App Privacy Policy
Gart App
Effective Date: May 26, 2026
Last Updated:
May 26, 2026
This Privacy Policy explains how Gart ("we," "us," or "our") handles data in connection with the Gart mobile application (the "App") available on Android. Gart is an emergency communication tool built on a privacy-first, decentralized architecture. This policy should be read alongside our general Terms of Service.
1. Architecture Overview
The Gart App uses the Nostr protocol — a decentralized, open communication protocol. All sensitive content is end-to-end encrypted before leaving your device. Emergency alerts and messages are transmitted through publicly operated Nostr relays.
We operate a Blossom server as a fallback to ensure the permanency of encrypted backups. All data stored on this server is end-to-end encrypted — we cannot decrypt it.
This means:
- We cannot read your messages or alerts.
- We cannot access your location data.
- We cannot read your backups — even on our own server.
gart-device-link events on public relays)
or does Gart maintain a separate user directory/index on its own infrastructure? The answer
determines whether we need to disclose a central user registry and its data retention.2. Data We Do Not Collect
By design, we do not collect, process, or have access to:
- Your location data. GPS coordinates are encrypted on your device using NIP-44 (XChaCha20-Poly1305) encryption and sent directly to your designated contacts via Nostr relays. We never see, process, or store your location.
- Message content. All chat messages between group members are end-to-end encrypted using NIP-44 and wrapped with NIP-59 gift wrapping. Only intended recipients can decrypt them.
- Private keys. Your cryptographic keys (UserKey, SystemKey, ButtonKey, FinderKey) are generated and stored locally on your device in platform-native secure storage (Android Keystore). We never receive or have access to your private keys.
- Cryptocurrency wallet addresses or holdings.
- Biometric data.
- Browsing history or cross-site tracking data.
- Social media profiles or content.
- Contacts list or phone book data.
3. Data Stored Locally on Your Device
The App stores the following data locally on your device only
in an encrypted database (gart_db):
| Data | Purpose | Shared with Gart servers? |
|---|---|---|
| Nostr public keys (npubs) | Identity and group membership | No |
| Display name and avatar URL | Profile display from Nostr Kind 0 events | No |
| Group membership records | Managing your alert groups | No |
| Encrypted location events | Showing received alerts on a map | No |
| Chat messages | Conversation history | No |
| Invitation records | Tracking group invitations | No |
| Device-specific system keys | Authenticating your device | No |
This data remains on your device and is not transmitted to Gart. Uninstalling the App removes this data.
4. Data Transmitted via Nostr Relays
When you use the App, certain data is transmitted through third-party Nostr relays. We do not operate these relays.
When you activate an emergency alert, your GPS coordinates, timestamp, and emergency message are encrypted with NIP-44 on your device. The encrypted payload is signed by your Button key and broadcast to Nostr relays.
Only group members holding the shared Finder key can decrypt the content.
Relay operators can see: the public key that signed the event, the Finder public key tag, and event metadata (timestamp, event kind). They cannot see the encrypted GPS coordinates or message content.
Messages are encrypted, sealed, and gift-wrapped using NIP-59.
Relay operators can see the outer gift wrap metadata but cannot see message content, the true sender, or the true recipient.
When you sign up or log in, a Kind 30078 event associates your device key with your Nostr identity. The event content (your device private key) is NIP-44 encrypted.
Your Nostr public key and device public key are visible to relay operators.
If you set a display name or avatar, this is published as a standard Nostr Kind 0 event. This information is public by design on the Nostr protocol.
5. Data We Process on Our Infrastructure
We operate a Blossom server for encrypted backup storage (see Section 1) — all data on it is end-to-end encrypted and inaccessible to us. The following additional data processing occurs outside the App:
In-app analytics: We collect anonymous usage events using a self-hosted, open-source analytics solution on infrastructure we control. This data helps us improve the App's reliability and user experience. Analytics events include:
Onboarding and authentication: Login method chosen, permission grants/denials, account creation method. No credentials or private keys are collected.
Alert system: Test and real alert activation, delivery latency, GPS accuracy (in meters, not coordinates), relay delivery success/failure, alert duration.
Invitation flow: Search query type and length (not the query itself), result counts, invitation accept/decline timing, handshake completion.
Group management: Group creation, member counts, group age.
Messaging: Message length and chat type (not message content).
Hardware pairing: BLE pairing steps, success/failure phase, connection stability.
