Privacy Policy
Offing runs on a Bluetooth mesh between phones, and there is no Offing account. Unless you turn on the optional Stay connected when apart for friends you've met (this policy calls it "internet backup"), the app never connects to the internet and we collect nothing. If you do turn it on, section 4 says exactly what our relay sees and keeps. It cannot read your messages.
The short version
- Without internet backup, we collect nothing. In every case: no analytics, no crash reporting, no advertising identifiers, no tracking of any kind.
- Internet backup is optional and off until you turn it on. When it is on, our relay forwards end-to-end encrypted messages between friends that it cannot read, and keeps your public key, a push token and your friend permissions (section 4).
- You do not create an account. No email, no phone number, no password, no social login.
- Everything else the app stores lives in a database on your own phone and is deleted when you delete the app.
- The people this app does share information with are other users physically near you — that is the entire point of it, and section 5 spells out exactly what they receive.
1. Who we are
Offing is a free, non-commercial project built and operated by Nikhil Kishore, an individual developer based in Pennsylvania, United States ("Offing", "we", "us"). For anything in this policy, reach us at support@offing.xyz.
On the Bluetooth mesh we are not a party to anything: where this policy describes information being shared there, it happens directly between users' phones. The one exception is internet backup (section 4), which is off unless you turn it on. When it is on, we operate the relay and are the data controller for the small amount of data it holds.
2. What we collect
Without internet backup, nothing. With it, only what section 4 lists. In every case, the Offing app contains:
- No analytics or telemetry. The app makes no internet connection at all unless you turn on internet backup, and then only to deliver messages between friends. There is no Firebase Analytics, no Google Analytics, no Amplitude, no Mixpanel, no equivalent.
- No crash reporting service. Crashes are reported only through the operating system's own mechanism, which you control in your device settings, and which is subject to Apple's or Google's privacy policy rather than ours.
- No advertising. No ad SDKs, no advertising identifier (IDFA / AAID) access, no ad network, no tracking pixels.
- No third-party SDKs that transmit data off your device, except Google Firebase for internet backup, which does nothing until you turn internet backup on.
- No cookies in the app. This website uses none either — no analytics, no trackers, no consent banner needed.
We do not sell, rent, share, or broker personal information. We have no personal information to sell.
3. What stays on your device
The app stores the following locally, in a database only the app can read, plus your device's secure keystore. None of it is transmitted to us, apart from what internet backup needs if you turn it on (section 4).
- Your identity key
- An Ed25519 keypair generated on your phone the first time you open the app. It is your identity — there is no account behind it. The private key is held in the iOS Keychain / Android Keystore and never leaves the device.
- Your handle and profile
- The handle you choose, plus any status text and vibe tags you set. Stored locally and broadcast to people near you (see section 5).
- Posts and messages
- Content you create, and content received from people in range, held until it expires. See section 10.
- Contacts, blocks and verifications
- Who you have blocked, who you have verified in person by QR scan, and any private nicknames you set. This list is local to your phone and is never shared or broadcast.
- Session keys
- Cryptographic keys for encrypted conversations and groups you have joined.
Deleting the app deletes all of it from your phone. There is no cloud copy of any of it and no account to close. If you used internet backup, turn it off first and the relay deletes its record for your phone at once; otherwise section 10 says when it is deleted. On iOS the app takes an extra step for this: the system keychain is not removed when an app is deleted, so Offing detects a reinstall and clears the previous install's key itself rather than silently resurrecting your old identity.
4. Internet backup (optional)
Offing 1.1 adds one optional feature that uses the internet: Stay connected when apart ("internet backup" in this policy), for friends you have met (a mutual wave, or an in-person QR verification). It is off until you turn it on, from a card in a conversation, the switch in your profile, or a friend's card. The app makes no internet connection before then. When it is on and Bluetooth can't reach a friend, the message goes through a small relay we operate.
What the relay can and cannot see
- It cannot read your messages. They are end-to-end encrypted on your phone (section 9), and the relay only passes sealed bytes on.
- It does see who is messaging whom, and when. To deliver a message it needs the sender's public key, the recipient's route, the time and the size. Public keys are pseudonymous: not your name, phone number or email. They are stable, though.
While internet backup is on, the relay stores:
- Your public key and a route ID
- A random identifier for your phone, so friends' messages can reach it.
- Your device push token
- Issued by Apple or Google. Used only to wake your phone when a message is waiting.
- Your friend permissions
- Which friends' public keys you have allowed to reach you, and when each permission expires (at most 30 days, renewed automatically while you use the app). Only friends you've met can be given one, and blocking or unfriending someone withdraws it.
