Lauki Privacy & Security
Last updated October 27, 2026 · The legal bit · Changes to this page · Terms
Your messages are encrypted in transit and at rest, and we hold the keys. Lauki is not end-to-end encrypted. Every message travels to us over an encrypted connection and is stored in our database as ciphertext. Our server holds the keys, opens a message when someone with the right to see it asks, and writes every open to a log nobody can edit. That means the operator of Lauki can read your messages. We chose this so every message opens on every device you sign in on, with no PIN, no key ceremony and nothing lost when you change phones. Under each claim below is how we prove it.
How your messages are stored
Sealed at rest, one key per chat. Every message and file is stored as ciphertext under a key that belongs to that chat alone; text and files never share one. The chat key is wrapped under a per-account key, wrapped in turn under a root key kept outside the database. A copy of the database alone opens nothing.
How we prove it: on every release a test reads the stored rows directly and finds only scrambled bytes.
Files sealed in pieces. Photos, videos, voice notes and files are sealed on the server chunk by chunk under a key derived per file. A file link is signed to the person opening it, checks they are still in the chat, and expires within about an hour. The sender owns the file; nobody else can re-send it as their own. Uploads started and never finished are cleared each night; the sweep never deletes a file that exists.
How we prove it: a test alters a file link by one character and is refused; another waits for a link to age and finds it dead.
Calls are recorded. Every voice call between people, one to one or in a group, is recorded. Each phone records only its own microphone and uploads it in short pieces during the call; the server seals every piece at rest under a key that belongs to that speaker. Everyone on the call sees a Recorded label from the moment it connects. Our server holds these keys too, so a recording is protected at rest, not from us. Lauki the assistant never joins these calls.
Call recordings waiting to upload are tied to the account that recorded them: they upload only when that same account is signed in on this device, and are stored on our servers sealed at rest (not end-to-end encrypted). Before Oct 27 2026, a recording waiting on a shared browser could upload under the next account signed in there; that is fixed.
A call is written up only when you send it to Lauki. Since 6 October 2026 no call is transcribed automatically and nobody sees a transcript, summary or action items in the app. A recorded call card has one button, Send to Lauki: it puts your note and a link to the call in your own chat with Lauki. Only then does Lauki read that call: our server transcribes it once, for Lauki alone, stored sealed, and Lauki asks you what you want done before doing anything. Each such read and the transcription itself writes a line to the log. The other people on the call see nothing of your request. Only people who were on the call can play the recording, and each play is logged. Deleting the call from the chat for everyone hides its recording from everyone and from Lauki; like a deleted message, the sealed recording is retained, not purged.
How we prove it: a test asks for a call's recording as someone who was not on it and gets nothing; another checks that no recording ever reaches a speech-to-text service until a participant asks.
Backups sealed in a separate vault. Snapshots are sealed under their own key in storage nothing public reaches. In the 5 September audit we found one older backup stored in plain form; it was sealed, moved into the vault and the original deleted that day.
How we prove it: a test asks the public file host for a backup by every path and gets nothing.
Who can read what
| Who | Can see | Cannot see |
|---|---|---|
| You and the chat | Everything in the chat, on every device you are logged in on. | Anyone's phone number but your own. |
| Lauki, the assistant | Your direct chat with him, and the chats he has a seat in. Every message he opens is logged under his name. | Chats he has no seat in, unless someone there names him. Anything without leaving a record. |
| Lauki operators | Metadata: who is in which chat, when, sizes and names. A message's text if they open it, because the server holds the keys; that open is logged. | Nothing, anywhere, without leaving a record. |
| Apple, Google, Mozilla | That your device has a notification waiting. For the Lauki app on iPhone and Android, also who it is from and which chat, so your phone can show their name and photo. | The text: it is sealed to your device before it leaves us. In a browser, not the sender either. |
| A court | Whatever a valid order compels us to open, through the same logged path. | Nothing quietly. |
The log
Every open of a message or file on the server writes one line: who asked, which chat, why, when. That includes you reading your own chats, Lauki reading where he is spoken to, and any operator. The table refuses edits and deletes, so the record exists before the reader finishes reading, and nobody can tidy it up. Each night the day's log is copied once into sealed storage that cannot be overwritten. Opens may happen; they cannot happen invisibly.
Read from that log on 6 September 2026: no open by an operator, ever. Every open under Lauki's key was one of four kinds, each with its own line: answering someone who spoke to him, reading a chat when asked to look something up, bringing back a message that was lost (with a written reason), or preparing your own data download. Every other open was a person reading their own chats.
How we prove it: the log rejects edits and deletes at the database level; a test tries both on every release.
