No Bars Given Privacy Policy

Last updated: August 2026

Our Commitment

No Bars Given is designed for private, account-free communication. This policy describes what the app keeps on your device, what it sends when you use mesh or optional internet features, and how long local data can remain.

Summary

No project-operated accounts or messaging servers — Bluetooth mesh is peer-to-peer; optional internet features use public or user-selected Nostr relays.
No analytics, advertising, telemetry, or tracking — the app does not contain an analytics or advertising SDK.
No sale of data — the project does not sell user data or build advertising profiles.

What No Bars Given Stores on Your Device

Identity and cryptographic keys - Noise, signing, group, prekey, and optional Nostr identity material is generated locally. - Secret keys are stored in the system keychain as device-only items. Public keys are shared when required for messaging, verification, groups, or Nostr events. - Keys remain until they are rotated, removed by the relevant feature, or erased with panic wipe. Because operating-system keychains can outlive an uninstall, No Bars Given records a non-secret install marker and deletes surviving app keys before use after a later reinstall.
Nickname, preferences, and relationships - Your nickname, settings, favorites, petnames, read-receipt identifiers, and bounded operational metadata are stored locally. - The share extension can retain one item you choose to share in the app-group preferences for up to 24 hours. The app shows the destination and a preview for review; it does not send the item automatically. The item is cleared when you add it to the composer, cancel, panic-wipe, or it expires.
Private group state - Group names, rosters, creator identity, and key epoch are stored as protected files in Application Support. - Current group keys are stored in the keychain. Group state remains until you leave or remove the group, panic-wipe the app, or remove the app.
Queued and carried private messages - An outgoing private message that has not been acknowledged may remain for up to 24 hours in a bounded, encrypted outbox. The outbox is sealed with ChaCha20-Poly1305 and its key is stored in the keychain. - A device acting as a courier may store a bounded opaque end-to-end encrypted envelope for another user for up to 24 hours. The courier cannot read its message content. - A panic wipe deletes both stores.
Recent public mesh messages and notices - Signed public mesh messages may be kept in a protected local gossip archive for up to 6 hours so they can cross mesh partitions and survive a relaunch. - Public bulletin-board posts and deletion tombstones persist until the post's author-selected expiry, at most seven days. Both stores are bounded and panic-wipeable. - These items are public to the mesh or board where they are posted; they are not confidential messages.
Media attachments - Voice notes and images you send or receive can be stored under Application Support so they remain playable while referenced by the app. - Incoming media is subject to a 100 MB quota with oldest-file eviction. All stored media, sent and received, is also deleted once it is more than seven days old, and immediately by panic wipe or app removal.
Optional location-channel state - Your selected geohash channel, bookmarks, teleport flags, and bookmark display names are stored locally so the UI can restore them. - Per-geohash Nostr identities are derived locally from a device seed stored in the keychain. - Location-channel features do not persist exact latitude or longitude and do not include exact coordinates in mesh or Nostr messages. Crew location sharing is different — see below.
Crew location sharing (the live map and AR totems) - When you turn location sharing on, No Bars Given broadcasts your exact current coordinates over the Bluetooth mesh, roughly every 10 seconds, so your crew can see you on the map and in AR. - Each beacon is encrypted with your crew's shared key (ChaCha20-Poly1305) before it leaves the device. Only current members of your crew can read it. Other devices nearby relay the sealed beacon without being able to decrypt it. - Beacons are ephemeral: they are never written to disk, never gossip-synced, and a received position is dropped after roughly ten minutes of silence. Leaving or being removed from a crew rotates the key, which ends your ability to read that crew's positions and theirs to read yours. - Nothing is sent to any server: there is no operator of this app who can see your location at any time. - Turning sharing off stops the broadcasts immediately.
Favorite artists and taste matching - Artists you mark as favorites are stored locally on your device. - If you explicitly start Find Your People, the app broadcasts your display name and up to 16 compact tags derived from your favorite artists to nearby strangers over Bluetooth. These taste beacons are intentionally unencrypted so nearby devices can compare interests. - Taste beacons travel one hop only, are not relayed or written to disk, and stop when you leave the finder screen. Matches disappear after roughly 90 seconds without a new beacon. - Artist names are represented on the wire by truncated hashes, but because the festival lineup is public and finite, nearby users may be able to determine which artists those tags represent. Do not use Find Your People unless you are comfortable sharing those interests and your display name with nearby strangers.
Ranger on-device guide - Ranger prompts, responses, and retrieval from the bundled festival guide are processed on your device using Apple's on-device language-model system and the app's bundled adapter. - Ranger chat content is not sent to the project or an external AI service. If you choose to post a Ranger response into a conversation, that posted message is shared under the rules for that conversation.

Temporary Session Data

While running, No Bars Given maintains active connections, routing state, deduplication state, and bounded in-memory conversation timelines. Closing the app clears the in-memory timelines and active connections, but it does not erase the persistent stores listed above.

What Is Shared

With Nearby Mesh Users

Depending on the feature you use, nearby peers can receive:

Your chosen nickname and public Noise/signing identity material.
Announce metadata such as supported capability flags and a bounded list of short direct-neighbor identifiers. When the bridge is enabled, an announce can also include its coarse rendezvous geohash cell.
Public mesh messages, public notices, and group-control packets you intentionally send.
Private ciphertext addressed to them, or opaque courier ciphertext they agree to carry.
Radio metadata available to the receiver, such as approximate Bluetooth signal strength.
While Find Your People is active, your display name and compact tags for up to 16 favorite artists. These taste beacons are unencrypted, limited to direct nearby peers, and are not relayed.

Noise identity keys can persist across sessions; do not treat them as anonymous identifiers. Panic wipe rotates local identity state.

With Private Group Members

Private group members receive the group's name, roster, key epoch, and encrypted group traffic needed to participate. Group messages are confidential to devices holding the current group key, subject to the security of those devices and members.

With Nostr Relays and Internet Gateways

Internet-backed features are optional. When enabled or used:

Private fallback messages use DigiTotem's app-specific encrypted envelopes. This format is not NIP-17, NIP-44, or NIP-59 compatible. Relays can observe the recipient public-key tag, event timing and size, and network metadata, but not the message plaintext or stable sender identity.
Public location-channel messages, notes, notices, and presence include a geohash tag, event kind, timestamp, and a public key. A geohash reveals an approximate area; finer precision reveals a smaller area.
The optional mesh bridge publishes bridge-enabled public mesh messages and presence to a neighborhood rendezvous cell. Those messages are public to participants and relays for that cell. A per-message “nearby only” choice prevents that message from crossing the bridge.
Bridge courier drops contain opaque end-to-end encrypted envelopes and a rotating recipient tag. Relays still observe timing and network metadata.
A device with gateway features enabled may relay signed bridge/location traffic or opaque courier envelopes for nearby mesh devices.

Nostr relays are operated by third parties. Their retention, logging, availability, and privacy practices are outside the project's control. Public events and encrypted events may remain on relays according to each relay's policy.

You can add relays yourself in settings, including .onion addresses. Added relays are stored locally, are limited in number, and are erased by panic wipe. Tor routing is on by default; while it is off, every relay you connect to can see your IP address, including relays carrying your private messages.

Location and Apple Services

Location permission is requested as when-in-use access and, together with Bluetooth, is required to complete onboarding and use the main crew experience. It is used for the crew map and AR totems, and to compute geohash channels, bridge rendezvous cells, and nearby place labels.

Exact coordinates are not included in location-channel (geohash) or Nostr payloads and are not persisted by No Bars Given.
Crew location sharing is the exception and is opt-out at any time: while it is on, your exact position is broadcast over Bluetooth, encrypted so that only your crew can read it. See "Crew location sharing" above.
A selected geohash can still reveal an approximate area to peers and relays.
When No Bars Given asks the operating system for a friendly place name, Apple's CLGeocoder service may process the location under Apple's privacy terms.
Revoking location permission stops live location sampling. Saved bookmarks remain until you remove them, panic-wipe the app, or remove the app.

Microphone, Camera, and Media Permissions

Microphone access is used only while you record a voice note or actively hold live push-to-talk. The resulting audio is sent to the mesh conversation you selected; public-conversation audio is public to that mesh, while private-conversation audio uses the private transport protections described below.
Voice-note and live-audio files can remain in Application Support under the media retention rules above.
Camera access is optional and requested only when you open a QR scanner or an AR feature. It is used to scan peer-verification and crew-invite QR codes and to place totems in the AR camera view. Photo-library access is used when you choose an image to send.
These permissions can be revoked in system settings. No Bars Given does not record microphone or camera input while the related capture UI is inactive.

Cryptography

Private and public features use different protections:

Mesh private sessions use Noise XX with X25519, ChaCha20-Poly1305, and SHA-256.
Private group messages use ChaCha20-Poly1305; group state and relevant mesh packets use Ed25519 signatures.
Nostr events use secp256k1 Schnorr signatures. DigiTotem private envelopes use secp256k1 key agreement, HKDF-SHA256, and XChaCha20-Poly1305. The envelope format is proprietary, only interoperates with DigiTotem clients, and does not provide forward secrecy against later compromise of the recipient's static Nostr private key.
The persistent private-message outbox uses ChaCha20-Poly1305 with a key held in the keychain. Some other protected local identity state uses AES-GCM.
Public mesh, bridge, geohash, and board content is signed or authenticated as appropriate but is intentionally not confidential.

No cryptographic system can protect content after a recipient reads, copies, screenshots, or exports it.

Data Retention Summary

In-memory chat timelines and active connections: until the app closes or state is cleared.
Queued outgoing private messages: until acknowledged, dropped by bounded policy, or 24 hours, whichever comes first.
Opaque courier envelopes: until handed off, evicted by bounded policy, or 24 hours, whichever comes first.
Recent public mesh gossip: up to 6 hours.
Public board posts and tombstones: until expiry, at most seven days.
Media: seven days, or sooner by quota eviction, panic wipe, or app removal.
Groups, favorite peers, favorite artists, preferences, identity keys, and bookmarks: until removed by the feature, panic wipe, or app removal.
Taste matches: in memory while Find Your People is active; a match expires after roughly 90 seconds without a new beacon.
Nostr data: according to the policies of the relays that receive it.

Your Controls

Panic wipe: Triple-tap the logo to synchronously cancel in-flight media work and clear local keys, sessions, preferences, groups, queues, carried mail, public archives, board data, and media managed by the app.
Notification previews: Hidden by default, so lock-screen alerts do not show message text, sender names, or geohashes. Full previews can be turned on in settings.
Clearing a conversation: Clearing the mesh timeline also deletes the recent public gossip this device had stored on disk.
Feature controls: Location channels, mesh bridge, internet gateway, and related internet behaviors can be disabled in the app. Some already-published relay data cannot be recalled.
System permissions: Bluetooth, location, microphone, camera, and photo-library access can be revoked in system settings.
No account: The project operates no account record for you to request or export.

What the Project Does Not Do

No Bars Given does not:

Operate an account database or project-owned messaging backend.
Include advertising, analytics, or tracking SDKs.
Sell user data or create advertising profiles.
Send your location to any server, or to anyone outside the crew you chose (crew beacons are encrypted end-to-end on the mesh).

Children's Privacy

The project does not knowingly operate a service that collects children's personal data. The app has no account registration or age-verification system. Users and guardians should understand that public mesh, board, bridge, and location-channel posts are visible to other participants and may be relayed.

Changes to This Policy

Material behavior changes will be reflected in this document and its “Last updated” date. Updating this policy cannot retroactively retrieve data that remained only on a user's device.

Contact

For privacy questions:

Email: jamesbassomatic [at] gmail [dot] com