Privacy Policy

At signup: your chosen username (public), display name, a password (we store only a strong one-way hash of it — never the password itself, never in a log), a recovery email, a phone number where verification requires one, your date of birth (checked once at signup to confirm your age, then discarded: we keep only whether you’re 18 or older and, if you’re not, the month you turn 18), and your country, confirmed from your signup IP.

When you accept our Terms, Privacy Policy and Acceptable Use Policy, for your account or a product: which versions you accepted, and when. We keep this for as long as your account exists.

If you add a passkey: its public key, device type (hardware key, device-bound, or synced), and the label you give it — never anything that could reconstruct the private key, which never leaves your device.

LIECOSYS Email is not live yet, so no mail is sent or received through your reserved address. If you activate LIECOSYS Email once it launches: your reserved @liecosys.xyz address and the messages you send and receive through it, plus a system-generated mail credential — encrypted at rest, and never the same as your account password — used only to connect that mailbox.

If you use LIECOSYS Messaging: your reachability preference (who can send you a request — anyone by username, or contact code only), the contact requests you send or receive and their status, and your contacts. Your messages are end-to-end encrypted on your device before they are sent, with keys that exist only on the devices in the conversation, so we cannot read them. What we hold is: the encrypted messages, padded so their length is hidden and stored with no record of which account or device sent them, along with the conversation each belongs to and when it arrived; for each message, which device it is waiting for and when it was delivered and read; your Messaging device’s label and public keys, including a small supply of one-time public keys that let a contact start an encrypted conversation with you; and short-lived connection records that are deleted within minutes. We also store an encrypted copy of your message history, which we cannot read, so that your other Messaging device can load it. It is deleted when your account is permanently deleted. The encrypted messages stay stored until both people in the conversation have deleted their accounts. If you verify a contact’s security code, we also store an encrypted list of the contacts you’ve verified, which we cannot read, so your other devices know it too. It is deleted when your account is permanently deleted. If you report a message: the message you report and up to 10 messages around it, each with proof of who really sent it, plus the reason you pick and any note you add. These leave your device only when you choose to report, and we store them encrypted. The person you report is never told who reported them.

If you use LIECOSYS Notes: only encrypted ciphertext — your note content is encrypted on your device before it is ever sent to us, with a key we never receive, so we cannot read it. What we do hold is the ciphertext itself, a per-device wrapped copy of your encryption key (which we also cannot unwrap), your device public keys and the labels you give them, and an aggregate byte count of how much encrypted storage you are using. When a note is open on more than one of your devices, edits travel between them through our servers still encrypted, and we keep only short-lived connection records that are deleted within minutes.

If you use LIECOSYS Drive: only encrypted ciphertext — your file content is encrypted on your device before it is ever sent to us, with a key we never receive, so we cannot read it. What we do hold is the ciphertext itself, a per-device wrapped copy of your encryption key (which we also cannot unwrap), your device public keys and the labels you give them, and an aggregate byte count of how much encrypted storage you are using.

LIECOSYS Photos is paused. If you used it before the pause, we still hold only encrypted ciphertext — your photo and video content is encrypted on your device before it is ever sent to us, with a key we never receive, so we cannot read it. What we do hold is the ciphertext itself, a per-device wrapped copy of your encryption key (which we also cannot unwrap), your device public keys and the labels you give them, and an aggregate byte count of how much encrypted storage you are using, shared with LIECOSYS Drive.

If you install a LIECOSYS app on a phone or computer (currently LIECOSYS Photos for Android): the app counts installs. On first launch it creates a random install ID on the device, not linked to your account, and at most once a week it sends that ID with the app’s name, the app version and the operating system version. We store only a one-way hash of the ID and the weeks it was first and last seen, never your IP address or anything else about the device; your IP address is used only to limit abuse, for about a minute. An install that stops checking in is deleted after 120 days. Only the running total of installs is kept, and a rounded-down figure may be shown publicly. You can turn this off in the app’s settings, which also deletes that install’s record.

If you’re part of an organization account: the organization’s name, its member list, and your role within it (owner, admin, or member), tracked the same way individual account activity is.

