we process your data To exercise these rights, contact us at [email protected] or use the in-app account settings.

8. Contact

For privacy-related inquiries: **Email**: [email protected] **Address**: PayraLab Privacy Team, [Address] For security disclosures, use our responsible disclosure policy at payralab.com/security.