Leaving a chat
Leave, and access goes with you. When you leave a group, are removed, delete your account, or an admin deletes the group, your access to that chat is revoked in the same step, not later. The server stops opening its messages for you, and any file link you held dies at that moment. Re-added, you see the chat again.
How we prove it: a test leaves a group and confirms the old key opens nothing new; a sweep of every chat finds no former member holding one.
Your data is yours
Download everything. Settings → Download my data gives you one file: your profile, your chats, every message you can see, files as expiring links. Once per day, from a signed-in session only; an API key cannot ask for it. Every message in it is logged as a read by you.
Delete everything. Deleting your account wipes your keys, sessions, devices and identity. What you posted in groups stays in those groups; the rest is in the legal bit.
How we prove it: a test downloads its own data, checks nothing is missing or extra, then asks again that day and is refused.
What this protects against
Encryption at rest protects your messages from someone who gets a copy of our database or our backups without our keys: they get scrambled bytes. Encrypted connections protect them on the way to us and back. File links protect your files from anyone who is not in the chat. The log protects you from quiet reading: an open always leaves a line.
It does not protect your messages from us. Our server holds the keys, so someone who controls our server, or a valid legal order served on us, can open a message. That open is logged, but logging makes it visible, not impossible.
How we prove it: a test reads stored rows with the database alone and finds only scrambled bytes, and a member removed from a chat is refused its messages and files.
Notifications
A notification carries the sender's name and up to 140 characters of the message, sealed to your device's own push key. Our server seals that preview for each of your devices; Apple, Google and Mozilla relay a sealed payload and see neither the name nor the text. A device we have no push key for gets a plain "New message" and opens the text itself.
How we prove it: a test stands in for Apple's push relay and receives only scrambled bytes; only the device's own key turns them back into the sender and preview, and a stolen relay credential opens nothing.
In the Lauki app on iPhone and Android, each install makes its own notification key on the phone, and the preview is sealed to it the same way; the phone opens it itself. The banner's sender name and chat name travel in the clear so it can show them; the text never does.
How we prove it: the Apple and Google payloads are checked to carry no text, and another phone's key opens nothing.
Devices
Every device sees everything. Sign in with the one-time code sent to your number, or shown on a device you are already signed in on, and the whole history of every chat you are in is there. There is no PIN, no pairing and no recovery step: the keys are ours to hold, so changing or losing a phone loses nothing.
Moving off the old setup. Until 5 October 2026 most messages were sealed on the sender's device. On 5 October we moved every one of them our server could open into the storage described above, opening each once, sealing it at rest and checking it against the original before switching over. Those opens are logged. A small number were sealed only to members' own devices and never to us; when a device that still holds their key next opens Lauki, it hands that key over and the messages move too. A message no device can open shows as "Message unavailable".
How we prove it: every moved message was opened again after the move and compared with the original; none differed.
Lauki and AI processing
Lauki, the assistant, reads your direct chat with him and, elsewhere, the messages that tag or name him, with a few before them for context. In a group where he has a seat, he also reads recent messages to tell whether he is being spoken to; the group's members can remove him from its settings. Lauki's AI providers are configured not to train on your messages. Lauki's AI providers keep nothing: zero data retention - what you send is not stored by them and not used to train their models. That promise is about Lauki the assistant; the speech-to-text providers that turn calls and voice notes into text are separate, and what they may keep is set out under Third parties. Calls with Lauki are not covered by it either; see below.
Calls with Lauki. A voice call with Lauki himself, when you tap Call Lauki or when Lauki calls you, is not one of the calls between people above: it does not run on lauki.chat's call system, and lauki.chat records no audio or transcript of it. It runs on Lauki's voice service and is carried by ElevenLabs, which runs the voice and the AI model behind it. Calls with Lauki are recorded and transcribed. Lauki says so in the first thing he says on every such call; the ring and call screens carry no recording label, this page is where it is written down. The audio and transcript of the whole call are recorded from the moment it connects and kept until they are deleted: there is no automatic deletion, and ElevenLabs' zero-retention mode is off for these calls. Lauki keeps the transcript so he can act on what was said. The zero data retention promise above does not cover these calls; what ElevenLabs does with the audio it receives is under Third parties. To have a call with Lauki deleted, write to hi@lauki.ai, or message @lauki in the app. When Lauki calls you, lauki.chat keeps only that he rang, the one-line purpose shown on the ring screen, and whether you accepted, declined or missed the call or he cancelled it; the link to join is deleted when the ring ends.
