NCraft Privacy Policy

Effective: 26 October 2026 · Applies to NCraft for macOS (live.ncraft.browser), NCraft for iPhone and NCraft for Android (live.ncraft.mobile) and NCraft for Windows, from the App Store (including TestFlight), the Mac App Store, Google Play, the Microsoft Store or a direct download (including the Android app from dl.ncraft.live) · Developer: Aleksandr Pavlov, an individual ("we") · Contact: support@ncraft.live

This English text is the binding version. Translations are provided for convenience; if they differ, the English text applies.

The short version

• NCraft has no accounts, no passwords and no server that stores your data. Your identity is a key created on your device.
• A backup of your 24 words is kept in your own iCloud Keychain (Mac, iPhone) or Windows Credential Locker, never on our servers. NCraft for Android keeps no backup in the cloud.
• Messages, notes and tasks go directly between the devices of the people in a group and are end-to-end encrypted. We cannot read them.
• Voice calls go between the devices in the call, encrypted. Our servers never carry them, and calls are not recorded. The microphone is used only during a call.
• Our three rendezvous servers help devices find each other. They see network addresses, but no content, names or groups, and they keep nothing on disk.
• NCraft contains no analytics, advertising or tracking. Its only third-party SDK is Google Firebase Cloud Messaging in NCraft for Android, used only to wake the phone for notifications and calls (section 3).
• The App Store privacy label for NCraft is "Data Not Collected".

The rest of this policy explains exactly what leaves your device, who can see it, how it is protected and how to remove it.

1. Your identity

When you start NCraft it creates on your device:

• an identity key (Ed25519), which NCraft shows you as 24 words;
• a device key that cannot be copied out of the device: on a Mac and an iPhone it is kept in the Secure Enclave; on Android in the Android Keystore, in the phone's secure hardware; on Windows in the TPM, or in the Windows software key storage on a computer without a usable TPM.

We never receive these keys or the 24 words. The identity key is kept in NCraft's encrypted database on the device (section 7), so a device that holds it can show you the words again.

Backup of the 24 words. So that you can get your identity back on a new device, a device that holds the identity key keeps a backup of the 24 words, together with the signed list of your devices, in your platform's password storage:

• on a Mac and an iPhone — in iCloud Keychain, which Apple syncs to your devices signed in to the same Apple Account;
• on Windows — in Windows Credential Locker for your Windows user. If you sign in to Windows with a Microsoft account and password sync is on, Windows may sync it to your other computers; with a local account it stays on this computer;
• NCraft for Android keeps no backup in the cloud: keep your 24 words written down.

We never receive the backup. Anyone who can open your iCloud Keychain or your Windows account can use it to take your identity, so protect these accounts as you protect the words. You can delete the backup when you forget your identity (section 8).

Your profile has a name (required), an optional nickname and an optional picture. These are shared with every group you belong to, so that members can recognise you. The optional e-mail field in your profile stays on your device and is never sent anywhere, except when you put it into a report to us yourself (section 6).

2. What other people in your groups can see

A group is a set of people who chose to talk to each other. Everything you publish in a group — messages, topics, notes, tasks, reactions — is encrypted on your device (MLS, RFC 9420) and delivered to the other members' devices. Each member keeps their own copy. When you link another device of your own, it receives your groups and their history.

