Privacy Policy

Last updated 3 November 2026

Iskra is built so that as little as possible about you ends up anywhere. This page explains what is stored, where, who can see it, and how to get rid of it.

• 1. Who is responsible
• 2. On your device
• 3. On the servers you join
• 4. DMs, group chats and calls
• 5. Voice and video
• 6. Reports and moderation
• 7. Notifications
• 8. Who Iskra talks to
• 9. The websites
• 10. How long things are kept
• 11. Deleting your data
• 12. Children
• 13. Your rights
• 14. Changes and contact

1. Who is responsible for your data

Iskra isn't one service: it's software that many people run. So who is responsible (the "controller" under the GDPR) depends on where your data is:

• Each server's owner is responsible for the data on their server: your profile there, your messages, files and so on. If you want something from a server, ask its owner. They can see everything on their server that isn't end-to-end encrypted.
• Viktor Lundgren ("From a Spark"), Sweden, is responsible for the websites iskra.foo and app.iskra.foo, and for the servers he runs, such as chat.iskra.foo. Contact: spark@iskra.foo. In this policy, "we" means him.

We make the apps, but we don't receive your chats, your contacts or your usage. The apps don't send anything to us.

2. On your device

• Your account keys are created on your device and never leave it unencrypted. In the desktop app they're protected by your operating system's keychain (Windows DPAPI, macOS Keychain, or GNOME Keyring / KWallet on Linux). In the browser and the phone app they're stored in the browser's storage (IndexedDB), encrypted with a key the browser keeps and never reveals. You can add an app lock on top (My settings → App lock), opened with a passphrase or a passkey. A passkey stays with your device or password manager; Iskra only uses it to unlock your data on that device.
• Your decrypted direct messages and group chats, your settings, and the list of servers you've joined are stored on the device, encrypted in the same way.
• Settings that sync between your devices are stored on your servers end-to-end encrypted, so a server can't read them or see which other servers you're on.
• Your recovery key is shown to you once and whenever you ask for it. Where you keep it is up to you.
• Activity status ("Playing X", desktop app only) is off until you turn it on. Games are recognised on your computer; only the game's name is sent to your servers, never the list of running programs. Streamer mode (hides invite links, account ids and previews on your screen) is a setting of yours that syncs between your devices like other settings; the desktop app's "Turn on by itself" looks only for the programs you listed, on your computer, and sends nothing about them anywhere.
• Noise removal, voice detection, camera background effects and live captions run on your device. No sound, picture or caption text is sent anywhere for processing, and captions are dropped from memory seconds after they're shown. The captions model is downloaded once from the server of the call you're in and kept on your device.
• Share to Iskra on the phone apps: what you share from another app waits in the Iskra app's private storage only until you send or cancel it (on iPhone, a day at most; on Android, until the next share or the app's next start). The last few places you shared to stay listed on that device.
• Clips (the last seconds of a call) are recorded on your device and stay there unless you save or share them. Turning clips on is shown to everyone in the call.
• Catch up summaries are worked out on your device.
• The assistant (bring your own AI) is off until you turn it on. Iskra doesn't provide AI and never sees what you ask: you add a key from an AI provider you choose (or use a model on your own computer), and the key is kept on your device, encrypted like your other secrets. The AI provider you choose sees what you send, only when you send: your question, the conversation so far, and what the assistant reads for it (names, channel lists, recent messages of a channel you can read). It never reads encrypted chats (unless you paste text yourself), keys or invite links, and every change it wants to make waits for your OK. The conversation is kept only in memory; the list of what it did stays on your device.
• Translating a message happens on your device, after it's decrypted, so no message text is ever sent anywhere to be translated. The language models come from your own server, only if its owner offers translation, and only after you agree to the download.

3. On the servers you join

When you join a server, it stores what it needs to run your account there:

• Your account's public key (your identity) and the public keys and names of your devices.
• Your profile: display name, avatar (and, if you set one, a picture shown on that server only, stored without its metadata), bio, pronouns, profile colour, custom status, and your profile page if you make one. Plus your nickname, roles (including ones you pick yourself), when you joined, and which server rules you accepted.
• What you post: messages (with up to 20 earlier versions after edits, which you and the moderators can see), files, images, voice messages, reactions, polls and votes, pins, threads, forum posts, docs pages and their history, whiteboard drawings, events you create or are interested in, emoji, stickers and sounds you add (and emoji or stickers your app copies in from another server you're on, so you can use them here), and a notice when you save a clip.
• Reminders and scheduled messages you set: when they're due, and for server channels which message or what to send. What a reminder is about and its note are encrypted so the server can't read them; scheduled DMs and group messages are already encrypted. Your inbox lists the messages that mention or reply to you. Saved messages are a synced setting (see above).
• The server's key log: every account key the server has shown, with the name it showed, and every key change, signed by the server so members' apps can check it (see key transparency). It only ever grows.
• Settings for that server, such as notification levels, and your block list (so the server can stop DMs and calls from people you've blocked; nobody else sees it).
• Push subscriptions for the devices where you turned notifications on (see Notifications).
• Your presence (online, idle, in voice) is kept in memory only while you're connected.

