{"format":"markdown","content":"# Free Navi — Privacy Policy\n\n**Effective Date:** January 1, 2026\n**Last Updated:** July 3, 2026 (updated to reflect end-to-end DM encryption, image bytes E2E, Reports feature with plaintext consent, admin audit log, and federation)\n\n---\n\n## Our Commitment\n\nFree Navi is built on a simple principle: **your data belongs to you.** We collect only what is necessary to operate the Service, we never sell your personal data, and we give you full control over your privacy settings. Where cryptography allows us to remove ourselves from the trust chain (as with end-to-end encrypted direct messages), we do.\n\n---\n\n## 1. Information We Collect\n\n### 1.1 Information You Provide\n| Data | Purpose | Stored |\n|------|---------|--------|\n| Email address | Account creation, magic-link sign-in, notifications | Plaintext (used for auth); TLS in transit |\n| Username & display name | Profile identity | Plaintext; readable by platform operators |\n| Profile info (bio, location, website, avatar) | Public profile | Per your privacy settings; readable by platform operators |\n| Avatar images | Profile picture | JPEG on disk; EXIF (including GPS) is stripped before storage |\n| Posts and comments | Social features (feed, groups) | Readable by platform operators; visibility to *other users* is gated by Privacy Squares |\n| Group messages and posts | Group features | Readable by platform operators; group membership is the access boundary |\n| **Direct message text** | Private messaging | **End-to-end encrypted** (ECDH P-256 + AES-GCM) — server stores only ciphertext, operators cannot read plaintext |\n| **DM image attachments** | Private messaging | **End-to-end encrypted bytes** — server stores opaque `.bin` files, operators cannot view the images |\n| Public keys (E2E) | DM encryption | Your ECDH public key is stored on the server so peers can encrypt to you; your private key never leaves your device |\n| Payment information | Subscription billing | Processed by Stripe — we never see or store full card numbers |\n\n### 1.2 Information Collected Automatically\n| Data | Purpose | Retention |\n|------|---------|-----------|\n| IP address | Rate limiting, abuse prevention | Hashed; retained 30 days |\n| Device identifier | Multi-device session management | Retained until logout |\n| Timestamps (login, last seen) | Service operation | Retained with account |\n| Subscription tier & billing events | Billing | Retained per tax law requirements |\n\n### 1.3 Information We Do **NOT** Collect\n- We do **not** track you across other websites\n- We do **not** build advertising profiles\n- We do **not** sell or share data with data brokers\n- We do **not** use your content to train AI models without explicit opt-in\n- We do **not** read your end-to-end encrypted direct messages (we cryptographically cannot — see Section 4)\n- We do **not** proactively scan your DMs for any purpose\n\n### 1.4 What Happens When You File a Report\n\nWhen you use the in-app Report feature to flag another user or content:\n\n- The reported user's identity, the category you selected, your description, and any evidence you attach are stored in our systems and readable by platform operators.\n- **For end-to-end encrypted direct messages**, your client decrypts the last messages of your conversation on your device before sending them to us. **This is your voluntary disclosure** — filing a report removes end-to-end encryption for that specific content, so operators can review it. **You are consenting to that plaintext disclosure by clicking Send report.**\n- Reports and their evidence are retained even after resolution. They may be referenced in future moderation decisions and produced to law enforcement when legally required.\n- The reported user is not notified that a report was filed against them until (and unless) an enforcement action is taken.\n\n### 1.5 Admin Audit Log\n\nEvery action taken by a platform operator through the internal admin console — viewing a user's account, sending a warning, restricting, banning, dismissing a report, escalating a report — is recorded in an immutable audit log with the operator's identity, target, timestamp, and written reason.\n\n- The audit log is not user-facing but exists so that if you ever ask \"why did you take this action against me,\" we have a definitive answer.\n- Entries are write-once — never edited or deleted.\n- The audit log itself is not disclosed publicly. It may be produced to law enforcement under valid legal process, or in your own account export upon request.\n\n## 2. How We Use Your Information\n\nWe use your information **only** for:\n\n1. **Operating the Service** — authentication, delivering messages, displaying profiles\n2. **Security** — rate limiting, abuse detection, fraud prevention\n3. **Billing** — processing payments via Stripe, sending receipts\n4. **Communication** — service announcements, security alerts (you can opt out of non-essential emails)\n5. **Improving the Service** — anonymous, aggregated usage statistics\n\n## 3. Data Sharing\n\nWe share your data **only** in these limited circumstances:\n\n| Recipient | Data Shared | Why |\n|-----------|-------------|-----|\n| **Stripe** | Email, subscription tier | Payment processing (subject to Stripe's privacy policy) |\n| **AI Providers** (if you use AI features) | Your prompts | AI response generation (not stored by us after delivery) |\n| **NCMEC** (National Center for Missing & Exploited Children) | Suspected CSAM content and associated account information | **Required by U.S. federal law** (18 U.S.C. §2258A). We report suspected CSAM within the mandatory window. |\n| **Law enforcement** | Account info, audit log entries, non-E2E content, and E2E content only if plaintext was voluntarily disclosed to us via a report | Only with valid legal process (subpoena, court order, or search warrant), or in emergencies where a threat to life is imminent |\n| **Peer instances** (if federation is enabled) | Your username, display name, avatar URL, and public profile fields | For cross-instance user discovery (e.g., resolving `@alice@peer.example.com`). Direct messages and private content are never federated. |\n| **You** | All your data | Via data export (see Section 7) |\n\n**We never sell your personal data. Period.