If you authorize a third-party app through Sign in with LIECOSYS: only the data that app’s specific, granted scope requests — at minimum your username and email — is shared directly with that app, and never anything beyond what you explicitly approved at the authorization prompt.

If you or your organization pays for a paid feature — LIECOSYS Organizations, a Sign in with LIECOSYS integration, a LIECOSYS Notes storage upgrade, or a LIECOSYS Drive storage upgrade (shared with LIECOSYS Photos): our payment processor collects your billing details, including your card information, directly — LIECOSYS itself never sees or stores your full card number. We receive and keep only the minimum billing record needed to administer the subscription: plan, amount, timestamp, and a processor-issued transaction reference.

If your organization applies for organization verification: the legal entity name, registration number, and tax ID you submit, plus the supporting document you upload as proof. That document is stored in a private, access-restricted location, used only to review the application, and is never public.

During use: login timestamps and the IP address of each session, kept as a security log.

When you visit liecosys.xyz or our sign-up pages: the page, the site that sent you (its domain only, never the full link), any campaign tags in the link, your country (worked out from your IP address, which isn’t stored), and your device type and operating system. We also count each sign-up step and the errors and slow responses on our servers. None of this carries an identifier or your IP address. If you accept the analytics cookie, a random visit ID links the pages of one visit together, and your browser reports how fast each page loaded and responded and, if a page crashes, the type of error and where in our code it happened, never the error message.

For account security: when you sign up or sign in, and only then, a set of device and browser signals, combined into an internal security profile. They’re never collected on other pages and never across other sites. It lets us recognize when a sign-in looks like it belongs to your usual devices versus something unfamiliar, and helps us detect patterns like one device being used to create many accounts. We don’t publish the exact signals or how they’re combined — that detail is itself a map for working around it; see why. This is real profiling of security-relevant device behavior, and we are not going to pretend otherwise — but it stays internal to LIECOSYS. It is used only for account security, abuse prevention, and multi-account detection, is never sold, and is never made available to any advertiser, data broker, or other outside party.

For abuse prevention when you sign up, sign in, or do something that reaches other people — sending a contact request, inviting someone, sharing, creating an organization, changing your username: we check whether your IP address is on public lists of Tor exit nodes, VPNs and datacenters. Those lists are copied onto our own servers, so your IP address is never sent to anyone else to be checked. Your browser also counts a few coarse things about how the sign-up and sign-in forms were filled in — roughly how long it took, how many keys were pressed, how many pastes, whether autofill was used, and how even the typing rhythm was — as rounded numbers. It never records which keys you pressed or anything you typed. Together with how soon after signing up an action happens, these add up to a risk score. We keep only the score and short reason codes, encrypted, and delete them after 30 days. A higher score can mean an extra verification check, a cap on how often you can do those things for a few days, or a pause on them until a person reviews the account. Using a VPN or Tor never stops you from signing up, signing in, or reading your data.

If you send a copyright notice: your name and email address, stored encrypted, plus the link you reported, the description of your work and the two statements you confirmed. We never give your name or email to the account owner. If a copyright notice names one of your links: which link it was, the decision, and any counter-notice you send. Your counter-notice is forwarded to the person who complained, without your name or username. See the Copyright Policy.

If you send feedback or report an account: what you write, the page or username it’s about, and an email address if you choose to give one, stored encrypted. We don’t store your IP address with it.

Your data is used to run your account: authenticate you, secure your sessions, verify you’re old enough to hold an account, detect abuse, and send you security-relevant notices such as repeated failed sign-in attempts on your account.

We count visits to our public website and sign-up pages to learn where visitors come from, how many go on to create an account, and whether pages load quickly and work. Random statistical noise is added to every count before we see it (a technique called differential privacy), and small counts are dropped, so no single visitor can be picked out of what we look at. We don’t measure what you do inside LIECOSYS apps.

Every use of your data has a legal reason behind it.

To give you what you signed up for: your account, sign-in, storage, Messaging and any paid feature. We need this data to provide the service under our Terms.