- Delivery bookkeeping
- Packet IDs, a fingerprint of each packet, and per-minute counters, used to stop replays and floods. Never message content.
Service providers. The relay runs on Google Firebase (Cloud Functions and Cloud Firestore, in the United States). Messages reach your phone as silent push notifications through Firebase Cloud Messaging and, on iPhone, Apple Push Notification service. These carry the sealed packet, the sender's public key and your route, and Google's and Apple's privacy policies apply to them. Google's infrastructure records the IP address and time of each request to the relay in logs kept for 30 days. We use them only to run and protect the service.
Nothing else changes. Internet backup carries direct messages between friends and the permissions that make them possible. Posts, waves, radar, groups, photos and location never use it, and there is still no account, no analytics and no advertising.
5. What other people nearby can see
This is the section that actually matters. Offing works by broadcasting over Bluetooth to phones within radio range — typically tens of metres. Treat anything below as public to strangers around you.
Broadcast to everyone in Bluetooth range
- Your handle and avatar initials.
- Your status text and vibe tags, if you set them.
- Your public key, which is how other phones address messages to you.
- A rough sense of how close you are, derived from Bluetooth signal strength. This is a coarse band — "right here", "in range" — not a distance in metres and not a direction.
- Any post, photo, poll, story or reply you publish to the public feed. These relay onward from phone to phone, so they can travel beyond the people you can see.
Public posts are public. They are signed by your key and readable by anyone running the app within the mesh. They are not encrypted, because every phone in the chain has to be able to carry and display them.
Direct messages, waves and group posts are encrypted so that only the intended recipient or group can read them. Phones that relay them along the way carry sealed bytes they cannot open. See section 9.
You cannot recall a broadcast. Once something has left your phone and been relayed, copies exist on other people's devices until they expire there. Blocking someone afterwards stops your phone from carrying their content; it does not reach back and remove yours from theirs.
Handles are self-chosen and unverified by default. Anyone can claim any handle. The in-app QR verification and the safety-word check exist precisely because a name alone proves nothing.
6. Location
Offing does not track your location, does not log where you have been, and does not send your location to us. Internet backup never carries it either.
Location is used in exactly two ways:
- Bluetooth scanning. Android requires location permission for any app that scans for nearby Bluetooth devices, because Bluetooth scanning can in principle be used to infer position. We request it for this reason. We do not read your coordinates for scanning.
- Pinning a spot. If you choose to attach a location to a post, or ask the app for a bearing to someone else's pin, the app reads your coordinates at that moment.
Pinned locations are public, and rounded off
A pin on a public post is snapped to roughly a 100-metre grid before it is sent. That is enough to walk to a spot in a field, and not enough to say which tent, doorway or room. The precise coordinates never leave your phone — the rounding happens before the post is signed, so there is no exact version of it anywhere on the mesh.
A pin in a group keeps its full precision, because a group is people who scanned your QR code to get in rather than every stranger in radio range.
Rounded or not, a public pin still points at an area you are in, and the post relays onward past the people you can see. Think twice before pinning where you live or where you are sleeping.
Location is read only while the app is open and only for the two purposes above. There is no background location tracking and no location history.
7. Photos and camera
The camera is used to scan verification and group QR codes, and to take a photo for a post. The photo library is read only for the single image you pick — your library is never scanned, indexed, or uploaded.
Images attached to posts are shrunk on your phone to a 32-pixel thumbnail of a couple of kilobytes before they are broadcast. That is small enough to be deliberate rather than merely economical: a photo at that size carries the gist — a stage, a sunset, a crowd — and cannot carry identity. A face inside a 32-pixel image is under ten pixels across, which is below what people can recognise even for someone they know, and text and faces in the background go with it.
The original full-resolution photo never leaves your device, and the reduction happens before the post is signed, so no sharper version exists anywhere on the mesh. The app also refuses to display more detail than that even if a modified app sent a sharper image. Once broadcast, the thumbnail is public content and section 5 applies to it.
8. Permissions and why each is needed
- Bluetooth
- Required. This is the network. The app both advertises and scans so that nearby phones can find each other and relay messages.
- Location
- Required on Android for Bluetooth scanning; optional elsewhere and used only when you pin a spot or request a bearing. See section 6.
- Camera
- Optional. Scanning QR codes for in-person verification and joining groups, and taking photos for posts.
- Photo library
- Optional. Only the single image you select for a post is read.