Navigation and errors: Screen views, session duration, error types and crash reports.
Backup and restore: Backup size, restore success/failure stage.
What analytics does NOT collect: message content, GPS coordinates, private keys, Nostr identities, IP addresses, device fingerprints, or any data that could identify you personally. All analytics data is stored on our self-hosted infrastructure and is never shared with third parties.
6. Authentication
The App supports three authentication methods:
1. External Signer (NIP-55) — Your private key never touches the Gart App. Authentication is handled by a separate signing application (e.g., Amber). This is the recommended method.
2. Login with nsec — You provide your Nostr private key directly. It is stored encrypted in your device's secure storage and never transmitted to us.
3. Create New Account — A fresh keypair is generated locally on your device.
In all cases, a device-specific SystemKey is generated locally. We do not receive or store any authentication credentials.
7. Permissions Requested
The App requests the following device permissions:
| Permission | When | Purpose |
|---|---|---|
| Location (GPS) | Required for active alerts | Broadcast your position to your emergency contacts |
| Internet | Always | Connect to Nostr relays |
| Notifications | Always (optional) | Alert you when an emergency is received |
| Background execution | When enabled | Receive alerts while the app is not in the foreground |
| Camera | When scanning QR codes | Add contacts or importing keys |
Location is only accessed during an active alert. GPS is completely off when the App is idle, resulting in zero battery impact. When the alert is stopped, GPS is immediately released.
8. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Nostr relays (third-party) | Message and alert transmission | Encrypted events, public keys, metadata |
| Gart Blossom server | Encrypted backup storage | Encrypted blobs (opaque to us) |
| Self-hosted analytics (Gart-operated) | Anonymous usage analytics | Behavioral events only — no PII (see Section 5) |
| Google Play | App distribution | Standard store metadata |
We do not use third-party advertising, analytics SDKs, or tracking services in the App.
9. Data Retention
All App data is retained until you delete it or uninstall the App. You can delete individual groups, conversations, or your entire account from within the App.
Events published to third-party Nostr relays are subject to each relay's retention policies. Nostr events are cryptographically signed; they cannot be forged but also cannot be forcibly removed from all relays.
Encrypted backups are retained to ensure data permanency. All stored data is end-to-end encrypted and inaccessible to us.
Analytics data is retained on our self-hosted infrastructure for product improvement purposes. We do not maintain a central database of user accounts, profiles, or activity.
10. Key Rotation and Group Security
When a member is removed from a group:
- A new shared Finder key is generated.
- The new key is distributed to remaining members via encrypted NIP-59 messages.
- The removed member's copy of the old key can no longer decrypt new alerts or messages.
This ensures forward secrecy for group communications after member removal.
11. Children's Privacy
The App is not directed at children under 16. If a parent or guardian becomes aware that their child has used the App and wishes to exercise data rights, they may contact us.
12. Your Rights
We do not process personal data as defined under GDPR. Your data is either stored locally on your device under your control, end-to-end encrypted on infrastructure we cannot access, or collected as anonymous analytics that cannot identify you.
You are in direct control of your data:
Deletion — Uninstall the App or delete your account to remove all local data.
Portability — Your Nostr keys and profile are inherently portable to any Nostr-compatible application.
Opt out of analytics — You may disable analytics in the App settings.
Should you have any concerns about your data, contact us at [email protected].
13. International Data Transfers
The Nostr protocol is global and decentralized. When you publish events, they may be relayed to servers in any jurisdiction. Because all sensitive content is end-to-end encrypted before transmission, relay operators in any jurisdiction cannot access the plaintext content of your alerts or messages.
14. Security Measures
End-to-end encryption: NIP-44 (XChaCha20-Poly1305) for all alert and message content.
Gift wrapping: NIP-59 for sender/recipient metadata protection on chat messages.
Local key storage: Private keys stored in platform-native secure storage (Android Keystore).
Zero-knowledge architecture: We cannot access your data even if compelled to, because we do not have it.
Key rotation: Automatic group key rotation when members are removed.
No central honeypot: No central server storing user data that could be breached.
15. Changes to This Policy
We will update this policy as the App evolves. Material changes will be announced on our website and reflected in the updated policy with a revised "Last Updated" date at the top. Continued use of the App after changes constitutes acceptance.