To protect accounts and stop abuse: security logs, device signals, risk scores and abuse checks. Keeping LIECOSYS and the people on it safe is a legitimate interest, and we only use what that purpose needs. You can object at privacy@liecosys.xyz, and we’ll weigh your objection against the safety reasons in your case.

To meet legal obligations: billing and tax records, and responses to binding court orders.

Website counts with no identifier: a legitimate interest in knowing whether the site works, with noise added so no one can be picked out.

The analytics cookie and what it links: your consent, which you can withdraw at any time from Cookie preferences.

We never store your password in plaintext, never store continuous precise location, never track your general browsing history outside LIECOSYS, and never sell your data or share it with advertisers — not in any country, not under any circumstance. That includes the device and security signals described above: we collect them to protect accounts, not to build a marketing profile, and no outside party — advertiser, data broker, or otherwise — ever gets access to them.

Every government or legal request for user data starts from refusal. No request is ever approved automatically, or by standing policy — every request is reviewed personally, and there is no delegated or automated approval path, ever.

There’s one case where we act without being asked: if a report shows child sexual abuse material, or a child in immediate danger, we pass that report to a child-safety hotline and the police ourselves. Nothing else from any report is ever passed on, and every case is counted in our transparency report.

A request is only even considered once its legal basis is unambiguous and verified: a valid, binding court order we have no lawful remaining way to challenge. Even then, disclosure requires an individual, personal sign-off on that specific request — case by case, every time, never a blanket authorization. What’s disclosed is limited to the absolute minimum a court compels.

Every fulfilled request is published in our transparency report. This standard does not change depending on which country is asking — a request from the United States, the European Union, China, or anywhere else is held to the exact same bar.

liecosys.xyz and our account pages set only the cookies they need to work: one to keep you signed in, a few that remember choices like your language, theme and cookie preference, and one that lasts a minute to carry a message from one page to the next. Only with your consent do we add one more: an anonymous visit ID that lasts until you close your browser. It links the pages of a single visit and lets your browser report page speed and crashes. It never identifies you, never follows you to other sites, and is never used to build a profile of you. Declining sets nothing beyond the cookies the site needs to work. You can change your choice at any time from the "Cookie preferences" link in the footer, and withdrawing consent deletes the visit ID.

This choice applies the same way everywhere — LIECOSYS does not ask for consent only where a law requires it and track by default elsewhere.

You have the right to request a copy of your data, correct it, or delete your account. You can export a copy of your profile, recovery contacts, sessions, passkeys, and account activity, or permanently delete your account, at any time from myaccount.liecosys.xyz — no request or waiting period required. To correct your profile or recovery details, use the Profile section of the same dashboard. Deleted accounts enter a 30-day recovery window before anything is permanently removed; your username is released for others to use 90 days after that.

Self-service export doesn’t include your mailbox or organization membership data yet — email privacy@liecosys.xyz if you need a copy of either in the meantime.

For any request about your data (a copy, a correction, deletion, the names of our providers, or a question), write to privacy@liecosys.xyz. We answer within 30 days.

If you think we’ve handled your data wrongly, you can complain to a data protection authority, in whichever country you’re in. You don’t have to contact us first.

Signup IP and per-session IP addresses are kept for 90 days as a security log, then deleted. Audit log entries — login attempts, token issuance, profile changes, session activity — are kept 90 days in active storage and up to 1 year in cold storage for security investigation purposes, then deleted.

Your mailbox — address, messages, and mail credential — is deleted along with your account, following the same 30-day recovery window described in "Your rights." An address that has ever had an active mailbox is never given to another account.

Behavior risk scores and their reason codes are stored encrypted and deleted after 30 days.

Device and browser security signals for a session are kept while it’s active and for 90 days after it ends, then moved to encrypted cold storage and deleted 1 year after the session ended.

Website analytics: raw counts and the pages linked by a visit ID are deleted within 30 days, usually within two. The noised daily figures are kept for 30 days and noised monthly totals for 24 months.

If your account is flagged in an active abuse investigation, relevant data may be held past these windows under legal hold until the investigation concludes.

