TEPAST Messenger Privacy Policy

Effective: July 27, 2026

TEPAST Messenger provides direct and group messaging, attachments, voice calls, video calls, and optional sharing tools. This policy explains what data is processed, why it is needed, and the choices available to you.

Service operator and contact

TEPAST operates this service. Privacy and support requests can be sent to support@tepast.com.

Data we process

• Account ID, name, password hash, recovery PIN hash, recovery codes, profile photo, language, timezone, and preferences.
• Friends, groups, conversations, messages, reactions, delivery and read state, call records, and files or locations you choose to share.
• Device notification tokens, device and app version details, online state, session records, security logs, and abuse-prevention records.
• Camera and microphone media only while you actively use camera capture, document scanning, voice messages, or voice/video calls. Live call media is transported through the configured LiveKit service and is not recorded by TEPAST Messenger.

Device permissions

• Camera: used when you start or join a video call, capture a photo, scan a document, or update an avatar.
• Microphone: used for voice/video calls and voice messages.
• Device connectivity: used to monitor network availability and route call audio through speaker, earpiece, wired headsets, or Bluetooth communication devices.
• Approximate and precise location: requested only after you choose Share location in a conversation. Location is not collected continuously or in the background.
• Notifications: used for new messages, calls, security notices, and service announcements.
• Photos and files: accessed only through the system picker for items you select, or when you ask the app to save a download.

You may deny or later revoke optional permissions in device settings. Only the related feature will become unavailable. TEPAST Messenger does not use these permissions for advertising or continuous tracking.

Why data is used

Data is used to create and secure accounts, deliver and synchronize messages, calls and files, show presence and receipts, remember user choices, send notifications, prevent spam and abuse, provide support, and comply with legal obligations. Optional camera, microphone, location, and notification features operate only when you request or enable them.

Sharing and international processing

Content is shared with the recipients you select. Necessary data may also be processed by service providers used for hosting, database storage, media calls, file processing, and push notifications, including Firebase Cloud Messaging or Huawei Push Kit according to the device. Data may therefore be processed outside your country, subject to applicable safeguards. TEPAST does not sell personal data or use it for targeted advertising.

Security

Network transport uses HTTPS and WSS encryption. Passwords, recovery PINs, and recovery codes are stored as secure hashes. Access to attachments is checked against conversation membership. Messages stored on the server are not currently end-to-end encrypted, so the service must not be described as E2EE.

Retention

Account and conversation data is retained while the account is active and until it is removed through the available controls or is no longer needed for the service. Deleted content is removed from active storage when it is no longer referenced by another valid message, forward, group, or broadcast. Security and abuse-prevention records and protected backups may remain for a limited period where reasonably necessary for recovery, fraud prevention, dispute resolution, or legal obligations.

Your privacy rights

Depending on your location, you may request access to, correction of, export of, restriction of, or deletion of your personal data, and may object to or withdraw consent for optional processing. You can update profile information and permissions in the app or device settings. Send other requests from the account email context, with your account ID and enough information to verify ownership, to support@tepast.com. We will respond according to applicable law.

Delete your account

Sign in, open Your profile, choose Devices and sessions, then Delete my account. Your recovery PIN confirms the request. Sign-in is disabled immediately and permanent deletion is scheduled after seven days. You may also use the link below or contact support if you cannot access the app.