Your data belongs to you. Full stop.

An earlier version of this page filed the microphone under things we never touch. That was wrong the day voice notes shipped, and wronger the day calls did. The accurate version is still a short one.

Wack Message opens the microphone in exactly two places: while you hold the record button on a voice note, and for the length of a 1:1 call. wack.dev opens it in one — a 1:1 call. Nothing opens it in the background, nothing holds it open afterwards, and no path reaches it without a deliberate press from you first.

The camera starts every call switched off. Turning it on is a separate, per-call tap; until you take it, the other person is looking at your avatar.

Calls are 1:1 and peer-to-peer. Audio and video travel browser to browser over WebRTC and are encrypted in transit. When a direct path can't be negotiated, the still-encrypted stream is relayed by Cloudflare's TURN service. We do not record calls, and no call audio or video passes through a Wack server. We keep the dull part — who called whom, when, how long it lasted, how it ended, and whether the connection was direct or relayed — so your call history and missed-call badges work.

A voice note is a different thing: it's a file you chose to record and send. It's stored and delivered like any other attachment, behind the same access rules as the thread it lives in.

Attachments are served from a CDN, and a CDN link is public by nature — anyone holding it can fetch the file. A photo or a clip straight off a phone carries far more than the picture: the coordinates it was shot at, the camera and its serial number, the date, sometimes a thumbnail of a different moment. None of it shows up anywhere in the app, and all of it used to survive the upload.

It doesn't now. Your browser rewrites the file before it is sent: EXIF, XMP, and IPTC out of JPEG, PNG, WebP, and GIF; the user-data and metadata atoms — QuickTime's GPS box among them — out of MP4, MOV, and M4A; tag and attachment elements out of WebM; the comment list out of an Ogg voice note; ID3 and APE blocks off MP3 and AAC. The picture and the sound are copied across byte for byte, so nothing is re-encoded and nothing looks or sounds worse for it.

The part that matters more than the list is what happens when the rewrite can't be trusted. A container we don't recognise, a fragmented MP4, a structure we can't walk exactly — those are refused, with an error, and the file is not uploaded at all. There is no quieter path where a file we couldn't read goes up as it came.

This is recent, and it is not retroactive. Anything uploaded before it shipped went up as it came off the camera and is still on the CDN in that state. Deleting your account deletes your uploaded files along with it.

Push is off until you switch it on, once per device. Switching it on registers a single subscription for that device — a browser push endpoint, or an Apple push token inside the installed app. Switching it off deletes it.

The body of a notification is composed on our server from two things: the type of the notification and the sender's display name. The message itself is never read into it. The most a lock screen ever shows for a new message is a name followed by “sent you a message.” — the same sentence whether the message is one word or a thousand.

For public posts Wack publishes through the AT Protocol, our server periodically asks the public Bluesky AppView for the post thread, likes, and reposts. This does not require access to your connected account or any additional OAuth permission.

We keep a separate server-only snapshot of public actor DIDs, handles, display names, avatars, reply text, interaction types, timestamps, engagement counts, and moderation labels. It is not written into Wack posts, likes, profiles, circles, or private messages. We hide labeled or unavailable results by default and purge the interaction snapshot when the source post is withdrawn or no longer public.

None of this happens in the messaging app. It publishes no records to the AT network and reads none back.

A new managed Wack signup creates a portable account on Wack's managed PDS behind the Wack interface. Publishing public posts to AT remains a separate activation. Members who connect an external AT identity use that provider's PDS, and public AT features may also contact identity, relay, and AppView services.

The public AT network is not one Wack service provider. Independent apps, PDS hosts, relays, crawlers, search engines, and other services may receive or copy records you publish publicly and apply their own terms and retention rules.

Wack data is kept while an account or feature needs it, subject to security, fraud, legal, and backup-retention needs. Leaving Nearby deletes the saved location row. Public AT activity snapshots are removed when their source Wack post is withdrawn or stops being public. Provider logs and encrypted backups follow settings that differ by service. Wack is documenting those periods for the public beta; ask hello@wack.dev for the current setting, or for an export or deletion request.

No advertising pixels, fingerprinting, third-party ad cookies, or cross-site dossiers. wack.dev uses narrowly scoped crash reporting and aggregate performance telemetry to stay reliable; the messaging app uses neither, and neither is ever used for ads. We make money from software, not your attention.