**\n\n## 4. Data Security\n\nWe implement industry-standard security measures:\n\n- **Passwords:** Argon2id hashing (never stored in plaintext)\n- **Sign-in tokens:** SHA-256 hashed before storage; magic-link tokens have short expiration windows\n- **Transport:** TLS 1.2+ required for all connections\n- **Headers:** Security headers on all responses (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)\n- **Rate limiting:** Per-endpoint rate limits to prevent abuse\n- **Access control:** Subscription tier enforcement on protected endpoints; admin console gated by a single environment-configured operator identity\n- **Infrastructure:** Database encryption at rest via managed PostgreSQL\n\n### 4.1 End-to-End Encryption for Direct Messages\n\n- Each device generates an ECDH P-256 keypair on first use. **The private key stays in browser localStorage and never leaves your device.**\n- When you send a DM, your client derives a shared AES-GCM-256 key by ECDH with the recipient's public key, encrypts the message text (and image bytes, if attached) locally, and uploads only the ciphertext.\n- The server stores the ciphertext. It cannot decrypt it. **Even a full server breach or a subpoena to the operator cannot expose the plaintext of your DMs.**\n\n**Trade-offs you should know about:**\n- **Losing your device's private key** (e.g., by clearing site data) makes previously-received encrypted messages permanently unrecoverable on that device. There is no key-escrow, no backup, no operator-side recovery.\n- **First message before your peer sets up encryption**: if your peer has never signed in on a device that supports Web Crypto (extremely rare), their public key won't be on the server, and your client will fall back to a plaintext send with a warning.\n- **Not currently implemented**: forward secrecy (Double Ratchet), multi-device key synchronization, and cryptographic message franking. These are on the roadmap.\n- **Reporting removes E2E for the reported content**: see Section 1.4.\n\n## 5. Data Retention\n\n| Data Type | Retention Period |\n|-----------|-----------------|\n| Account data | Until you delete your account |\n| Posts and comments | Until you delete them or your account |\n| **End-to-end encrypted DMs** | Retained (as ciphertext) until you or your peer deletes the message or conversation. **Because they are E2E encrypted, the operator cannot read them at any point during retention.** |\n| Encrypted DM image attachments | Retained (as opaque `.bin` files) until the referencing message is deleted or the account is deleted. |\n| Avatar and post images | Retained (as JPEG/PNG/WebP with EXIF stripped) until the referencing record is deleted or the account is deleted. |\n| Reports and their evidence | Retained indefinitely for accountability and pattern detection, even after the report is resolved. |\n| Admin audit log | Retained indefinitely. Immutable — entries are never edited or deleted. |\n| Federation peer registry | Retained as long as the peer relationship is active; removed on disconnection. |\n| Auth tokens | 30 days or until logout |\n| IP addresses (hashed) | 30 days |\n| Billing records | As required by tax law (typically 7 years) |\n| Backups | 30 days after deletion |\n\n## 6. Your Privacy Controls\n\nNavigator gives you granular privacy controls:\n\n- **Profile visibility:** Public, Friends Only, or Private\n- **Post visibility:** Per-post privacy (public, friends, private)\n- **Online status:** Show or hide your online status\n- **Friend list:** Public or private\n- **Message encryption:** Optional end-to-end encryption\n- **Data export:** Download all your data at any time\n- **Account deletion:** Permanently delete your account and all associated data\n\n## 7. Your Rights\n\nDepending on your jurisdiction, you may have the right to:\n\n- **Access** your personal data\n- **Correct** inaccurate data\n- **Delete** your data (\"right to be forgotten\")\n- **Export** your data in a portable format\n- **Restrict** processing of your data\n- **Object** to processing of your data\n- **Withdraw consent** at any time\n\nTo exercise these rights, contact us at privacy@navigator.app or use the in-app privacy controls.\n\n### GDPR (EU/EEA Users)\nWe process your data under the following legal bases:\n- **Contract performance** (Art. 6(1)(b)) — operating your account\n- **Legitimate interest** (Art. 6(1)(f)) — security, abuse prevention\n- **Consent** (Art. 6(1)(a)) — optional features like AI interactions\n- **Legal obligation** (Art. 6(1)(c)) — tax and billing records\n\n### CCPA (California Users)\n- You have the right to know what data we collect and why.\n- You have the right to delete your data.\n- You have the right to opt out of the \"sale\" of your data — **we don't sell your data, so there's nothing to opt out of.**\n- We will not discriminate against you for exercising your rights.\n\n## 8. Children's Privacy\n\n- The Service is not intended for children under 13 (or the minimum age in your jurisdiction).\n- We do not knowingly collect data from children.\n- If you believe a child has provided data to us, contact us and we will delete it.\n\n## 9. Cookies & Tracking\n\n- We use **only essential cookies** for authentication and session management.\n- We do **not** use advertising cookies or third-party trackers.\n- We do **not** use analytics services that track individual users.\n\n## 10. International Data Transfers\n\nIf you access the Service from outside our hosting region, your data may be transferred internationally. We ensure appropriate safeguards (Standard Contractual Clauses or equivalent) are in place.\n\n## 11. Changes to This Policy\n\nWe may update this Privacy Policy from time to time. We will:\n- Notify you via email or in-app notification of material changes\n- Provide at least 14 days' notice before changes take effect\n- Keep previous versions available for review\n\n## 12. Contact Us\n\nFor privacy questions or data requests:\n\n- **Email:** privacy@freenavi.app\n- **Website:** https://freenavi.app/\n- **Data Protection Officer:** dpo@freenavi.app\n\n---\n\n*Free Navi — Your Data, Your Choice.*\n"}