The short version
- We collect nothing about you. No name, phone number, email address, date of birth, location, address book or IP address. We do not know who you are, and we do not want to.
- We collect no metadata. We do not record who you talk to, when, how often or from where.
- Zero-knowledge architecture. Your private keys are created on your device and never leave it. Our servers only store and pass along sealed, encrypted data that they cannot open. We see nothing.
- Even a court order cannot change the maths. If the law forces us to hand over what our servers hold, we comply, and what we hand over is unreadable, because we never hold the keys.
- Your password never reaches us. There is no "forgot my password" function. Only your password and your recovery phrase can open your account. If you lose both, nobody can recover it, including us.
- We do not sell data, show ads or train AI on your messages. Ever.
- Q, the OBLIQ assistant, runs on your device. Nothing you say to it goes to a cloud AI.
- Our servers are in Europe. You can delete your account at any time.
1. Who we are
OBLIQ is made by ThirdAct Pte. Ltd., a company registered in Singapore (UEN 202508104R), at 68 Circular Road, #02-01, Boat Quay, Singapore 049422. In this policy "we", "us" and "OBLIQ" mean ThirdAct Pte. Ltd.
| Contact | Address |
|---|---|
| Privacy questions | privacy@obliq.cc |
| Data Protection Officer | privacy@obliq.cc (subject line: "DPO") |
| Our representative in the EU | privacy@obliq.cc |
| Account deletion | obliq.cc/delete-account or delete@obliq.cc |
| Security reports | security@obliq.cc |
2. Zero knowledge: how OBLIQ is built
Most messaging apps can see far more than they admit. They tie your account to your phone number, keep a record of who you talk to, and hold copies of the keys that protect your messages. OBLIQ is built so that none of that is possible.
- Your keys stay with you. The private keys that lock your messages, calls, files and profile are created on your device and never leave it. We never receive them, never store them and never have a copy.
- Our servers are blind. They hold only sealed data and pass it along. They cannot open it. There is no master key and no back door, and we cannot build one without changing the app you install, which you would see.
- Your account is anonymous. You sign up with a username and a password. We never link an account to a person, a phone number or an email address.
- Your password never leaves your device. Your device turns it into cryptographic material, and we hold only a sealed form of it that we cannot reverse.
What this means if you lose your password
Because we know nothing about you and never hold your password or keys, we cannot reset your password, recover your account or prove that you are you.
- OBLIQ has no "forgot my password" function, by design.
- The only ways into your account are your password and your recovery phrase.
- If you lose both, the account and everything in it are permanently out of reach, for you and for us. We cannot make an exception, even if you can describe your account in detail, because anyone could claim to be you.
Keep your password and recovery phrase somewhere safe, away from your phone.
3. What our servers hold, and why we cannot read it
We collect nothing about who you are and nothing about your conversations. To deliver a message, however, a server must hold some things for a short time. The law requires us to list all of them, so here they are.
| What our servers hold | Can we read it? | How long |
|---|---|---|
| Your username | Yes. It is the one public thing about your account, so people can find you by typing it exactly. It is not linked to anything about you. | Until you delete your account. It is then retired so nobody can reuse it to impersonate you. |
| Your public keys | Yes. They are public by design. They let other people's devices lock messages that only you can open. | Until you delete your account. |
| Sealed password material | No. It can only be opened with your password or recovery phrase, which we never receive. | Until you delete your account. |
| Your profile (display name, photo, "About" text) | No. It is encrypted on your device and can only be opened by the people you share it with. | Until you change it or delete your account. |
| Your contacts and groups | No. They are stored sealed, so we cannot see who is in your contact list or your groups. | Until you change them or delete your account. |
| Messages and files waiting for delivery | No. They are end-to-end encrypted, and the sender is sealed inside them. | Deleted as soon as all your devices receive them, and never kept longer than 30 days. |
| Encrypted backups you choose to create | No. They are locked with a key only you hold. | Until you delete the backup or your account. |
| A notification address for each of your devices | It is a technical address for sending a wake-up signal. It says nothing about you. | Until you remove the device or delete your account. |
| Failed sign-in counters | They are stored under a scrambled identifier instead of your username, and record only the number of failed attempts. They exist to stop people guessing your password. | 90 days. |
What we never collect or keep:
- your name, phone number, email address, date of birth or location.
- your IP address. Our servers do not record where you connect from.
- your address book. OBLIQ never uploads it.
- who you talk to, when, how often or for how long.