Server channels, voice channels and files are not end-to-end encrypted, unless the channel is an encrypted channel (see below): whoever runs the server can read them, and so can the members allowed into each channel. Servers use HTTPS when the owner has turned it on (it's automatic with "Let friends anywhere join").

A server sees your IP address while you're connected, because it needs it to talk to you. Iskra's server doesn't store IP addresses in its database and doesn't log requests by default. Each server keeps a security log that only its owner can read: failed sign-ins, new members and devices, account key changes, account deletions, backups and data downloads, with the account key and time (never message text). It records IP addresses only if the owner turns that on. Servers also keep daily backups (the last 7 days by default) so the owner can undo mistakes, and the owner can have an encrypted copy of each one written to another disk, or kept on a friend's Iskra server (backup buddies). That server can't read it: the copy is encrypted before it leaves, and only the owner holds the recovery code.

Links in messages get a preview (title and description) that the server fetches, not your device, so the website sees the server's address instead of yours.

Searching with "Everywhere" sends your search words to each server you're on, as searching one server does; servers don't keep searches. Your direct messages and group chats are searched on your device.

Bots on a server are programs an admin added; they show a BOT badge. A bot gets only its commands, button clicks and forms, and messages that mention it or reply to it, unless an admin lets it read all messages (you can see which bots can). The built-in bots (Dice, Polls, Reminders) run inside the server and read only their own commands. In an encrypted channel, a command you send to a bot goes to the server and the bot unencrypted; the app tells you before you send it, and the answer is shown only to you.

4. Direct messages, group chats and calls

Direct messages and group chats, including their pictures, files and voice messages, are end-to-end encrypted: only the people in the conversation can read them. Voice and video calls in DMs and group chats are end-to-end encrypted too, and so are encrypted channels (an option for small private channels: text, voice and whiteboards), which only the people who can see the channel can read. You can read the details in our security notes.

A server that carries them stores only the ciphertext and the metadata needed to deliver it: who sent what to whom, when, and how big it is, plus group and encrypted channel membership. It also knows who calls whom, when and for how long. It can't read the content or listen to the call.

A bot can be a DM partner too. The server still can't read those messages, but whoever runs the bot can: that's the point of writing to it, and the app says so. You can turn off DMs from bots in your settings.

Disappearing messages: a conversation can make its new messages disappear after a set time (5 minutes to 4 weeks). The server deletes them when the time is up, and the apps delete their own copies too. Someone in the conversation can still copy or screenshot a message before then.

5. Voice and video

Voice and video go through a voice service (LiveKit) that runs alongside each server, on the same machine, under the server owner's control. It sees your IP address while you're in a call. In voice channels and stages the audio and video aren't end-to-end encrypted (the server could in principle access them); in DM and group calls and encrypted voice channels they are. Iskra's servers don't record calls. Text written in a voice channel's chat is stored like any channel message. Voice rooms you make by joining a "join to create" lobby are temporary voice channels named after you; they're deleted about 30 seconds after they empty.

When a server is open to the internet, its voice service may ask a public STUN server (by default one run by Google) for the server's own public address. This reveals the server's address, not yours.

6. Reports and moderation

• When you report a message, the server keeps a copy of it as it was when you reported it (text and attachments), with your reason and note, so moderators can see it even if it's deleted.
• When you report from a DM or group chat, only the messages you choose to share are sent to that server's moderators. The server can't check them against the encrypted originals, and moderators are told so.
• Your identity as the reporter is visible to the server's moderators, but never to the person you reported.
• Moderators' actions (deleting messages, one or many at once, warnings, timeouts, kicks, bans, letting people in, role changes) are recorded in the server's audit log, with names, for 90 days; moderators can read the entries about one member as that member's moderation history. A warning is shown to you at once. Resolved reports are deleted 90 days after they're resolved.
• Moderators can keep private notes about a member, to remember earlier trouble. You never see notes about you, and they aren't in your data download (like reports about you); the moderator who wrote a note can download it as theirs. Notes stay after you leave and are deleted with your account.
• A list of people who left (your name on that server, how and when you left, who removed you) lets moderators act on a report about someone who's gone, for example by banning them. If you delete your account, your name is removed from it.
• An invite can require approval: while a moderator decides, the server keeps your name, your account key, which invite you used and when you asked, for up to 7 days (a day after a refusal). Moderators see those, never your IP address.
• If you email a safety concern to spark@iskra.foo, we keep the email for as long as we need it to handle the concern, and we may pass illegal content to the authorities.

