Privacy Policy
Offing runs on a Bluetooth mesh between phones. There is no Offing server, no Offing account, and no Offing database. We do not collect your personal data — not because we promise not to, but because the app has nowhere to send it and no way to identify you.
The short version
- We collect nothing. No analytics, no crash reporting, no advertising identifiers, no tracking of any kind.
- You do not create an account. No email, no phone number, no password, no social login.
- Everything the app stores lives in a database on your own phone and is deleted when you delete the app.
- The people this app does share information with are other users physically near you — that is the entire point of it, and section 4 spells out exactly what they receive.
1. Who we are
Offing is a free, non-commercial project built and operated by Nikhil Kishore, an individual developer based in Pennsylvania, United States ("Offing", "we", "us"). For anything in this policy, reach us at support@offing.xyz.
Because we operate no servers and hold no user data, we are in the unusual position of being a data controller with no personal data to control. Where this policy describes information being shared, that sharing happens directly between users' phones over Bluetooth, and we are not a party to it.
2. What we collect: nothing
The Offing app contains:
- No analytics or telemetry. The app has no networking library and makes no HTTP requests. There is no Firebase Analytics, no Google Analytics, no Amplitude, no Mixpanel, no equivalent.
- No crash reporting service. Crashes are reported only through the operating system's own mechanism, which you control in your device settings, and which is subject to Apple's or Google's privacy policy rather than ours.
- No advertising. No ad SDKs, no advertising identifier (IDFA / AAID) access, no ad network, no tracking pixels.
- No third-party SDKs that transmit data off your device.
- No cookies in the app. This website uses none either — no analytics, no trackers, no consent banner needed.
We do not sell, rent, share, or broker personal information. We have no personal information to sell.
3. What stays on your device
The app stores the following locally, in a database only the app can read, plus your device's secure keystore. None of it is transmitted to us.
- Your identity key
- An Ed25519 keypair generated on your phone the first time you open the app. It is your identity — there is no account behind it. The private key is held in the iOS Keychain / Android Keystore and never leaves the device.
- Your handle and profile
- The handle you choose, plus any status text and vibe tags you set. Stored locally and broadcast to people near you (see section 4).
- Posts and messages
- Content you create, and content received from people in range, held until it expires. See section 9.
- Contacts, blocks and verifications
- Who you have blocked, who you have verified in person by QR scan, and any private nicknames you set. This list is local to your phone and is never shared or broadcast.
- Session keys
- Cryptographic keys for encrypted conversations and groups you have joined.
Deleting the app deletes all of it. There is no cloud copy and no account to close, so there is nothing left behind for us to hold. On iOS the app takes an extra step for this: the system keychain is not removed when an app is deleted, so Offing detects a reinstall and clears the previous install's key itself rather than silently resurrecting your old identity.
4. What other people nearby can see
This is the section that actually matters. Offing works by broadcasting over Bluetooth to phones within radio range — typically tens of metres. Treat anything below as public to strangers around you.
Broadcast to everyone in Bluetooth range
- Your handle and avatar initials.
- Your status text and vibe tags, if you set them.
- Your public key, which is how other phones address messages to you.
- A rough sense of how close you are, derived from Bluetooth signal strength. This is a coarse band — "right here", "in range" — not a distance in metres and not a direction.
- Any post, photo, poll, story or reply you publish to the public feed. These relay onward from phone to phone, so they can travel beyond the people you can see.
Public posts are public. They are signed by your key and readable by anyone running the app within the mesh. They are not encrypted, because every phone in the chain has to be able to carry and display them.
Direct messages, waves and group posts are encrypted so that only the intended recipient or group can read them. Phones that relay them along the way carry sealed bytes they cannot open. See section 8.
You cannot recall a broadcast. Once something has left your phone and been relayed, copies exist on other people's devices until they expire there. Blocking someone afterwards stops your phone from carrying their content; it does not reach back and remove yours from theirs.
Handles are self-chosen and unverified by default. Anyone can claim any handle. The in-app QR verification and the safety-word check exist precisely because a name alone proves nothing.
5. Location
Offing does not track your location, does not log where you have been, and does not send your location to us — we have no server to send it to.
Location is used in exactly two ways:
- Bluetooth scanning. Android requires location permission for any app that scans for nearby Bluetooth devices, because Bluetooth scanning can in principle be used to infer position. We request it for this reason. We do not read your coordinates for scanning.
- Pinning a spot. If you choose to attach a location to a post, or ask the app for a bearing to someone else's pin, the app reads your coordinates at that moment.
Pinned locations are public, and rounded off
A pin on a public post is snapped to roughly a 100-metre grid before it is sent. That is enough to walk to a spot in a field, and not enough to say which tent, doorway or room. The precise coordinates never leave your phone — the rounding happens before the post is signed, so there is no exact version of it anywhere on the mesh.