- your call history, which stays on your device.
- the content of anything you send.
What you choose to send us
We receive something readable only when you decide to send it to us yourself.
| What | When | How long we keep it |
|---|---|---|
| Abuse reports | When you report someone. Only the messages you select are sent. | Up to 180 days after the report is closed. |
| Bug reports and app logs | When you use "Report a problem". You see what will be sent before you send it. | 60 days. |
| Support emails | When you write to us. | Up to 12 months after the conversation ends. |
| Website deletion requests | When you use the form at obliq.cc/delete-account. | Until the request is completed or expires. |
What stays on your device
Your messages, calls, photos, voice notes and files, your keys, your address book, your call history, everything Q does, your calendar (if you let Q check it for scheduling) and any WhatsApp chats you import or connect. None of it leaves your device unless you send it.
4. What we do not do
- We do not sell, rent or trade information about you. Ever.
- We do not show ads, and we do not build profiles of anyone.
- We do not train AI models on your messages or your data. This applies to us and to anyone we work with.
- We do not use analytics or tracking tools in the app or on our website.
- We do not read your messages. We cannot.
- We do not share information with other companies for their own use.
5. Q, the OBLIQ assistant
Q runs on your device. Translation, transcription, summaries and suggestions are all produced by AI models that run on your phone or computer.
- Q never sends your conversations to a cloud AI service.
- The first time you use certain features, your device downloads an AI model from our servers. The download contains no information about you.
- You can turn Q off completely in Settings. Q is never forced on you.
- Q can be wrong. Treat its answers as suggestions, and check anything important.
6. How long we keep things
The table in section 3 lists each period. In addition:
- Backups of our systems are encrypted and kept for 7 days. After something is deleted, it can remain in these backups for up to 7 days before it is gone for good.
- When you delete your account, everything in section 3 is deleted from our live systems immediately. We keep only a record that your username existed, so nobody else can take it and pretend to be you. That record is linked to nothing else.
- When the law requires us to keep something longer, we keep only that item, only for as long as required.
7. Who we share with
We share nothing about you, because we hold nothing readable about you. The companies below run parts of OBLIQ's infrastructure for us. They store or carry sealed data and are bound by contract to protect it and use it for nothing else.
| Provider | Country | What they do | What they can see |
|---|---|---|---|
| Gcore | Luxembourg (servers in the Netherlands, Luxembourg and the UK) | Hosting, storage, backups | Sealed data only |
| Hetzner Online | Germany | Hosting, website | Sealed data only |
| Exoscale (A1 Digital) | Switzerland | Hosting, key protection for our own systems | Sealed data only |
| Google Workspace | EU data region | Our support and privacy mailboxes | Only emails you choose to send us |
| Apple (APNs) and Google (Firebase Cloud Messaging) | United States | Delivering the wake-up signal to iPhones and Android phones. Every app that sends notifications must use them. | A device address and a sealed signal. They cannot see who sent it or what it says. |
| Apple App Store and Google Play | United States | Distributing the app | What they collect under their own policies when you download apps. We receive nothing about you from them. |
We keep a current list of these providers at obliq.cc/privacy, and we update it at least 30 days before a new provider handles any data.
When the law requires us to hand over data
We obey the law. If a court or authority with proper jurisdiction serves us a legally binding order, we comply with it.
But we can only hand over what our servers hold, and section 3 shows what that is: sealed data that nobody can read without keys that only users hold. A court would receive encrypted data we cannot open, plus the account's username and the date it was created. We have no key that unlocks it, and the law cannot compel us to hand over something we do not have.
We check every request, and we refuse requests that are unlawful or too broad. We tell the affected user about the request unless the law forbids it or a court orders us not to. We publish a transparency report at least once a year, listing how many requests we received and how we answered them.
If the company changes hands
If ThirdAct is merged, acquired or sells OBLIQ, this policy goes with it, and the new owner must keep every promise in it. We will tell you at least 30 days before any change, and you can delete your account before it takes effect.
8. WhatsApp import and the WhatsApp bridge
OBLIQ can help you move from WhatsApp in two ways. Both run on your device.
- Import. You can import a chat that you exported from WhatsApp. The file is read on your device and stored there. It is never uploaded to us.
- Bridge. You can connect your WhatsApp account to OBLIQ as a linked device, the same way WhatsApp Web works, so you can read and answer WhatsApp chats inside OBLIQ. The connection runs from your device directly to WhatsApp. Your WhatsApp messages never pass through our servers.
Please know:
- WhatsApp is a separate service run by Meta. When you use the bridge, Meta receives what it normally receives from a WhatsApp linked device, under Meta's own privacy policy.
- WhatsApp chats include messages from other people. Import or connect only chats you are entitled to keep, and respect the privacy of the people in them.
- You can disconnect the bridge at any time, inside OBLIQ or from WhatsApp's "Linked devices" screen.
9. Where the servers are
Our servers are in the European Union, Switzerland and the United Kingdom. All of them are recognised by the EU as giving data adequate protection.
ThirdAct is a Singapore company, and our team may run these systems from outside Europe. Where any data leaves Europe, including the wake-up signal handled by Apple and Google, we protect it with the European Commission's Standard Contractual Clauses or an equivalent legal safeguard. You can ask for a copy at privacy@obliq.cc.
10. Your rights and choices
You have these rights wherever you live. Where your local law gives you more, you get more.
| Right | How to use it |
|---|---|
| See your data | Everything about your account is visible in the app, because it is held on your device. |
| Correct it | Change your display name, photo and "About" text in Settings. |
| Delete it | Delete individual chats, your backups or your whole account in the app. |
| Take it with you | Export your chats from the app in a standard format. |
| Withdraw permission | Turn off notifications, camera, microphone or calendar access at any time in your device settings. |
| Ask us anything | Write to privacy@obliq.cc. We answer within 30 days. |
| Complain | Write to us first if you can. You can also complain to your local data protection authority. In Singapore that is the Personal Data Protection Commission. |
Because we do not know who you are, we can act on a request about an account only when it is made from inside that account, by someone signed in with its username and password. This protects you: nobody can get at your account or delete it just by claiming to be you.
Deleting your account
- In the app: Settings, then Account, then Delete account. You confirm with your password. Deletion is immediate.
- From the web: obliq.cc/delete-account. You can request deletion without the app installed. The request is completed when it is confirmed by someone signed in to the account.
When your account is deleted, we immediately delete everything listed in section 3, except the retired username. Messages you already sent stay on the devices of the people who received them, the same as a letter you already mailed. Our system backups clear within 7 days.
11. Security
- Messages, calls, files and profiles are end-to-end encrypted with modern, published cryptography.
- Private keys are created and kept on your device. On supported phones they are protected by the device's secure hardware.
- Your password never leaves your device.
- Your chats on your device are stored in an encrypted database.
- Access to our servers is limited to the few staff who need it, and every access is logged.
No system is perfectly secure. If a breach ever affects you, we will tell you and the relevant authorities without undue delay and as fast as the law requires, with what happened and what you should do. Because our servers hold only sealed data, a breach of our servers cannot expose your messages. If you find a security problem, please report it to security@obliq.cc. We will not take legal action against good-faith security research (see our Terms of Use, section 9).
12. Children
OBLIQ is for people aged 16 and over, everywhere in the world. We do not knowingly allow anyone younger to use it.
We cannot verify ages, because we do not collect identity information. If you believe someone under 16 is using OBLIQ, tell us at privacy@obliq.cc. We will look into it and close the account where it is used by a child.
13. Our website
obliq.cc does not use cookies, analytics or tracking. It loads no third-party scripts or fonts. Our web server does not keep logs of visitor IP addresses.
If you use the deletion request form, we receive only what you type into it: the username and an optional note. The form does not ask for your name or email address. It sends the request to delete@obliq.cc, and we delete it once the request is completed or expires.
14. Changes to this policy
If we make a change that affects your rights or how your data is handled, we will tell you in the app at least 30 days before it takes effect, and explain the change in plain words. If you do not agree, you can delete your account before then. We never apply a change backwards to data handled under an earlier version.
Small corrections, such as fixing a typo or updating a contact address, take effect when we publish them. Every version of this policy stays available at obliq.cc/privacy.
15. Legal basis (for users in the EU, UK and Switzerland)
| What we do | Legal basis |
|---|---|
| Running your account and delivering sealed messages and calls | Performing our contract with you |
| Failed sign-in counters, to protect accounts from password guessing | Our legitimate interest in keeping accounts safe, balanced against your rights |
| Handling abuse reports, bug reports and support emails you choose to send | Our legitimate interest in answering you and fixing problems |
| Notifications, camera, microphone and calendar access on your device | Your permission, which you can withdraw at any time |
| Answering legally binding orders | Legal obligation |