• Pages. When you start a topic or a note on a web page, that page's address without the query string and anchor is added to the group so members can open it. Simply visiting a site does not send anything to a group. Private tabs never add anything to a group.
• Direct connections. When your device connects directly to another device (messages, sync, pairing, calls), that device learns your IP address, as with any peer-to-peer connection.
• Voice calls. You can call a person or a group of up to six people. The microphone is used only while a call you started or answered is on. Voice goes to the other devices in the call over the same encrypted connection as your messages (DTLS, authenticated by your device key) — directly, or through the group's own relay if the group has one (section 3). Our servers never carry or see it. Calls are not recorded. In Push-to-talk mode your voice is sent only while you hold the key or button, and only while the NCraft window is active; NCraft does not monitor your keyboard in other apps.
• Remote actions. Members of your groups can send your NCraft requests, but only within the rights you allow. By default a member may point at or highlight something on the page you have open and read that group's own data. Seeing your open tabs and page addresses, scrolling, navigating, typing, clicking, writing on your behalf, files on your disk and logs are off until you turn them on; tabs and disk access can be given only to a particular person, never to a whole group, and dangerous rights need a typed confirmation. A group's policy can only narrow your rights, never widen them. Private tabs are never visible to remote requests. While someone shows or acts on your screen, NCraft names them and shows a Stop button. A journal of remote requests is kept on your device for 30 days. You can change or revoke any right per group and per person in Rights and Member rights.
• Logs. Your diagnostic logs are visible to another person only if you grant it, with a level you choose and, if you wish, an expiry; by default they see only errors and warnings. Logs are built only from fixed event names, numbers and hashes that change with every launch: they never contain invitation or pairing codes, verification digits, your 24 words, keys, tokens, passwords, names, message text or page addresses. Whoever reads your logs sees only the events of that group and their own requests, but can still see technical activity, such as when and how often your device syncs with the group.
• Bots. A bot is a group member run by a person — usually the group owner — on their own computer or server. It receives what a member receives and can act only within its rights. Its operator decides what the bot does with what it receives, including passing it to other services. We never add bots to your groups.

3. What our servers and relays see

Rendezvous servers. NCraft uses three rendezvous servers (asia.ncraft.live in Singapore and eu.ncraft.live in France, both hosted by Contabo, and ru.ncraft.live in Russia, hosted by Selectel) only to help devices find each other, open direct connections, exchange invitation codes and send wake-ups (notifications and calls). Your device connects to whichever of them answers first; ru.ncraft.live is there for people who cannot reach the other two. All three run the same software and work the same way.

• They see your IP address, packet sizes and timing, and short-lived random identifiers by which the devices of a group find each other (these change every hour). They do not see who you are, your name, which groups you are in, or any content: they hold no keys.
• They keep this information in memory only, for seconds to minutes (for example a presence record lives 90 seconds), and do not write it to disk or log requests. Only aggregate counters without addresses are kept.
• When you invite someone with a code, the server holds the invitation window and passes the encrypted key exchange between the two devices; you both confirm six digits to be sure no one is in between.
• So that members connected to different servers still find each other, the three servers pass to each other the random identifiers of the devices connected to them, open invitation windows and the encrypted signals between devices — nothing else. These copies are also kept in memory only, for at most 75 minutes, and are forgotten when the link between two servers drops.

Notifications on macOS. If you allow notifications on a Mac, NCraft can wake it when it is not connected. Your Mac receives a push address from Apple; our server returns it sealed with a server key, and the sealed address is shared, encrypted, with your groups. When a member's device needs to wake yours, it sends the sealed address and an encrypted payload (the kind of event, the group, the author and the place — never the text of a message) to our server, which opens the address and passes the payload to the Apple Push Notification service. Our server sees the push address and the time of sending, cannot read the payload and does not store either. The group owner chooses which events may wake members; you can turn down your own notifications. NCraft for Windows shows notifications only while it is running and does not use a push service.

Notifications and calls on iPhone. On iPhone, NCraft wakes the device the same way as on a Mac, through the Apple Push Notification service. For incoming calls, your iPhone also receives a second address from Apple — for calls (VoIP push, PushKit); it is sealed and shared with your groups the same way. When a member calls you while NCraft is closed, their device wakes your iPhone through this address: the system shows the call screen at once, while who is calling, the call number and the group travel in a payload encrypted with the group key — our server sees only the address, the time and that it is a call or the end of one. If you answered on another device or the call was cancelled, an end signal comes the same way and the call screen goes away. NCraft calls are not added to the phone's call history.

