Privacy policy

Effective date: [DATE]

Who we are: Chat7 is made by Managed Softwares LLC ("we", "us"), [POSTAL ADDRESS]. Managed Softwares LLC also makes Northdesk, the software many contractors use to run their business. Chat7 runs on the same servers as Northdesk.

Contact: support@getchat7.com

1. The short version

• Your chats, calls and Snippets are end-to-end encrypted. They are encrypted on your device and can be decrypted only on the devices of the people you are talking to. We can't read them.
• We do see some metadata: who is in which conversation, when messages are sent, roughly how big they are, and your phone number and profile. We explain exactly what below.
• People who have your phone number can find you on Chat7 and message you, as on other messaging apps. You can turn off Let people find me by my number, and you can turn on Message requests so first messages from people who aren't in your contacts wait in a separate Requests folder. You can block anyone.
• We never store your address book. If you turn on contact matching, the numbers are compared and then forgotten.
• Dex, the AI rundown, is off unless you turn it on. When you use it, your phone sends the text of the chats you chose to an AI provider to write your rundown. That text leaves end-to-end encryption for that request, at your choice.
• If you work with a contractor who uses Northdesk, the projects, tasks, bids and documents you share with them are not end-to-end encrypted. They are stored securely on our servers so both of you can see them, and they are part of the contractor's business records.
• We don't sell your personal information, we don't show ads, and the app and website contain no third-party trackers.

2. What end-to-end encryption means here

Messages (text, photos, videos, voice notes, files, reactions, edits and delete notices), group names and photos, call audio and video, and Snippets are encrypted on the sender's device with keys that only the recipients' devices hold. Our servers store and pass along encrypted data they cannot decrypt. Your private keys never leave your devices, except inside an encrypted backup that only you can unlock (section 6).

End-to-end encryption protects the content of what you send. It does not hide that you are using Chat7, who you talk to, or when. A device that is already unlocked, a screenshot, or a person you send a message to can still share what you sent.

3. Information we collect and why

3.1 Information the server can see

3.2 Information the server cannot see

• The text of your messages, captions and file names
• Your photos, videos, voice notes and files (in readable form)
• Reactions, edits, delete notices, group names and group photos
• Call audio and video
• Snippet text and media
• Your private keys, your backup passphrase or recovery key
• Which chats you included in Dex, and the rundowns Dex writes
• Your starred messages and per-chat settings (synced between your own devices, encrypted)
• Your address book

3.3 What end-to-end encryption does not hide

We still know who talks to whom and when, conversation membership, the approximate size of messages, and your profile. We may be required to disclose this metadata to authorities (section 10). We cannot disclose message content because we don't have it.

4. Phone numbers and contact discovery

• You sign up with a US or Canadian mobile number. We send a verification code by text through our SMS provider.
• Findable by your number. Let people find me by my number is on by default: someone who has your number (in their address book, or typed in) can see that you use Chat7, see your name, photo and "about", and message you. If you turn it off, people can't find you by your number; they can still reach you if you message them first, if you share a QR or link code, if you are in the same group, or if a contractor you work with invited you.
• Message requests (off by default). If you turn it on, a first message from someone who isn't in your contacts and whom you haven't messaged goes to Requests instead of your chats. You can read it, then accept (it moves to your chats), delete it, block the sender or report it. Until you accept, the sender doesn't see when you read their messages or whether you are online, and isn't told if you delete the request. The notification says only "New message request". With Message requests on, only your contacts can add you to groups, and only your contacts see your online status and last seen.
• Contact matching is a separate switch. If you turn it on, your phone sends the phone numbers in your address book, in batches, over an encrypted connection. Our server converts each number into a keyed hash using a secret key that stays inside our database, compares the hashes with the people who can be found by their number, keeps only the matches, and discards the numbers. We never store your address book. Limits: up to 1,000 numbers per request and 5,000 per day. When someone else matches your number, we keep that match (that they can reach you), not their address book.
• We don't send "your contact joined" notifications.
• Chat7 never shows your phone number to other users; contractors you are linked to already have it in their own records.

5. Business chats, Projects and Work (contractors and subcontractors)

If a contractor who uses Northdesk invites you, or you work as a subcontractor:

• Business chats with the contractor are end-to-end encrypted between your devices and the devices of the contractor's team members who handle these chats. When the contractor's team changes, people who left lose access to new messages, and new team members can see the conversation's history. The app tells you "[Company]'s team can see this conversation".
• Projects shows information your contractor chose to share about your job (as on the contractor's client page).
• Work (for subcontractors) shows tasks, bids and documents. Task details, files the contractor shared, the photos, files and notes you send when you mark a task done, bids you submit, and the documents you upload (insurance certificate, license, W-9) are business data. They are not end-to-end encrypted. They are stored on our servers, visible to the contractor's managers, and kept as part of the contractor's records.
• Documents: your insurance certificate (COI) and license are shared with every contractor you are linked to unless you turn that off. A W-9 is shared only with a contractor you explicitly choose, because it contains your tax ID.
• Company Snippets posted by a contractor for its clients or subs are business posts and are not end-to-end encrypted. The app labels them.
• The contractor is responsible for its own use of the business data it receives, under its agreement with us and its own privacy obligations.

