Privacy Policy

Every message is encrypted on your device before it leaves it, using the Double Ratchet protocol with an X3DH handshake. The server stores only opaque ciphertext: it never holds your plaintext, and it never holds a key that could reveal it.

Message rows carry no readable sender or recipient name — routing uses blinded, rotating delivery tokens. Ciphertext is padded so that message length reveals nothing about content.

Delivered messages are removed from the server automatically. The default retention window is 24 hours, with a visible countdown in the app. Self-destructing messages burn on your device after you open them.

Attachments are encrypted on your device with a key that exists only on your device and your recipient's. What is uploaded is an encrypted blob: we cannot open it, preview it, scan it, thumbnail it or restore it.

Attachments follow the same automatic deletion schedule as messages. Once removed, they are gone — there is no backup copy.

Your display name, status and avatar are encrypted and shared only with contacts you have explicitly added. There is no public directory and no searchable profile — nobody can find you by browsing.

Your username is stored blinded. No phone number and no email address is required to use Panthera.

Operational metadata strictly needed to move ciphertext: encrypted rows, their approximate size, masked delivery tokens and coarse timestamps. Nothing more.

Administrative tooling is limited to counts and sealed metadata. It cannot display usernames, plaintext, attachments, private keys, or any path to decryption. No advertising, no profiling, no tracking, no sale of data — ever.

Private keys are generated on your device and wrapped with your passphrase using Argon2id. They never reach any server.

If you lose your passphrase, your account and its content are permanently unrecoverable. This is a deliberate design property, not a limitation: no operator, no administrator and no court order can unlock what nobody holds a key to.

Because content is end-to-end encrypted and identifiers are blinded, the amount of personal data we could produce, correct or export is minimal by construction. You can delete your data directly in the app at any time: wiping a conversation or your account removes it from your device and from the service.

Where privacy law grants you rights of access, rectification, erasure, restriction, objection or portability, you may exercise them by contacting us. We will respond within the periods the applicable law requires, and will explain plainly where encryption means the data simply does not exist in a readable form.

Panthera S.E.M.S is a communications service. It is provided "as is", without warranty of any kind. Panthera holds no responsibility or liability whatsoever for how the application is used, for the content users choose to send, or for any loss, damage or consequence arising from its use, to the fullest extent permitted by applicable law.

You are solely responsible for your own conduct and for complying with the laws that apply to you. Unlawful use is strictly prohibited.

Panthera operates lawfully and will comply with every valid legal obligation applicable to it. Where a lawful, properly served request is received, we can only ever provide what actually exists: encrypted, unreadable data and minimal operational metadata. We cannot hand over plaintext, photos, keys or passphrases, because we do not have them.

Panthera is a service that holds privacy in the highest regard — privacy is the product, not a feature added on top.

If this policy changes, the updated version will be published on this page with a new date. Material changes will be announced in the app.