- Face ID / biometrics
- Optional. Unlocks your identity key locally so nobody else can post or chat as you. Biometric data is handled entirely by the operating system and is never seen by the app.
- Notifications
- Optional. Notifications are written on your device. With internet backup on, the app also receives silent push messages through Apple or Google to wake it when a friend's message is waiting. Their contents are sealed, and the text you see is generated by the app on your phone.
9. Encryption
- Direct messages and waves use the Noise XX handshake to establish a session between two devices, so only the two of you can read them.
- Group posts are sealed with a ChaCha20-Poly1305 key shared with the group, so only members can read them.
- Every message is signed with the sender's Ed25519 key, so a relaying phone cannot alter content in transit without invalidating it.
- Public feed posts are signed but not encrypted, since the whole mesh must be able to read and relay them.
- Internet backup carries the same Noise-encrypted direct messages. The relay forwards sealed bytes it cannot open.
The app shows safety words for each conversation. If you and the other person read them aloud and they match, no one is sitting in the middle of your conversation. We cannot read your encrypted messages under any circumstances, and there is no mechanism by which we could be compelled to: we hold no keys, and the relay only ever handles sealed messages.
10. How long things last
Content in the mesh carries a time-to-live and expires on its own, typically within about six hours, on every device holding it. This is enforced by the app rather than by a policy promise.
Your own local data — your key, your handle, your block list, your conversations — persists on your device until you delete it or delete the app.
Without internet backup we retain nothing, because we receive nothing. With it, the relay keeps the records in section 4 for these periods:
- Your route record (public key, route ID, push token): deleted as soon as you turn internet backup off. Otherwise deleted automatically within a day once 90 days have passed since your phone last verified it, which it does on its own while you use the app.
- Friend permissions: until they expire, or with your route record if that goes first.
- Delivery bookkeeping: until the next delivery under the same permission replaces it.
- Request logs: 30 days.
If you email us, we keep that email and any information in it for as long as needed to deal with your request, and to keep a record of abuse reports and their outcomes.
11. Your controls
- Block. Blocking someone hides their content immediately, removes them from your radar and people lists, refuses everything their device sends you, and stops your phone from relaying anything of theirs onward. It takes effect at once and does not need a network.
- Report. You can report content or a person to us from inside the app. See the support page for how reports work and what we can and cannot do about them.
- Go quiet. Turning off Bluetooth, or closing the app, stops all broadcasting immediately.
- Turn off internet backup ("Stay connected when apart") in your profile at any time. The relay then deletes its record for your phone: route, push token and friend permissions. You can also turn it off for one friend on their card, which withdraws their permission to reach you. Bluetooth keeps working either way.
- Change your handle at any time in your profile.
- Delete everything by deleting the app. There is no account to close. If you used internet backup, turn it off first so the relay's record is deleted at once. Otherwise it is deleted automatically about 90 days after your phone last used it, or sooner if you email us.
12. Children
Offing is rated 13+ and is not directed at children under 13. We do not knowingly permit under-13s to use it. Because there are no accounts and we collect no identifying data, we cannot identify a user's age, and we ask parents and guardians to use the parental controls built into iOS and Android to manage access.
The app puts you in contact with strangers physically near you and hosts unmoderated content created by other users. Please read the Terms of Service for what is and is not allowed, and the support page for how to report abuse.
13. Your legal rights
Under the GDPR, the UK GDPR, the CCPA/CPRA and comparable laws, you have rights to access, correct, delete, and port your personal data, and to object to its processing.
Without internet backup, these rights are satisfied structurally rather than procedurally: we hold no personal data about you, so there is nothing to access, correct, export, or erase. All of your data is already in your sole possession on your own device, where you can inspect or destroy it at any time without asking us. If you use internet backup, the relay holds the pseudonymous records in section 4. Email us to access or delete them. Because they are keyed to your public key rather than a name, we may ask you to show that the key is yours.
We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not engage in cross-context behavioural advertising. If you email us, we will hold that correspondence, and you may ask us to delete it at support@offing.xyz.
14. Changes to this policy
If we change this policy we will update the date at the top of the page. Earlier versions promised that any internet-connected feature would be described here before it shipped and would be something you turn on deliberately rather than something enabled by default. Internet backup (section 4) keeps that promise: it is described here ahead of the version that adds it, and it is off until you turn it on. Any future internet feature will follow the same rule.
15. Contact
Questions about privacy, or anything else: support@offing.xyz. We aim to reply within two business days, and within 24 hours for reports of abuse or objectionable content.