Privacy Policy
Last updated: November 7, 2026 (email)
Dewan.World — Messaging & Social is a small, self-hosted service run by Dewan Mahmud, an independent developer. It has private parts (one-to-one chats, group chats and calls) and public parts (your profile, feed posts, comments and marketplace listings, which everyone signed in can see). We collect only what is needed to run it. We don't sell your data, show ads, or use third-party trackers or analytics.
What we store
| Data | Why |
|---|---|
| Username and password (stored only as a secure hash) | To sign you in |
| Recovery code (stored only as a hash) | To let you reset a forgotten password |
| Email address (required for accounts created from November 2026; optional for older accounts) | To confirm your account, let you sign in with it, and send account and security emails (confirmation, welcome, username recovery, password reset, password or email changed, new sign-in, account deleted, moderation notices). If you choose, also Marketplace emails (on unless you turn them off) and a daily unread-messages email (off unless you turn it on); you can change these in Profile → Notifications or with the link in each email. Emails never contain the text of your messages. Sent through our email provider, Hostinger. Never shown to other users, never used for marketing, never shared. The site owner can see it in the owner dashboard to run the service. |
| Marketplace listings: title, description, price, the area you type, photos, and who saved them | To show your listings to signed-in members until you delete them. Photos are resized on your device, which removes location data. We never store your exact location. The number of views and saves is shown only to you. |
| Your answer that you are 18 or older, and date of birth (optional) | To confirm you are an adult, and show your age only if you add a date of birth |
| Display name, bio, profile photo (optional) | Shown on your profile, unless you turn on anonymous mode |
| Private messages, voice messages, photos and files | To deliver them to the person you send them to. Deleted automatically after 7 days. |
| Call history: who called whom, when, voice or video, and whether the call was missed, declined or answered (with how long it lasted) | Shown in your chat and in the Calls tab, to you and the other person. Never what was said or seen. Deleted automatically after 7 days, like messages. |
| Push notification tokens of your phones (Android and iPhone apps) | To send new-message and incoming-call notifications to your phone. A token belongs to one sign-in: it's deleted when you log out, change your password, or the sign-in expires (30 days). |
| Marketplace chats: which item a chat is about (its title), the buyer and the seller, their text messages, and how far each of them has read | To keep each item's conversation separate from your personal chats and show it to the two of you. Messages are deleted automatically after 7 days. If you remove a chat, it's hidden from you only. If you report someone from a Marketplace chat and choose to share messages, the moderators see that person's messages in that chat. |
| Group chats: the group name, who is in it (and who added them), and its text messages | To deliver group messages to the group's members. Group messages are deleted automatically after 7 days. A group is deleted when its last member leaves. |
| Reactions and post likes | Shown to the people in the chat, or as a count on the post |
| Public posts and comments (text only) | Shown to signed-in users in the feed |
| Delivered/read times, last-seen time | To show message status and online status. You can hide your last-seen time or appear offline (Settings → Privacy). |
| Blocks and reports | To keep users safe and moderate the service |
| A log of staff actions (bans, role changes, removed posts) | Accountability for how administrators use their access |
| A sign-in cookie, and a device cookie | To keep you signed in, and to recognise a browser or phone you've signed in on before, so we can warn you by email when your account is used on a new one (we keep only a coded version of the device cookie and a label like “Chrome on Windows”). No advertising or tracking cookies. |
| A record of notification emails sent (which kind, and which chat or listing it was about) | So you don't get the same email twice or too many. No addresses or contents. Deleted after 30 days. |
Profile photos are cropped and re-saved by your browser before upload, which removes location and camera data. The microphone is only used while you record a voice message or are in a call, and the camera only during a video call.
Voice and video calls
- Call sound and video are encrypted in transit (WebRTC, DTLS-SRTP) and go directly between the devices whenever possible. Our server only passes the short setup messages that connect the call. We never record, store or listen to calls. The call history described above is the only thing kept.