6. Linked devices and encrypted backup

• You can link up to 5 devices. A new device is linked by scanning a QR code with a device you already use.
• Encrypted backup is optional. If you turn it on, your device encrypts your message keys (and, if you choose, your message history) with a recovery key or a passphrase only you know, and uploads the encrypted file. Your recovery key can be saved in iCloud Keychain or Google Block Store on your device's platform, or you can write it down.
• We cannot read your backup and cannot reset your passphrase. If you lose your phone and your passphrase or recovery key, your history cannot be recovered.
• If you sign in on a new phone without your old phone or a backup, Chat7 creates new keys; your contacts see that your security code changed.

7. Dex rundown (optional AI summaries)

• Dex is off by default. You turn it on in Settings → Dex after reading a consent screen, and you pick which chats to include. That list stays on your devices.
• When you open the app (if your last rundown is older than 6 hours) or tap Catch me up or Summarize this chat, your phone takes the decrypted messages from the chosen chats and sends their text to our Dex service, which forwards it to Anthropic (the maker of the Claude AI models) to write the rundown and streams the answer back to your phone.
• This takes that text outside end-to-end encryption for that request, at your choice.
• Our Dex service does not store the text or the rundown and does not log request or response contents. We record only how many AI tokens you used each day, for limits and, later, billing.
• Anthropic processes the text to produce the rundown. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
• The rundown is stored only on your device, for 7 days.
• Chats where any member turned on Block AI summaries, deleted messages and messages from people you blocked are left out. Our apps respect Block AI summaries; a modified app or a screenshot can't be stopped.
• Other members of a chat are told that members may use AI summaries ("AI summaries: used by some members").
• Translation and voice transcription, if you turn them on, work the same way: your device sends that text or audio through a pass-through service to an AI provider after a one-time opt-in, and we don't store it.
• You can turn Dex off at any time; your phone stops sending text.

8. Reports, blocking and safety

• You can block a person or a company, and report a person, message, Snippet, task or Dex rundown.
• Because we can't read messages, a report includes your own decrypted copy of the reported message and up to the 5 messages before it. Media is included only if you choose to attach it. The app shows you exactly what will be sent before you send it.
• Reports are reviewed by our team and kept for 1 year.
• We use content-free signals to limit abuse: account age, how many new chats you start with people who don't have you as a contact (limited per hour and per day), sending rate, how often your message requests are deleted and how often you are blocked or reported (which slows down or pauses new chats with strangers), forward counts, invite volume and, optionally, a phone-number reputation check at sign-up.
• We do not scan the content of messages or media, because we can't. See our Acceptable Use Policy for what happens to reported content, including reports to the National Center for Missing & Exploited Children (NCMEC).

9. Who we share information with

We share personal information only as needed to run Chat7, with service providers bound by contracts:

We also share information:

• With contractors you are linked to, as described in section 5.
• To comply with law, a valid legal process, or to protect someone's safety (section 10).
• In a business transfer (merger, acquisition or sale of assets), subject to this policy.

We do not sell personal information and we do not "share" it for cross-context behavioral advertising (as those terms are used in California law). Chat7 has no ads.

10. Law enforcement requests

We respond to valid legal process. We can provide only what we have: the account and metadata in section 3.1. We cannot provide message content, call content, Snippets, backups or rundowns, because we cannot decrypt them.

11. How long we keep information

12. Deleting your account

You can delete your account in the app (You → Settings → Delete account) or by request at getchat7.com/delete-account. Deletion removes your devices, keys, backup, profile, contact matches, Snippets, Dex settings and your own documents, ends your links with contractors, and deletes your login.

What remains:

• Messages other people already received stay on their devices. We can't change that.
• Encrypted messages you sent stay on our servers, unreadable to us, until they expire or the conversation is deleted, shown as from "Deleted account".
• Task evidence and bids you sent to a contractor are part of the contractor's records and remain with the contractor.
• Reports about you or by you are kept for 1 year.
• We may keep limited records where the law requires it.

13. Your rights

Depending on where you live, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, and not be discriminated against for using these rights.

• California residents (CCPA/CPRA): you can ask to know, delete and correct personal information, and you can use an authorized agent. We don't sell or share personal information and don't use sensitive personal information for purposes that require a right to limit.
• Other US states with privacy laws: similar rights; you may appeal a denial by replying to our response.
• Canada (PIPEDA and provincial laws, including Quebec): you can access and correct your personal information and withdraw consent. Our servers are in [REGION]; your information is processed there.

Most of your information can be viewed, changed or deleted in the app. For anything else, email support@getchat7.com. We will verify your request through your phone number.

14. Children

Chat7 is for people 18 and older. You confirm your age when you accept the terms. We do not knowingly collect information from anyone under 18; if we learn that we have, we delete the account.

15. Security

We use end-to-end encryption, encryption in transit, private storage, row-level access rules in our database, and limits against abuse. We plan an independent security review of our encryption before public launch [update when complete]. No system is perfectly secure; if we learn of a breach affecting you, we will notify you as the law requires.

16. The website

getchat7.com has no analytics, no advertising and no tracking cookies. Our host keeps standard server logs (such as IP address and pages requested) for security. The site loads nothing from other companies' servers (no fonts, scripts or images from third parties).

17. Changes

If we change this policy in a way that matters, we will tell you in the app before the change takes effect. If a change affects Dex, we ask for your consent again.

18. Contact

Managed Softwares LLC, [POSTAL ADDRESS] support@getchat7.com