When you send a bug report, it goes to Iskra's bug inbox: Iskra's own server (chat.iskra.foo), into a private channel only the Iskra team reads. It contains what you wrote, the screenshots you added (stored without their metadata), your email address if you gave one (so we can answer), and, unless you untick "Include logs", technical logs from the last 30 minutes (see Who Iskra talks to). Reports aren't linked to your account, and your IP address is used only to limit abuse and never stored. We delete reports once they're no longer needed, and after 12 months at the latest. If you'd rather not send it, the app can save the report as a file for you to email instead.

7. Notifications

If you turn on notifications (Settings → Notifications, per device), each server sends them through your browser's push service: Google (Chrome, Edge on Android), Mozilla (Firefox), Microsoft (Edge on Windows) or Apple (Safari, iPhone and iPad). This uses the Web Push standard: every notification is encrypted to your device, so the push service can't read it, but it does see that a notification was sent to your device, and when.

• DM and group chat notifications never contain the message, just "New message from X".
• Mentions and replies in server channels include the sender's name, the channel and a short excerpt (up to 140 characters).

Alert words, follows and quiet hours stay on your devices, and sync between them sealed so your servers can't read them; the app looks for your words, and for posts by the people and roles you follow, itself, in encrypted channels and DMs too. Only if you tick "Also when Iskra is closed" do your servers get a readable copy of your words and follows (words matched only in channels that aren't encrypted), and only servers that send you push notifications get your quiet hours (days, times and time zone). Untick it, or turn quiet hours off, and those copies are deleted.

On phones, the Iskra apps (Android, iPhone and iPad) show notifications while the app is open, straight from your servers. They don't use any push service, so nobody else learns when you get one. For notifications while Iskra is closed, use the web app in your phone's browser.

8. Who Iskra talks to

Your devices talk to the servers you join. These are the only other services the apps and servers contact, and only in the situations listed. The apps show the same list in My settings → Privacy & data. The technical version has the details.

Voice and video connect straight to your server's own voice service; the apps use no STUN or relay servers of anyone else's. The desktop app turns off Chromium's background connections: spellcheck uses your computer's own spellchecker on Windows and macOS, and is off on Linux, where it would download dictionaries from Google.

If you run a server and turn on "Let friends anywhere join", the server also talks to your router (UPnP or NAT-PMP, on your own network) to open ports, gets an HTTPS certificate from Let's Encrypt, and, if you haven't set your own domain, uses an address under sslip.io (a public DNS service that turns a name like 1-2-3-4.sslip.io into the server's IP address; its name servers answer the lookups for that name). When such a server's address isn't known from the router, its voice service may ask a public STUN server (by default one run by Google) for the server's own public address; this reveals the server's address, not yours. The server also fetches link previews from the linked websites (text only, no images) and sends notifications to the push services above.

Every server can also:

• Send encrypted backups to a friend's Iskra server (backup buddies), only if the owner pairs it with one. The friend's server sees this server's address, when backups happen and how big they are, never what's in them.
• Fetch the live-captions model once from Hugging Face (at a fixed version, checked against a fingerprint built into Iskra), the first time a member turns captions on. Hugging Face sees only the server's address; members' apps then get the model from their own server. The owner can turn this off.
• Fetch translation models from Mozilla (Mozilla's Firefox Translations models, at fixed versions, checked against fingerprints built into Iskra), only if the owner offers translation, and only each model the first time a member needs it. Mozilla's storage (on Google Cloud) sees only the server's address; members' apps then get the models from their own server.
• Send events to addresses its admins choose (outgoing webhooks), for example to a game server or home automation: new messages and reactions in chosen channels, people joining or leaving, events starting. That site gets what the event contains, such as message text and names, from the server's address, never yours. Nothing from encrypted channels, DMs or group chats is ever sent. Every member can see where their servers send things in My settings → Privacy & data.
• Check feeds its admins choose (the Feeds bot), only if an admin turns it on: RSS and Atom feeds, YouTube channels' public feeds and, only if the owner adds their own Twitch app, whether Twitch channels are live. Those sites see the server's address and that it follows them, never yours. Only text is fetched, never pictures.
• Check GitHub for new server versions (standalone servers; the owner can turn it off, or let the server install updates by itself). GitHub sees the server's address. Servers started by the desktop app update with the app and never check by themselves.

If you rent a server, the provider you pick runs that computer and can see what's on it, like any server you rent. The setup downloads Iskra from GitHub. If you rent on DigitalOcean through the app, Iskra gets a little DigitalOcean credit from the referral link (see above); with any other provider, Iskra gets nothing.

