Privacy Policy

1. Introduction #

This Privacy Policy explains what personal data the DiiL messenger ("DiiL", the "app") processes, why, who else receives it, how long we keep it and what you can do about it.

DiiL is operated by DIGITAL IT ADVISOR COMPANY LIMITED, a company registered in Thailand ("we", "us"). We are responsible for the processing of your personal data described here.

1.1 Our principles #

• We collect what we need to run the messenger, keep it secure and moderate it, and nothing for advertising.
• We do not sell your personal data and we do not show ads.
• We do not use your messages to build advertising or marketing profiles.

1.2 Related documents #

This policy is part of our Terms of Service. Mini apps inside DiiL are run by other companies under their own privacy policies (see section 6). Developers of mini apps also accept the Developer Agreement.

2. Why we may process your data #

We process personal data because:

• it is needed to provide DiiL to you under the Terms of Service: your account, delivering messages and calls, notifications;
• we have a legitimate interest in keeping DiiL secure and free of spam, fraud and abuse, and in understanding how the app is used so we can improve it;
• you gave your consent, for example to access your contacts, to receive notifications, or to share data with a mini app; you can withdraw consent at any time;
• the law requires it.

3. What personal data we process #

3.1 Account data #

• Phone number. Required to create an account and to sign in with a one-time code sent by SMS.
• Profile: display name, @username, and optionally a short bio, profile photo and date of birth. Other DiiL users can see your profile.
• Account information we create: when the account was created, when you were last online, your interface language.

3.2 Email address (developers only) #

Regular users do not give us an email address. If you join the developer programme to publish a mini app, we ask for your email address, verify it with a one-time code, and use it to run the developer programme.

3.3 Messages and media #

DiiL stores the messages, photos, videos, files and voice messages you send on our servers, so they can be delivered and so you can see your chats when you open the app.

• Delete for everyone removes the message for all participants. Its files are deleted from our servers within 24 hours.
• Delete for me hides the message only from you. It stays on our servers and remains visible to the other participants.
• In groups, administrators can delete messages.

Media files are delivered through links that contain a long random key. Anyone who has such a link can open the file, so do not share links to private files outside DiiL.

3.4 Phone number and contacts #

If you allow access to your contacts, the app sends the phone numbers from your address book to our servers so that we can show which of your contacts use DiiL. We use these numbers only for this check and do not store them.

If you give a contact your own name for them, or a photo, DiiL stores it on our servers so it is the same on all your devices.

3.5 Calls #

• We do not record calls and do not store their content.
• To connect a call, the devices exchange network addresses. If a direct connection is not possible, the call goes through our relay server. If our servers are unavailable, the app may use a public Google server to find a route, and that server sees your IP address.
• For your call history we store who called whom, when, the type of call (voice or video), its status and duration. A call is removed from our servers once both participants delete it from their history.

3.6 Usage, technical and crash data #

• Usage events: we record events such as opening the app, the length of a session, the screens you visit, and opening, closing or errors of mini apps, together with the app version and platform. We use them to improve DiiL. Individual events are kept for 90 days; after that only aggregated statistics remain, with no link to you.
• Crash reports: when the app crashes or hits an error, a report is sent to Firebase Crashlytics (Google).
• IP address: recorded when you request a login code, when you sign in to a mini app with DiiL, and when a developer accepts the Developer Agreement. We use it to prevent abuse.
• We do not collect your location, an advertising identifier or a device identifier, and we do not track you across other apps and websites.

3.7 Reports and support #

When you report a message, user or group, we keep the report together with a copy of the reported messages, so that our moderators can review it. When you write to support through the app, we keep the conversation.

3.8 Our website #

The website diil.pro uses no cookies, no analytics and no third-party scripts. It runs on a separate server that holds no data of app users.

4. Keeping your data safe #

4.1 Storage and security #

The app's servers are hosted by ITLDC in a data centre in Singapore. Traffic between the app and our servers passes through the network of Cloudflare, which protects the servers from attacks and abuse. Data is transmitted over encrypted connections (TLS). Our staff have no access to your personal chats.

4.2 Backups #

We make database backups to restore DiiL after a failure. Backups are kept for 14 days. Data you delete may stay in backups until they expire.

4.3 How long we keep data #

4.4 Data breaches #

If a breach of security affects your account, we will tell you within 72 hours of finding out about it.