Letting Lauki work in your chats. It is on by default and you can turn it off in Settings anytime. While on, Lauki can read and send in your own chats. He uses it only when you ask him in your direct chat with him, and only for you: a request from one person never opens anyone else's chats. Every chat he reads and every message he sends for you is logged under his name with your account on it, messages he sends for you carry a "via lauki" tag that everyone in the chat sees, and turning it off in Settings stops it on his next request.
Every message Lauki opens is logged under his name. If a message is lost by accident, an operator can open that one row, with a written reason, also logged and sent to our alert channel.
How we prove it: a live test sends Lauki a message, reads his answer back, and finds the logged open under his name; a recovery open leaves a logged row carrying its reason.
What Lauki remembers about you
Lauki is his own entity. The notes and memory he keeps about you live in a private container of his own, outside the chat database. As of today our admins can access that container. Ask him and he will tell you what he holds, or forget it.
What this is not
- Lauki is not end-to-end encrypted. The server holds the keys to every chat and can open any message; every open is logged.
- A compromise of our server, with its keys, is a compromise of your messages.
- Profile pictures and group photos are not private files. Anyone who can see the profile or the chat sees them; the server serves them as plain images, without a log entry.
- Metadata is visible to the server: who talks to whom, when, how much, file names and sizes.
- Our database provider keeps thirty days of point-in-time snapshots. Until about 5 October 2026, a snapshot from before the sealing could be restored and would contain plain text.
- Deleting a message hides it from everyone, on every device, immediately. The sealed row is retained, not shredded.
- Clearing a chat removes it for you only; Lauki's memory of you is separate.
- A lawful order could require specific messages to be opened, through the same logged path. There is no chat we could not open, and no open that would go unlogged.
What's next
Still to come:
- The last unmoved messages. Messages sealed only to members' devices move as those devices come back online. Once that stops, any left show as "Message unavailable" for good.
- Independent adversarial audit. Someone paid to break it, findings published.
This is being built now. Each change is published here as each lands.
Security reports: hi@lauki.ai.
The legal bit
The plain-words privacy policy. What we store, who can see it, and how to make it go away. Written from the code, not from a template.
What we store
| Thing | Details | Kept until |
|---|---|---|
| Phone number | Your login and your identity. Unique per account. | You delete the account |
| Profile | Name, username, photo. Visible to anyone who can find you. | You change or delete it |
| Messages | Text (sealed), replies, edits, reactions, read receipts, who's in which chat. | Retained; hidden from everyone once deleted for everyone (see below) |
| Media | Photos, videos, voice notes, files you send. Sealed, stored under unguessable IDs, served only through signed links that expire. | Retained; hidden with the message once it is deleted for everyone |
| Devices | A device ID per login, platform, and the push subscription for that browser. | You log out or delete the account |
| Presence | Last-seen time and, while connected, online / typing state. | Overwritten continuously |
| Blocks and reports | Who you blocked, and reports you filed (reporter, target, reason). | Blocks: until you unblock or delete. Reports: kept for moderation. |
| API key | Only a SHA-256 of the key, never the key itself. | You revoke it |
| App activity and errors | Tied to your account, to fix problems you report: which screens and chats you opened (chat IDs, never names or text), errors you hit, whether voice notes recorded and sent, notifications received and tapped, app load times and updates, and each request to our servers (route, result, how long it took). Never message text, captions, names, phone numbers or keys. Kept on our host (Cloudflare), not shared, not used for ads. | 90 days |
| Call recordings and transcripts | Each participant's own microphone audio from every voice call, in sealed pieces, with when each piece started and how loud it was. A transcript, short summary, decisions and action items, sealed, made only when a participant sends that call to Lauki and only for Lauki to read; earlier calls may also have one from before 6 October 2026. The note a participant sent Lauki about a call, and its status, sealed. Recordings playable only by the people who were on the call; every play and read is logged. The operator can access them, logged like any other open. | Retained for now; hidden from everyone once the call is deleted for everyone |
| Voice-note transcripts | On by default for every account, with a switch in Settings, "Transcribe my voice notes", that applies to all your devices: when it is off, no new voice note of yours is sent for transcription. A short text transcript of the voice notes you record and send (never ones you forward), sealed. Since 14 October 2026 a finished transcript is shown under that voice note to everyone in that chat who can see the note, in direct chats and groups; one still being made, or one that failed, is shown only to you. A voice note you receive gets a transcript only if its sender has transcripts on. To make it, our server opens that one voice note and sends its audio to one speech-to-text provider, which returns the text. Since 14 October 2026 that provider is Groq for almost every account; ElevenLabs is used only for a small internal list of accounts. That opening and every time anyone reads transcripts are in the open log. | Until the voice note is deleted for everyone |
| Open log | Every unseal of a message or file: who, which chat, why, when. Append-only. | Indefinitely; exported nightly to a sealed archive |
Voice call video. When you turn on your camera during a call, the app keeps a rolling buffer of at most three JPEG frames in memory only. It expires 60 seconds after uploads stop and is never written to disk or the database. At most one fresh frame is sent to the model per turn; the AI provider keeps nothing.