16. Contact
For privacy questions, data requests, or concerns:
[email protected]
App Privacy Policy
Gart App
Effective Date: May 26, 2026
Last Updated:
May 26, 2026
This Privacy Policy explains how Gart ("we," "us," or "our") handles data in connection with the Gart mobile application (the "App") available on Android. Gart is an emergency communication tool built on a privacy-first, decentralized architecture. This policy should be read alongside our general Terms of Service.
1. Architecture Overview
The Gart App uses the Nostr protocol — a decentralized, open communication protocol. All sensitive content is end-to-end encrypted before leaving your device. Emergency alerts and messages are transmitted through publicly operated Nostr relays.
We operate a Blossom server as a fallback to ensure the permanency of encrypted backups. All data stored on this server is end-to-end encrypted — we cannot decrypt it.
This means:
- We cannot read your messages or alerts.
- We cannot access your location data.
- We cannot read your backups — even on our own server.
gart-device-link events on public relays)
or does Gart maintain a separate user directory/index on its own infrastructure? The answer
determines whether we need to disclose a central user registry and its data retention.2. Data We Do Not Collect
By design, we do not collect, process, or have access to:
- Your location data. GPS coordinates are encrypted on your device using NIP-44 (XChaCha20-Poly1305) encryption and sent directly to your designated contacts via Nostr relays. We never see, process, or store your location.
- Message content. All chat messages between group members are end-to-end encrypted using NIP-44 and wrapped with NIP-59 gift wrapping. Only intended recipients can decrypt them.
- Private keys. Your cryptographic keys (UserKey, SystemKey, ButtonKey, FinderKey) are generated and stored locally on your device in platform-native secure storage (Android Keystore). We never receive or have access to your private keys.
- Cryptocurrency wallet addresses or holdings.
- Biometric data.
- Browsing history or cross-site tracking data.
- Social media profiles or content.
- Contacts list or phone book data.
3. Data Stored Locally on Your Device
The App stores the following data locally on your device only
in an encrypted database (gart_db):
| Data | Purpose | Shared with Gart servers? |
|---|---|---|
| Nostr public keys (npubs) | Identity and group membership | No |
| Display name and avatar URL | Profile display from Nostr Kind 0 events | No |
| Group membership records | Managing your alert groups | No |
| Encrypted location events | Showing received alerts on a map | No |
| Chat messages | Conversation history | No |
| Invitation records | Tracking group invitations | No |
| Device-specific system keys | Authenticating your device | No |
This data remains on your device and is not transmitted to Gart. Uninstalling the App removes this data.
4. Data Transmitted via Nostr Relays
When you use the App, certain data is transmitted through third-party Nostr relays. We do not operate these relays.
When you activate an emergency alert, your GPS coordinates, timestamp, and emergency message are encrypted with NIP-44 on your device. The encrypted payload is signed by your Button key and broadcast to Nostr relays.
Only group members holding the shared Finder key can decrypt the content.
Relay operators can see: the public key that signed the event, the Finder public key tag, and event metadata (timestamp, event kind). They cannot see the encrypted GPS coordinates or message content.
Messages are encrypted, sealed, and gift-wrapped using NIP-59.
Relay operators can see the outer gift wrap metadata but cannot see message content, the true sender, or the true recipient.
When you sign up or log in, a Kind 30078 event associates your device key with your Nostr identity. The event content (your device private key) is NIP-44 encrypted.
Your Nostr public key and device public key are visible to relay operators.
If you set a display name or avatar, this is published as a standard Nostr Kind 0 event. This information is public by design on the Nostr protocol.
5. Data We Process on Our Infrastructure
We operate a Blossom server for encrypted backup storage (see Section 1) — all data on it is end-to-end encrypted and inaccessible to us. The following additional data processing occurs outside the App:
In-app analytics: We collect anonymous usage events using a self-hosted, open-source analytics solution on infrastructure we control. This data helps us improve the App's reliability and user experience. Analytics events include:
Onboarding and authentication: Login method chosen, permission grants/denials, account creation method. No credentials or private keys are collected.
Alert system: Test and real alert activation, delivery latency, GPS accuracy (in meters, not coordinates), relay delivery success/failure, alert duration.
Invitation flow: Search query type and length (not the query itself), result counts, invitation accept/decline timing, handshake completion.
Group management: Group creation, member counts, group age.
Messaging: Message length and chat type (not message content).
Hardware pairing: BLE pairing steps, success/failure phase, connection stability.