5. How we use your data #

We use your data only to:

• provide DiiL: deliver messages, files and calls, show who among your contacts uses DiiL, send notifications;
• keep DiiL secure: confirm your phone number, prevent spam, fraud and attempts to break into accounts;
• moderate DiiL: review reports and act on content that breaks our Community Guidelines. Moderators see only the copy of the messages included in a report, not your chats;
• support you when you contact us;
• understand how DiiL is used, in aggregate, and improve it.

We do not use your data for advertising and we do not make decisions about you that are based solely on automated processing and have legal or similarly significant effects.

6. Mini apps #

6.1 What mini apps are #

Mini apps are web apps of other companies ("developers") that open inside DiiL. Mini apps are not run by DiiL. Each developer is responsible for its mini app and for the data it collects, under its own privacy policy. We review mini apps before they are published.

6.2 What a mini app receives #

• When you open a mini app for the first time, DiiL asks for your consent and shows what the mini app wants. With your consent, the mini app receives your DiiL user ID and, depending on what it asked for, your display name, @username, profile photo and language.
• Phone number and email address are given to a mini app only if it asks for them and you agree. A mini app receives an email address only if it is verified.
• Your device connects to the developer's servers directly, like any website. The developer therefore sees your IP address and basic browser information.
• Anything you enter in a mini app goes to its developer, not to us.
• We show developers anonymous statistics of how often their mini app is opened.

DiiL does not give mini apps your contacts, chats or messages.

6.3 Control #

You can disconnect a mini app at any time in Profile → Privacy & security → Connected apps. It then stops receiving your data from DiiL. Data the developer already received is covered by the developer's privacy policy. Ask the developer to delete it.

7. Who your data is shared with #

We do not sell your data. We share it only:

• With other DiiL users: your profile, and what you send in chats and groups, with the people in them. Group administrators can see and manage the content of their groups.
• With service providers that help us run DiiL, only for that purpose:

• With mini app developers, as described in section 6, with your consent.
• With authorities, when the law requires us to, for example under a court order. We disclose only the data required.

8. Your rights #

8.1 Your rights #

Depending on where you live, you may have the right to access your personal data, to correct it, to delete it, to receive a copy of it, to object to or restrict its processing, and to withdraw consent. You may also have the right to complain to a data protection authority.

8.2 How to exercise them #

Write to us through the support form in the app: Profile → Support. We may need to confirm that the request comes from you.

8.3 Settings in the app #

• Change or remove your profile information in your profile.
• Turn off access to contacts, notifications, the camera or the microphone in the iPhone settings at any time.
• Block users in Profile → Privacy & security → Blocked users.
• Disconnect mini apps in Profile → Privacy & security → Connected apps.
• Delete your account (section 9.1).

9. Deleting data #

9.1 Deleting your account #

You can delete your account at any time in Profile → Privacy & security → Delete account. Deletion cannot be undone.

When you delete your account, we delete or anonymise your personal data straight away: phone number, display name, @username, bio, date of birth, profile photos, email address (for developers), last-seen time, notification tokens, your block list, the names and photos you saved for contacts, and your connections to mini apps. Your usage events are deleted. Calls disappear from your call history; a call stays only in the other participant's history, shown with "Deleted account".

Messages and files you sent stay in the chats and groups of the other participants, because they are part of their conversations. They are no longer linked to your profile and are shown as sent by "Deleted account".

We keep only what we need to handle reports and to meet legal obligations:

• reports you made and reports about your account or your content, with the copies of reported messages, for 1 year after the report was last handled;
• support conversations, for 1 year after the last message;
• if your account was restricted for breaking the rules, a record of that, for appeals and audits;
• login code records and SMS delivery logs, until they expire after 90 days;
• for developers, the record of accepting the Developer Agreement, for as long as the law requires;
• data in backups, until the backups expire after 14 days.

9.2 Deleting messages #

See section 3.3. We have no messages that delete themselves after a set time, and we do not delete inactive accounts automatically.

10. Children #

DiiL is only for people aged 18 or over. If you believe that someone under 18 has created an account, tell us through the support form and we will delete it.

11. Changes to this policy #

We may update this policy. The version in effect is always at diil.pro/privacy, and earlier versions remain available there. We will tell you about material changes in the app before they take effect.

12. Contact #

We do not handle requests by email. For questions about privacy and to exercise your rights, use the support form in the app: Profile → Support.