Nothing is sold, and there is no advertising, no third-party analytics SDK, no tracking pixel and no cookies. App activity (above) stays with us.
Logging in
You log in with your phone number and a one-time code. The code is generated, sent by SMS and checked by our verification provider (Twilio) - we never see or store the code, only whether it was right. Your phone number is shared with Twilio for exactly that purpose.
A phone can request at most 5 codes an hour, and we cap requests per network address and overall to stop abuse. Each login is a signed session token for that device, valid 30 days. Log out revokes it on the server immediately and wipes the app's local copy of your chats from that browser.
Finding people
If you choose to sync contacts, the app sends the phone numbers from your address book to our server to see which of them are on Lauki. We match them against registered accounts and reply with the matching profiles - we do not store the numbers you sent, and the reply never includes phone numbers, only account IDs, names and photos. The numbers are sent as-is (not hashed) today; hashed matching is planned. At most 500 numbers per request, 10 requests an hour.
Anyone can also search for you by username or exact phone number. Your phone number is never shown to other users.
Who can see your messages
- The people in the chat. Obviously.
- Us, in principle. Our server holds the keys to every chat, so an operator could open a message, and every such open is logged in an append-only record (see The log above). We would do it only to investigate abuse or under a valid legal order - never to sell, profile or advertise.
- Lauki, the assistant. Lauki is an AI account that lives in the app. He reads everything in your direct chat with him. In a group he is either a member or not: once someone adds him (the chat shows "added Lauki"), he sees every message posted there until a member removes him; a group he is not in, he never sees. A direct chat between people he never sees: tagging
@laukior replying to an old message of his there does nothing, and he never answers there. He also opens a message when you ask him to bring something back. Every open is logged. What Lauki reads is processed by AI providers with zero data retention: they store nothing and train on nothing. This does not cover the speech-to-text providers for calls and voice notes, described under Third parties. Lauki keeps working notes about you in a private container of his own; as of today our admins can access it. We do not use your messages to train models. - Who read your message. The person who sent a message can see who in the chat has read it and when, in direct chats and groups, for messages up to 7 days old. Lauki never shows as a reader, and people who have blocked each other never see each other's reads.
- Push services. Notifications carry the sender's name and a short preview of the message, sealed to your browser or to the Lauki app on your phone. They are delivered through Apple, Google or Mozilla, which never see the preview text; for the app they also carry the sender's and chat's name so the banner can show them.
- Media links. A file link is signed to the reader, checks that the reader is still in the chat, and expires within about an hour. Someone holding a leaked link can open the file only while it is valid.
Links you paste
When you paste a link, our server - not your device - fetches that page once to build the preview (title, description, image). The site you linked sees our server, not you. Previews are cached for 24 hours.
Deleting things
- Delete for me hides a message from your view only. Everyone else still has it.
- Delete for everyone hides the message from everyone in the chat, on every device, the moment you tap it - the app never shows or searches it again. The sealed row itself (text and media) is retained on our servers; it is not purged.
- Edits replace the text in place; the previous version is not kept.
- Deleting a call from the chat for everyone (any participant can) hides its recording and any transcript from everyone, Lauki included. Delete for me hides it only for you. The sealed recording itself is retained.
Deleting your account
Settings → Delete account, confirmed with a code to your phone. What actually happens, in order:
- You leave every group. If you were the last admin, the earliest-joined member becomes admin.
- Your name becomes “Deleted account”, your username and photo are removed, and your phone number is freed so it can sign up again.
- Every session, device, push subscription and block involving you is deleted. Open connections are cut.
- Photos, videos, voice notes and files you posted in a group stay in that group: before your key is wiped, the key that opens each one is re-wrapped under a key our server holds, and that step is logged as a read by you, once per group.
- Your access to every chat and your own account key are revoked in the same step, so nothing can be opened for you again. Media you sent in direct messages, or uploaded and never sent, is no longer served to anyone, and its stored bytes are deleted, normally right away and at the latest within a day.
- Lauki's own notes about you live outside the chat database; ask him to forget them, before or after you delete.
Deletion is confirmed with a one-time code sent to the phone number on the account, so nobody can delete it from a stolen session alone. A fresh signup with the same number is a new account: new identity, new keys, none of the old history.
