Privacy Policy

Last updated: April 2026

1. Information We Collect

We collect information you provide when creating an account, including your name, email address, and organization details. We also collect usage data to improve our services.

  • Account information: Name, email address, password (hashed), organization name
  • Communication data: Messages are end-to-end encrypted using the Signal Protocol and cannot be read by Olbongo
  • Usage data: Feature usage analytics, login timestamps, device information
  • Hosted mail: Mailboxes on your own domain are covered separately — see the Olbongo Mail Privacy Policy

2. Google User Data

Olbongo requests one optional Google permission, and only when you ask for it:

  • Google Contacts (read-only): When you choose to import your contacts, we read contact names, phone numbers and email addresses to match them against existing Olbongo accounts and to populate your in-app contact list. The import is optional and user-initiated; we never modify or delete your Google contacts.
  • User profile information: Your name and email address, when you choose to sign in with Google.

Olbongo does not request access to your Gmail. Email inside Olbongo is our own hosted mail service on your own domain — see the Olbongo Mail Privacy Policy.

How We Use Google Data

  • Google Contacts data is used to find which of your contacts already use Olbongo, and to populate your in-app address book
  • We do not use Google user data for advertising purposes
  • We do not sell, rent, or share Google user data with third parties
  • We do not use Google user data for any purpose other than the contacts-matching feature described above

How We Store Google Data

  • OAuth tokens are encrypted at rest and stored in our secure database
  • Imported contact details are stored in your Olbongo address book until you remove them
  • We retain your Google authentication credentials only while your account is connected
  • When you disconnect your Google account, all stored tokens and cached data are permanently deleted

Google Data Sharing

Olbongo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking Access

You can revoke Olbongo's access to your Google account at any time from your Google Account permissions page. Revoking access does not delete your Olbongo account; it only stops Olbongo from accessing your Google data.

3. How We Use Information

We use your information to:

  • Provide, maintain, and improve Olbongo services
  • Communicate with you about your account and service updates
  • Ensure the security and integrity of our platform
  • Provide customer support
  • Comply with legal obligations

4. Data Security

We implement industry-standard security measures to protect your data:

  • End-to-end encryption for all messages using the Signal Protocol (X3DH + Double Ratchet)
  • TLS 1.3 encryption for all data in transit
  • AES-256 encryption for data at rest
  • Argon2 password hashing
  • Regular security audits and vulnerability assessments

5. Data Retention

We retain your account data for as long as your account is active. When you delete your account:

  • Your profile and account data are permanently deleted within 30 days
  • Connected third-party service tokens are immediately revoked and deleted
  • Cached email and contact data are permanently deleted
  • Encrypted messages are removed from our servers (messages already delivered to other users remain under their control)

How to delete your data

You can request deletion of your Olbongo account and associated data at any time by visiting /delete-account and submitting your account email. After clicking the confirmation link in the email we send, your account enters a 14-day suspension window — you can cancel at any point during that window from the cancel link in your confirmation email. If you don't cancel, your account and the data listed below are permanently deleted after 14 days.

  • Profile (name, email, avatar, status text)
  • Messages (anonymized to "Deleted user" for other participants)
  • Contacts and uploaded media
  • Authentication data and device registrations
  • Mini-app installations and per-app data

Retained for legal/security reasons: audit logs and billing records.

6. Your Rights

You have the right to:

  • Access and download your personal data
  • Correct inaccurate data
  • Delete your account and associated data
  • Disconnect third-party services at any time
  • Revoke Google account access from your Google Account permissions page

7. Contact

For privacy-related questions or data requests, contact us at: