Privacy policy

Last updated: 21 September 2026

Alanya is a mobile messenger based in Yaoundé, Cameroon. This policy explains what we process, including when you connect Google Drive for backup. Contact: alanyapro64@gmail.com.

1. Account data

To create an account: an Alanya number, a password, and optionally a name, handle, photo, email and country. We also keep enrolled devices, your settings (privacy, notifications, appearance) and technical traces needed to run the service (session tokens, login logs).

2. Messages, calls and media

Messages, voice notes, photos, videos, documents and call history go through our servers to be delivered. Ordinary stories expire after 24 hours. Media has a limited lifetime (around 30 days depending on type). This is not an end-to-end encrypted messenger: Alanya can technically read content that transits through the server. We do not use it for advertising.

3. Google Drive and Google Sign-In

If you choose an off-phone backup, Alanya requests Google Drive access with the single scope https://www.googleapis.com/auth/drive.file. That scope limits the app to files it created (or that you explicitly opened with it). Alanya does not list, read or change the rest of your Drive — documents, photos and personal folders included.

In practice Alanya:

• creates a visible folder named Alanya in your Drive;
• stores encrypted archives there (chat history, not media) and a latest.json descriptor;
• may list, replace or delete only those files;
• shows the connected Google account so you can check which Drive the backup uses.

Archives are encrypted (AES-256-GCM) before upload. This is not end-to-end encryption: the key is derived on Alanya's servers, so a backup remains restorable if you forget a password. Alanya can therefore technically decrypt an archive. Every key delivery is logged. The server does not store backup contents: only a date, a size, a key version, a message count, and a masked email (for example a•••@gmail.com) to help you find the right Google account on restore.

You can disconnect Google in the app, delete the Alanya folder in Drive, or revoke access from your Google Account. Alanya does not use Google data for advertising, does not sell it, and does not profile you with it.

Alanya's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Other technical services

• Firebase Cloud Messaging (Google): device tokens for push notifications and missed calls. Not message bodies beyond what the notification shows under your settings.
• Maps: OpenStreetMap tiles (or a provider we configure) during location sharing or a trusted trip. Location is collected only when you start a trip, and shared with the circle you chose.
• Sentry (when enabled): crash traces, stripped of passwords, messages, emails and tokens.
• Payments: if you subscribe to Alanya Plus, the payment provider handles the payment method. We keep subscription status, not the card number.

5. Why we process this data

To provide the service (account, messages, calls, trips, backup), to secure it, to comply with the law, and — only if you subscribe — to run Alanya Plus. Legal bases: performance of the contract and, for some technical traces, legitimate interest in operating and protecting the service.

6. Retention

• Account: until deletion (7-day grace period, cancellable).
• Call history: up to 12 months.
• Login logs: 90 days.
• Revoked devices: 90 days.
• Downloaded GDPR export: 7 days.
• Drive files: for as long as you leave them in your Drive. Deleting them in Drive removes them from Alanya's reach; deleting them in Alanya does not automatically empty Drive.

7. Your rights

In the app: data export (GDPR), account deletion, visibility settings (last seen, photo, read receipts). For anything else, write to alanyapro64@gmail.com. If you are in the European Union you may also contact a supervisory authority.

8. Children

Alanya is not intended for children under 13. We do not knowingly collect their data.

9. Changes

An update to this policy will be dated at the top of the page. A material change to how Google Drive data is used will be announced in the app.