Navigation and errors: Screen views, session duration, error types and crash reports.
Backup and restore: Backup size, restore success/failure stage.
What analytics does NOT collect: message content, GPS coordinates, private keys, Nostr identities, IP addresses, device fingerprints, or any data that could identify you personally. All analytics data is stored on our self-hosted infrastructure and is never shared with third parties.
6. Authentication
The App supports three authentication methods:
1. External Signer (NIP-55) — Your private key never touches the Gart App. Authentication is handled by a separate signing application (e.g., Amber). This is the recommended method.
2. Login with nsec — You provide your Nostr private key directly. It is stored encrypted in your device's secure storage and never transmitted to us.
3. Create New Account — A fresh keypair is generated locally on your device.
In all cases, a device-specific SystemKey is generated locally. We do not receive or store any authentication credentials.
7. Permissions Requested
The App requests the following device permissions:
| Permission | When | Purpose |
|---|---|---|
| Location (GPS) | Required for active alerts | Broadcast your position to your emergency contacts |
| Internet | Always | Connect to Nostr relays |
| Notifications | Always (optional) | Alert you when an emergency is received |
| Background execution | When enabled | Receive alerts while the app is not in the foreground |
| Camera | When scanning QR codes | Add contacts or importing keys |
Location is only accessed during an active alert. GPS is completely off when the App is idle, resulting in zero battery impact. When the alert is stopped, GPS is immediately released.
8. Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Nostr relays (third-party) | Message and alert transmission | Encrypted events, public keys, metadata |
| Gart Blossom server | Encrypted backup storage | Encrypted blobs (opaque to us) |
| Self-hosted analytics (Gart-operated) | Anonymous usage analytics | Behavioral events only — no PII (see Section 5) |
| Google Play | App distribution | Standard store metadata |
We do not use third-party advertising, analytics SDKs, or tracking services in the App.
9. Data Retention
All App data is retained until you delete it or uninstall the App. You can delete individual groups, conversations, or your entire account from within the App.
Events published to third-party Nostr relays are subject to each relay's retention policies. Nostr events are cryptographically signed; they cannot be forged but also cannot be forcibly removed from all relays.
Encrypted backups are retained to ensure data permanency. All stored data is end-to-end encrypted and inaccessible to us.
Analytics data is retained on our self-hosted infrastructure for product improvement purposes. We do not maintain a central database of user accounts, profiles, or activity.
10. Key Rotation and Group Security
When a member is removed from a group:
- A new shared Finder key is generated.
- The new key is distributed to remaining members via encrypted NIP-59 messages.
- The removed member's copy of the old key can no longer decrypt new alerts or messages.
This ensures forward secrecy for group communications after member removal.
11. Children's Privacy
The App is not directed at children under 16. If a parent or guardian becomes aware that their child has used the App and wishes to exercise data rights, they may contact us.
12. Your Rights
We do not process personal data as defined under GDPR. Your data is either stored locally on your device under your control, end-to-end encrypted on infrastructure we cannot access, or collected as anonymous analytics that cannot identify you.
You are in direct control of your data:
Deletion — Uninstall the App or delete your account to remove all local data.
Portability — Your Nostr keys and profile are inherently portable to any Nostr-compatible application.
Opt out of analytics — You may disable analytics in the App settings.
Should you have any concerns about your data, contact us at [email protected].
13. International Data Transfers
The Nostr protocol is global and decentralized. When you publish events, they may be relayed to servers in any jurisdiction. Because all sensitive content is end-to-end encrypted before transmission, relay operators in any jurisdiction cannot access the plaintext content of your alerts or messages.
14. Security Measures
End-to-end encryption: NIP-44 (XChaCha20-Poly1305) for all alert and message content.
Gift wrapping: NIP-59 for sender/recipient metadata protection on chat messages.
Local key storage: Private keys stored in platform-native secure storage (Android Keystore).
Zero-knowledge architecture: We cannot access your data even if compelled to, because we do not have it.
Key rotation: Automatic group key rotation when members are removed.
No central honeypot: No central server storing user data that could be breached.
15. Changes to This Policy
We will update this policy as the App evolves. Material changes will be announced on our website and reflected in the updated policy with a revised "Last Updated" date at the top. Continued use of the App after changes constitutes acceptance.
16. Contact
For privacy questions, data requests, or concerns:
[email protected]