Privacy Policy

Core Chat Android application (package com.livedrop.ae)
Published by White Rock LTD · Effective date: 23 July 2026

1. Who we are

Core Chat is published by White Rock LTD ("White Rock", "we", "us"), which also operates the messaging service the app connects to. White Rock LTD is the data controller for the personal data described in this policy. You can reach us at app-support@white-rock.ae.

2. What this policy covers

Core Chat is a client for the open Matrix communication network, based on the open-source Element X client. You use it with an account on a Matrix server (a "homeserver"), which stores and routes your communications. By default the app connects to the messaging service operated by White Rock.

This policy describes what the app does on your device and how data is handled on the White Rock service. If you sign in to a homeserver run by a different operator, your account, messages, and calls are processed by that operator under its own privacy policy; references to "your homeserver" below then refer to that operator's service.

3. Information we process

3.1 Account information

To use the app you need an account on a homeserver. Your user identifier, display name, optional profile picture, and sign-in credentials are processed by that homeserver. On the White Rock service, sign-in is handled by our authentication service and accounts are typically provisioned by the organisation you belong to.

3.2 Messages and attachments

Messages, files, images, and voice messages in encrypted rooms — the default for direct and private conversations — are end-to-end encrypted on your device before they are sent. Your homeserver stores this content in encrypted form and cannot decrypt it. To route and deliver messages, it processes conversation metadata such as sender and recipient identifiers, room membership, timestamps, and delivery and read status.

3.3 Voice and video calls

Calls are end-to-end encrypted. Call set-up messages are exchanged through your homeserver, and encrypted audio and video streams are relayed through the call and relay servers configured by your homeserver's operator — on the White Rock service, that is infrastructure operated by White Rock. These servers process connection data (such as your IP address and the time and duration of the call) but have no access to the content of your calls.

3.4 Location

The app accesses your device location only if you actively use the location-sharing feature in a conversation. A shared location is sent as a message (end-to-end encrypted in encrypted rooms). When the app displays a map, map imagery is loaded from MapTiler, a third-party map provider, which receives your IP address and the requested map area but no account information. The app never collects your location in the background.

3.5 Device and connection data

When the app connects to a homeserver, the homeserver processes your IP address and technical session data (device name, app version, session tokens, and last-seen time). On the White Rock service, we keep standard technical logs for a limited period for security, abuse prevention, and troubleshooting. You can review and remove your active sessions in the app's security settings.

3.6 Push notifications

To notify you of new messages, the app registers a push token. Notification delivery works in one of two ways:

• Google push services (default on devices with Google Play services): our notification gateway sends a wake-up signal through Google's Firebase Cloud Messaging. This signal contains only technical identifiers (an event and room identifier) — never message content or sender names. The app then retrieves the actual message directly from your homeserver. Google processes the push token and delivery metadata under its own terms.
• UnifiedPush: if you use a UnifiedPush distributor app, notifications are delivered through it and our own push gateway instead, without involving Google.

3.7 Data stored on your device

The app keeps a local cache of your conversations and your encryption keys on your device so it can work quickly and decrypt your messages. This data stays on your device and is removed when you sign out or uninstall the app. If you enable encrypted key backup, your encryption keys are stored on your homeserver in a form that only you can unlock with your recovery key; the server operator cannot access them.

4. What the app does not do

• No advertising and no advertising identifiers.
• No analytics, telemetry, or tracking SDKs.
• No crash or bug reports are sent to us or to any third party.
• No access to your address book, contacts, SMS, or call history.
• Camera and microphone are used only during calls or when you record or attach media yourself.
• We never sell personal data and never share it for advertising or marketing purposes.

5. How we use information

We use the information described above only to:

• provide and operate the messaging service (deliver messages, connect calls, sync your devices);
• deliver notifications you have enabled;
• keep the service secure, prevent abuse, and diagnose technical problems;
• respond to support requests you send us; and
• comply with legal obligations.

We do not use your data for profiling or automated decision-making.

6. When information is shared

• Infrastructure providers. We use cloud hosting and content-delivery providers to run the service. They process data on our behalf under contractual data-protection obligations and may not use it for their own purposes.
• Google (Firebase Cloud Messaging). Only for push notification delivery, as described in section 3.6, and only on devices using Google push services.
• MapTiler. Only to load map imagery when you use location features, as described in section 3.4.
• Other Matrix servers (federation). Matrix is a federated network: if you participate in a conversation that includes users of another homeserver, the messages and metadata of that conversation are replicated to that server so its users can take part. The White Rock service federates only with a small, approved set of partner servers.
• Legal requirements. We may disclose information where required by applicable law or a valid legal request, or where necessary to protect the rights, safety, or security of our users or the service.

7. Security

Conversations in encrypted rooms are protected with end-to-end encryption based on the Matrix Olm and Megolm cryptographic protocols. All traffic between the app and your homeserver is protected with TLS. The app supports device verification so you can confirm you are talking to the right person, an optional app lock (PIN or biometric), and encrypted key backup protected by a recovery key that only you hold. If you believe your account has been compromised, contact us immediately at app-support@white-rock.ae.

8. Data retention and deletion

• Account information is kept for as long as your account exists.
• Messages and attachments are stored (encrypted, where applicable) until they are deleted or removed in line with the retention rules of your organisation's deployment.
• On the White Rock service, technical server logs are kept for a limited period and then deleted or anonymised.
• When your account is deactivated, your profile and push registrations are removed and the account can no longer be used. You may request erasure of your personal data by contacting us.
• Signing out or uninstalling the app removes locally cached data from your device.

9. Your rights

Subject to applicable data-protection laws, you have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict its processing, and to receive a copy in a portable format. To exercise any of these rights, contact app-support@white-rock.ae. We may need to verify your identity before acting on a request. If you believe we have not handled your data properly, you may also lodge a complaint with your local data-protection authority.

10. Children

Core Chat is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

11. International data transfers

When you use the White Rock service, your data may be processed in countries where we or our infrastructure providers operate. Where data is transferred across borders, we apply appropriate safeguards in line with applicable data-protection laws.

12. Changes to this policy

We may update this policy from time to time. The current version is always available at this address, and the effective date at the top shows when it was last revised. If we make material changes, we will inform you through the app or the store listing.

13. Contact

White Rock LTD
Email: app-support@white-rock.ae