Notifications and calls on Android. When NCraft for Android is set up with your identity, it gets a push address (token) from Google Firebase Cloud Messaging (FCM); to issue it, Google's FCM library registers the app installation with Google. As on a Mac, our server returns the token sealed with a server key, and the sealed address is shared, encrypted, with your groups; our server keeps no list of addresses. When a member's device needs to wake yours — for a message, a mention, a call or the end of a call — it sends the sealed address and an encrypted payload (the kind of event, the group, the author and the place — never the text of a message) to our server, which opens the address and passes the payload to FCM. The payload is encrypted with the group key: neither Google nor our server can read it. Google sees the token, the time and size of the message, whether it is to be shown, silent or ends a call, and a random tag that changes with every wake-up. Our server does not store the address or the payload; if Google reports an address as no longer valid, the server keeps only a fingerprint of it in memory for up to 10 minutes, so as not to try it again. If you turned notifications off, a wake-up only lets NCraft fetch what is new and shows nothing. On phones without Google services, NCraft gets no token and fetches new items in the background about every 15 minutes.

Group relays (TURN). If a direct path is blocked, a group owner or admin may set up the group's own relay server. Messages and calls of that group can then travel through it. The relay sees the IP addresses of the group's connections and the amount and timing of traffic, but only encrypted data. We do not operate or control such relays.

4. Browsing

NCraft is a web browser built on the system web engine: Apple WebKit on macOS and iPhone, Android System WebView on Android and Microsoft Edge WebView2 on Windows. Websites you visit receive what any browser sends them (your IP address, cookies they set, and so on) and are governed by their own privacy policies.

• History, search queries, cookies and site data are stored on your device. Private tabs keep nothing after they are closed.
• Searches typed into the address bar go to a search engine: on a Mac and an iPhone, the one selected in your system settings, or DuckDuckGo if NCraft cannot read that setting; on Android, DuckDuckGo; on Windows, the one chosen in NCraft (Google unless you pick Bing, Yahoo, Ecosia or DuckDuckGo).
• Sites may ask for your location, camera or microphone. On a Mac and an iPhone this goes through the standard system prompts; on Windows and Android NCraft asks you first, and then the system applies its privacy settings. You can turn off NCraft's access to location, camera and microphone at any time in your system settings (on Windows: Settings → Privacy & security).
• On Windows, WebView2 is a component of Microsoft Edge that Microsoft installs and updates. Like Microsoft Edge, it may check the addresses of pages and downloads with Microsoft Defender SmartScreen and send diagnostic data to Microsoft according to your Windows settings, under the Microsoft Privacy Statement.
• On Android, Android System WebView is a component that Google installs and updates through Google Play. It may check the addresses of pages with Google Safe Browsing, under Google's Privacy Policy.

5. Camera, microphone and location used by NCraft itself

• Microphone — only during a voice call (section 2).
• Camera — only while a QR-code scan is open, for example when you link your own devices or invite someone next to you. Frames are processed on the device, are not saved and never leave it.
• Location — NCraft itself never uses it. Only websites can ask for it (section 4).

6. Reports and blocking

• Blocking a person hides their content on your devices. The block list is stored only on your devices.
• Reporting a person or a message sends an encrypted report to the owner of that group, who handles it. If you also choose Also tell the developer, your mail app opens a message to abuse@ncraft.live; we receive only what you decide to send, from your own e-mail address.

7. Data on your device and how it is protected

Your groups, history and settings are stored in an encrypted database (SQLCipher). Its key is protected by the system: on a Mac and an iPhone it is in the Keychain of that device only; on Android in a file encrypted with a key from the Android Keystore, and Android backup is turned off for NCraft; on Windows in a file encrypted with DPAPI for your Windows account. NCraft does not back up your groups, history or settings anywhere; the only backup is the backup of your 24 words (section 1). Content travels encrypted end to end (MLS for groups, Noise for connections to servers and devices, DTLS for calls).