Billing records for a paid feature are retained as long as required for tax and accounting purposes, then deleted.

When a phone number leaves your account — removed, replaced, or with your account deleted — we keep a keyed fingerprint of it, never the number itself, for 12 months to stop the same number being used to make account after account. Then it’s erased.

Copyright notices: the sender’s name and email are deleted 24 months after the notice is closed, and the rest of the record 36 months after it’s closed.

Feedback and abuse reports: the email address is deleted 12 months after the report is closed (for feedback, 12 months after you send it), and the report itself after 24 months. A report that’s still open is kept until it’s resolved.

Reported messages: deleted as soon as the report is closed. If a report was passed to a child-safety hotline and the police, the messages are kept 90 days after that, and longer only if the police ask in writing. The record of the report itself (who reported whom, when, and the outcome, without the messages) is deleted after 24 months.

The record of each time we look at account information is kept for 1 year.

Our main database, which holds your account and the data our services keep for it, is hosted in South Korea. Encrypted files, such as those from Drive and Photos, and encrypted archives are kept with our object storage provider, which may store them in other countries. Files you upload are encrypted on your device first, so we can’t read them wherever they are.

We use outside providers for these jobs, listed with where each one handles data: hosting and the database (South Korea); object storage for encrypted files (possibly several countries); the edge network that serves our sites and screens out bots (worldwide, nearest to you); email delivery (European Union); payment processing (our merchant of record, based in the United Kingdom); SMS delivery (not live yet); and secrets management (European Union). Each is bound by contract to handle data only to run its part of the service. For the name of any of them, write to privacy@liecosys.xyz.

None of this depends on where you live. Every account is stored and handled the same way.

Because our providers are in more than one country, your data may be handled outside the country you live in. Where a provider is in a country without equivalent data protection law, we rely on contract terms that require it to protect your data to the same standard, such as the European Commission’s standard contractual clauses. The protection you get doesn’t change with where your data travels.

Passwords are never stored — only a strong one-way hash of one. Data is encrypted in transit. LIECOSYS is built to resist both classical and future quantum attacks from launch, not as a later upgrade, because data intercepted today could still be decrypted once quantum computers mature.

No other user can ever reach your data. Your messages, notes, files and photos are encrypted on your device, so not even we can read them, unless someone in a conversation chooses to report a message to us, and then only what they send. Otherwise, the only thing LIECOSYS can look at is basic account information, and only when an account needs help with its security, an abuse report or a legal request. Every time that happens, it’s recorded.

The safety password, its decoy account and Seal protect your data, not your physical safety. They won’t hold up against someone who knows these features exist, examines your device, or compares your account with other records. The Terms of Service explain what that means for you.

This page describes what we protect and what we promise, not the exact mechanism behind it. That’s intentional — see why.

If personal data we hold is exposed in a breach, we’ll tell every affected account within 72 hours of confirming it, by email to the recovery address and inside LIECOSYS. The notice says what was exposed, what we’ve done about it and what you should do. Where the law requires it, we also report the breach to a data protection authority. This applies to every breach, not only the ones the law makes us report.

You must be at least 13 to create a LIECOSYS account. Accounts for people under 18 aren’t open yet: we’re building protections for younger users first. Your age is checked on our servers from the date of birth you enter at signup, which isn’t kept.

If something tells us an account may belong to someone under 18, the account gets the protections for younger users while a person checks, within 72 hours: only people who are already its contacts can message it or share with it, and it can’t make public links. A report sent from inside a Messages conversation starts this straight away. Any other report is looked at by a person first, so it can’t be used to restrict someone on its own. If the holder is an adult, the protections are lifted. If they’re under 18, the account is paused until accounts for younger users open. Nothing in it is deleted, and we tell the holder by email.

For an account made before its holder turned 18, the under-18 protections end in the month they turn 18, and we email them that adult settings are open. Their own privacy settings don’t change unless they change them.

This policy is versioned. Material changes are announced with a new version number before they take effect, and you’re asked to accept them the next time you open a LIECOSYS product.