- To find a direct connection, your device contacts a public connection-helper (STUN) server run by Cloudflare or Google, which sees your IP address. If a direct connection isn't possible, the call is relayed through a relay (TURN) server, ours or Cloudflare's; it only forwards the encrypted call data.
- Because the connection is direct, the person you call can see your IP address, which may show your rough location. Only call people you trust.
Place suggestions (Marketplace)
When you type in an "Area or city" field, our server looks up matching place names from OpenStreetMap (the Photon service run by Komoot). Only the words you type are sent, from our server, so the service never sees your IP address. If you choose Use my current location, your device asks for permission first; your position is rounded to about 1 km on our server before the lookup and is not stored. Place data © OpenStreetMap contributors.
The phone apps
The Dewan.World apps for Android and iPhone show this same service. They ask for the microphone (voice messages and calls) and the camera (video calls) only when you first use them, and for permission to show notifications (new messages, missed and incoming calls; on the lock screen messages only say "New activity"). Incoming calls can ring on the lock screen with Answer and Decline. During a call, Android shows an "ongoing call" notification so the call keeps working when you switch apps. The apps use audio settings to switch call sound between the earpiece, the speaker, headphones and Bluetooth. They contain no advertising or analytics code and collect nothing beyond what is described on this page.
Push notifications reach your phone through Google Firebase Cloud Messaging (Android) or the Apple Push Notification service (iPhone), which deliver them for us. A notification contains who it's from and, for messages, a short preview of the text (or "Voice message", "Photo"); a call notification contains the caller's name and the call type. Google and Apple handle this data under their own privacy policies. If you'd rather not have previews pass through them, turn notifications off for Dewan.World in your phone's settings.
Who can see it
- Everyone signed in can see your username, your public profile (display name, photo, age, bio), your feed posts and comments, your marketplace listings, and whether you're online (unless you choose otherwise below). An anonymous profile hides your photo, name, age, birthday, bio and online status.
- Only you and the people in a chat can see its messages, voice messages and files, and the calls between you. The app has no feature that lets staff read them.
- Invisible (Settings → Privacy): nobody sees you online or typing, and you don't appear in the Online list, including for moderators. Last seen: Nobody hides when you were last online. People you chat with still see when you've read their messages.
- Moderators see reports, and the reported person's recent messages only if the person reporting chooses to share them.
- Messages are stored on our server and are not end-to-end encrypted. People who maintain the server (the owner, and any developer the owner authorises) have technical access to stored data. They may only use it to keep the service running, fix problems or comply with the law, never to read private messages out of curiosity, and they must follow this policy.
- We don't sell, rent or share your data with advertisers or data brokers.
Where it's stored
On our own server, in a PostgreSQL database protected with encrypted connections (HTTPS). Regular backups are kept on the same server for recovery.
How long we keep it
Dewan.World is a beta service: we may delete data when features change, and we don't guarantee that anything is kept (see the Terms). Private messages, Marketplace chat messages, voice messages and shared files are deleted automatically 7 days after they're sent, and shared files are not included in our backups. Profiles, posts and comments are kept until you delete them or delete your account. When you delete your account (Profile → Delete account), your profile, photo, messages, voice messages and posts are deleted immediately. Copies in backups are overwritten over time.
Your choices
- Edit your profile, use an anonymous profile, appear invisible, or hide your last-seen time at any time (Settings → Privacy).
- Turn notifications on or off for Dewan.World in your phone's or browser's settings.
- Block people so they can't contact you or see you online.
- Delete posts you've made, or your whole account: in the app, Profile → Delete account. See how to delete your account (also by email).
Children
Dewan.World is only for people aged 18 and over. We remove accounts we believe belong to someone younger. Use Report → May be under 18 to tell us.
Changes and contact
We will update this page if anything changes. For privacy questions, requests about your data, or to report an incident, email [email protected]. You can also use Report in the app. See also our Terms of Use.