Direct-download builds for Mac and Windows only (not in the App Store, Google Play or Microsoft Store versions): a group owner can install a bot or a TURN relay on their own server over ssh. The server addresses and ssh keys are stored on the device (on Windows encrypted with DPAPI), the bot build is downloaded from asia.ncraft.live and checked against our signature, and the relay secret goes only to your server and into your group's settings.

Programs on this computer. NCraft has a local interface that lets programs on the same computer use NCraft within the same rights as group members. It is off by default. When you turn it on after a warning, it listens only on the computer's internal address (127.0.0.1), requires a secret token shown to you, never gives access to your identity, keys, files on your disk, logs or deletion, and shows the same banner and Stop button as remote actions. Turning it off closes it; Forget identity also deletes the token.

8. Deleting your data

• Forget identity on this device (in your profile) deletes the identity, the database and its key from that device. On Windows it also deletes browsing history, cookies and site data, and the device key. A tick box, on by default, also deletes the backup of your 24 words from iCloud Keychain or Windows Credential Locker (section 1). The backup is shared by your devices on that account: if you untick the box, it stays and can bring the identity back, and a device that still holds the key saves it again.
• Leave a group to stop receiving it. Authors can delete their own messages for everyone; group owners and admins can remove other people's messages and remove members; the owner can close a group for everyone.
• Copies that other members already received stay on their devices, as with any end-to-end encrypted app. We have no copy to delete.
• To delete your data from our servers: there is none. If you wrote to us, ask us to delete your e-mail (section 10).

Step-by-step instructions: Deleting your data.

9. Children

NCraft is a tool for work and is not directed at anyone under 18. It provides unrestricted web access and lets members of a group share content with each other, and for this reason it is rated for adults on the App Store. You must be at least 18 to use NCraft (see the Terms of Use). We do not knowingly collect personal information from children — in fact, we collect none from anyone through the app. See also Child safety.

10. Information we do receive

• E-mails you send us to support@ncraft.live or abuse@ncraft.live: your address and what you write or attach. We use them only to answer you and to act on reports, and keep them for 12 months after the request or report is closed (reports of child sexual abuse — for as long as the law requires). Incoming mail for ncraft.live is hosted by Apple (iCloud); our replies are sent through Namecheap (Private Email).
• Statistics from the stores. Apple, Google and Microsoft may give us aggregated statistics about installs and, if you agreed to this in your system settings, crash reports. Crash reports are handled by Apple under Apple's privacy policy on a Mac and an iPhone, by Google Play (Android vitals: crashes and freezes) under Google's Privacy Policy on Android, and by Windows Error Reporting under the Microsoft Privacy Statement on Windows. We use them only to fix NCraft.
• Testing. If you test NCraft through TestFlight or a Google Play testing track, we see the e-mail address you were invited with, and Apple or Google may give us what their testing service collects: which build you installed and when, crash reports, and the feedback and screenshots you choose to send. We use this only to run the test and fix NCraft.
• This website. ncraft.live keeps no visitor logs and has no analytics. It sets one cookie, lang, only if you switch the language, to remember your choice. The colour theme you choose is stored only in your browser (localStorage).

We do not sell or share personal information, and we do not use it for advertising. We disclose information only when the law requires it, and then only the little we hold.

11. Who receives what

12. Your rights

Depending on where you live (for example under the GDPR in the EU and UK), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict its use, and to complain to your data protection authority. Almost all of your data is on your own devices and under your control (section 8). For anything we hold — in practice, e-mails you sent us — write to support@ncraft.live. Our legal bases: operating the service you asked for (connections, notifications), our legitimate interest in keeping NCraft safe and working (abuse reports, crash statistics), and legal obligations.

13. Changes and contact

Changes to this policy come with app updates and on this page, with the date above updated; significant changes are also shown when you open the app. Questions: support@ncraft.live · Abuse reports: abuse@ncraft.live