That's the complete list. The apps load no fonts, scripts or images from other sites, and contain no analytics, advertising or crash-reporting services. The on-device models for noise removal, voice detection and background effects ship inside the apps.

9. The websites

iskra.foo and app.iskra.foo are static sites hosted on Cloudflare Pages. Like any web host, Cloudflare processes your IP address and request details to deliver the pages and protect them from attacks, and keeps short-lived logs. We don't add analytics, cookies or trackers to either site.

• iskra.foo loads nothing from other sites.
• app.iskra.foo only delivers the web app's files. Once loaded, the app talks straight to the servers you join; Cloudflare doesn't see your chats.
• Links to Ko-fi, PayPal and GitHub take you to those sites, under their own privacy policies.

Some of these companies (Cloudflare, Google, GitHub, Hugging Face, DigitalOcean, and some push services) are based in the United States. They transfer data under the EU's approved safeguards, such as the EU–US Data Privacy Framework or standard contractual clauses.

10. How long things are kept

• Your messages and files stay on a server until you or a moderator delete them, the server's owner removes them, or you delete your account (and choose to delete your messages).
• Uploads that aren't used by any message, avatar or the like are deleted after 24 hours.
• Encrypted DM envelopes stay on a server so your other devices can fetch them; deleting your account removes your copies. The short-lived keys that protect them are deleted about five weeks after use, after which old envelopes can't be decrypted even with your device keys.
• Audit log entries: 90 days. Security log entries: 365 days. Resolved reports: 90 days after they're resolved. A server's owner can change these, and can also choose to delete messages and files after a set time.
• Daily server backups: 7 days by default (the owner can choose 1 to 30); encrypted copies on another disk are kept for the same number of days. Encrypted copies on a friend's server (backup buddies) are kept as long as the owner and the friend agreed, at most the number of copies the friend allows, and for a grace period of up to 90 days after either side stops.
• Disappearing messages: until their timer runs out, if the conversation has one.
• Ended or cancelled events: 30 days.
• Bug reports you send to Iskra: 12 months at most (see Reports and moderation).
• Inbox entries: 60 days (at most 500). Reminders: 30 days after they're due. Scheduled messages: until they're sent or you delete them. Earlier versions of a message go with the message (at most 20); a docs page keeps its last 50 versions.
• Join requests (invites that need approval): until a moderator decides, 7 days if nobody does, a day after a refusal. Moderators' notes about you: until a moderator deletes them or you delete your account. People who left: the entry stays, with your name removed if you delete your account. Emoji and stickers copied in from other servers: until an admin removes them or newer ones push the oldest out (300 emoji, 100 stickers per server). Temporary voice rooms: about 30 seconds after they empty.

11. Deleting your data

You can delete things yourself: edit your profile, delete your own messages, remove a device, or leave a server. To remove everything at once, use Delete account in Settings → Account. It:

• removes your profile, avatar and any per-server picture, nickname, roles, settings and moderators' notes about you on every server you're in;
• optionally deletes all your messages on those servers;
• deletes the server copies of your encrypted DMs and group chats;
• revokes all your devices, and wipes Iskra from the device you're using.

What isn't deleted: messages already on other people's devices (for example the DMs you sent them) stay with them. Moderators may keep reports, the audit log and the "people who left" entry for safety, with your name removed, and the owner keeps the security log entries about your account (without IP addresses) until they expire. A server's backups (see How long things are kept) still hold your data until they're replaced. Servers that are offline at the time are reached by your other devices when they next connect, or you can ask their owners. See How to delete your account for step-by-step instructions and what to do if you've lost your devices.

12. Children

Iskra is for people aged 13 or over, or the age at which you can consent to online services yourself in your country if that's higher (13 in Sweden; up to 16 in some EU countries). Below that age, you may only use it with a parent's or guardian's permission where the law allows. If you believe a child's data is on a server we run without that permission, email spark@iskra.foo and we'll delete it.

13. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how it's used, and to get it in a portable form. Much of this you can do yourself in the app: Settings → Privacy & data downloads what each server keeps about you and what your device keeps (including your DM and group chat history). For a server, ask its owner; for iskra.foo, app.iskra.foo and servers we run, email us.

Why we process data on what we run: to provide the service you asked for (your account, messages and calls on our server), and our legitimate interest in keeping the sites and servers working, secure and free of abuse. Where the law requires it, we may share information with authorities.

You can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority where you live. We'd appreciate the chance to fix it first.

14. Changes and contact

If we change this policy, we update this page and the date at the top. If a change matters, the app will tell you.

Viktor Lundgren ("From a Spark"), Sweden · spark@iskra.foo

See also: Terms of Use · Help & support · Delete your account