A pin in a group keeps its full precision, because a group is people who scanned your QR code to get in rather than every stranger in radio range.
Rounded or not, a public pin still points at an area you are in, and the post relays onward past the people you can see. Think twice before pinning where you live or where you are sleeping.
Location is read only while the app is open and only for the two purposes above. There is no background location tracking and no location history.
6. Photos and camera
The camera is used to scan verification and group QR codes, and to take a photo for a post. The photo library is read only for the single image you pick — your library is never scanned, indexed, or uploaded.
Images attached to posts are shrunk on your phone to a 32-pixel thumbnail of a couple of kilobytes before they are broadcast. That is small enough to be deliberate rather than merely economical: a photo at that size carries the gist — a stage, a sunset, a crowd — and cannot carry identity. A face inside a 32-pixel image is under ten pixels across, which is below what people can recognise even for someone they know, and text and faces in the background go with it.
The original full-resolution photo never leaves your device, and the reduction happens before the post is signed, so no sharper version exists anywhere on the mesh. The app also refuses to display more detail than that even if a modified app sent a sharper image. Once broadcast, the thumbnail is public content and section 4 applies to it.
7. Permissions and why each is needed
- Bluetooth
- Required. This is the network. The app both advertises and scans so that nearby phones can find each other and relay messages.
- Location
- Required on Android for Bluetooth scanning; optional elsewhere and used only when you pin a spot or request a bearing. See section 5.
- Camera
- Optional. Scanning QR codes for in-person verification and joining groups, and taking photos for posts.
- Photo library
- Optional. Only the single image you select for a post is read.
- Face ID / biometrics
- Optional. Unlocks your identity key locally so nobody else can post or chat as you. Biometric data is handled entirely by the operating system and is never seen by the app.
- Notifications
- Optional. Local notifications only, generated on your device. There are no push servers and no remote push notifications.
8. Encryption
- Direct messages and waves use the Noise XX handshake to establish a session between two devices, so only the two of you can read them.
- Group posts are sealed with a ChaCha20-Poly1305 key shared with the group, so only members can read them.
- Every message is signed with the sender's Ed25519 key, so a relaying phone cannot alter content in transit without invalidating it.
- Public feed posts are signed but not encrypted, since the whole mesh must be able to read and relay them.
The app shows safety words for each conversation. If you and the other person read them aloud and they match, no one is sitting in the middle of your conversation. We cannot read your encrypted messages under any circumstances, and there is no mechanism by which we could be compelled to — we hold no keys and operate no servers.
9. How long things last
Content in the mesh carries a time-to-live and expires on its own, typically within about six hours, on every device holding it. This is enforced by the app rather than by a policy promise.
Your own local data — your key, your handle, your block list, your conversations — persists on your device until you delete it or delete the app.
We retain nothing, because we receive nothing. If you email us, we keep that email and any information in it for as long as needed to deal with your request, and to keep a record of abuse reports and their outcomes.
10. Your controls
- Block. Blocking someone hides their content immediately, removes them from your radar and people lists, refuses everything their device sends you, and stops your phone from relaying anything of theirs onward. It takes effect at once and does not need a network.
- Report. You can report content or a person to us from inside the app. See the support page for how reports work and what we can and cannot do about them.
- Go quiet. Turning off Bluetooth, or closing the app, stops all broadcasting immediately.
- Change your handle at any time in your profile.
- Delete everything by deleting the app. There is no account to close and no server-side copy to request the deletion of.
11. Children
Offing is rated 13+ and is not directed at children under 13. We do not knowingly permit under-13s to use it. Because we hold no accounts and collect no data, we cannot identify a user's age, and we ask parents and guardians to use the parental controls built into iOS and Android to manage access.
The app puts you in contact with strangers physically near you and hosts unmoderated content created by other users. Please read the Terms of Service for what is and is not allowed, and the support page for how to report abuse.
12. Your legal rights
Under the GDPR, the UK GDPR, the CCPA/CPRA and comparable laws, you have rights to access, correct, delete, and port your personal data, and to object to its processing.
In our case these rights are satisfied structurally rather than procedurally: we hold no personal data about you, so there is nothing to access, correct, export, or erase. All of your data is already in your sole possession on your own device, where you can inspect or destroy it at any time without asking us.
We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not engage in cross-context behavioural advertising. If you email us, we will hold that correspondence, and you may ask us to delete it at support@offing.xyz.
13. Changes to this policy
If we change this policy we will update the date at the top of the page. If a future version of the app ever introduces an optional internet-connected feature, we will describe exactly what it sends and make it something you turn on deliberately rather than something enabled by default — and this policy will say so before that version ships.
14. Contact
Questions about privacy, or anything else: support@offing.xyz. We aim to reply within two business days, and within 24 hours for reports of abuse or objectionable content.