What stays: messages you already sent remain in those chats, shown as from “Deleted account”. Media you posted in a group stays in the group for its members: you posted it there. Media in your direct messages does not stay. If you want something gone from a group, delete it for everyone before deleting the account.
Logs and alerts
Requests produce short-lived request logs on our hosting provider that we use to debug outages; they are not tied to an advertising profile. Server errors and delivery failures post an alert to a private ops channel - with phone numbers masked (first digits and last two only) and no message content.
On your device
The app keeps a local copy of your chats in the browser's storage so it opens instantly, works offline and can search without asking the server. Logging out clears it. Nothing on your device is read beyond what you explicitly pick (a photo, a file, your contacts when you tap sync).
Third parties
| Who | What they get |
|---|---|
| Cloudflare | Hosts everything: the app, the API, the database, media files and app activity logs. Stored data is sealed as described above. |
| Twilio | Your phone number, to send the login code. |
| Apple / Google / Mozilla | Push notifications for your browser and the Lauki app. The message text is always sealed; app notifications also carry the sender's and chat's name. |
| ElevenLabs, Anthropic | When a recorded call is sent to Lauki: since 14 October 2026 ElevenLabs receives only the own microphone audio of accounts on a small internal list, never any other participant's audio (that goes to Groq, below), and Anthropic receives the call's resulting text to tidy it into turns, a summary, decisions and action items. Nothing is sent to either for a call that was not recorded. For each voice note sent while transcripts are on by an account on that internal list, ElevenLabs receives that note's audio (not your name or number) to write its transcript. ElevenLabs may keep the audio it receives and may use it to improve its own models unless the account sending it has opted out of that. On a call with Lauki (Calls with Lauki, above), ElevenLabs carries the whole call: it receives both sides' audio, and records the audio and transcript with no automatic deletion. |
| Groq | For each voice note you record and send while transcripts are on (unless your account is on the internal ElevenLabs list above), Groq receives that note's audio (not your name or number) to write its transcript, and returns the text. When a recorded call is sent to Lauki, Groq receives each participant's own microphone audio, except for accounts on that internal list, to turn it into text. Groq uses its whisper-large-v3 model. Groq does not train its models on this audio. Groq may keep it for a limited time under its own terms. |
| Google Fonts | Loads the typeface; sees your IP like any web request. |
| AI model providers | Only what Lauki the assistant reads (above). Zero data retention: nothing stored, no training. This covers Lauki the assistant's providers only, not the speech-to-text providers (Groq, ElevenLabs). |
Security
TLS everywhere, HSTS, security headers, per-device sessions you can revoke, OTP-guarded account deletion, rate limits on login, contact matching and the API, and the sealing described on this page. The full list is in the API docs. Found something? Email hi@lauki.ai - security reports get fixed first.
Changes and contact
If this page changes in a way that matters, the date at the top moves and the app tells you. Questions, requests for a copy of your data, or anything else: hi@lauki.ai, or message @lauki in the app.
Changes to this page
This page is refined continuously; every release that touches it adds a line here.
- 27 October 2026 - Call recordings tied to their account. Call recordings waiting to upload now upload only under the account that recorded them; before this, one on a shared browser could upload under the next account signed in there.
- 19 October 2026 - Calls with Lauki are recorded and transcribed. The ring screen, its notification and the call screen no longer show a recording label on calls with Lauki; this page says it instead. Calls between people still show it.
- 19 October 2026 - Group media stays after you delete your account. Deleting your account keeps the photos, videos, voice notes and files you posted in groups; media in your direct messages is deleted.
- 18 October 2026 - Lauki can call you. Lauki can now ring you in your direct chat with him, for now on a few test accounts only. These calls, and calls you start with Call Lauki, run on Lauki's voice service and are recorded by ElevenLabs, which carries them, from the moment they connect, kept with no automatic deletion; lauki.chat records no audio or transcript of them. Lauki says the call is recorded when it opens. Calls with Lauki, under Lauki and AI processing, says who keeps what.
- 17 October 2026 - "Seen by" for everyone. The sender of a message can now see who in the chat read it and when, in direct chats and groups, like other messaging apps. Read times are kept for 8 days, then deleted. Lauki is never listed as a reader.
- 14 October 2026 - Less audio goes to ElevenLabs. Voice-note transcripts for almost every account now use Groq for speech-to-text instead of ElevenLabs. On a recorded call sent to Lauki, each person's own microphone audio goes to one provider: ElevenLabs only for accounts on a small internal list, never anyone else's on the call; everyone else's goes to Groq. Groq does not train on it. The Third parties table says what Groq receives.
- 14 October 2026 - Voice-note transcripts are on for everyone. Every account now gets transcripts of the voice notes it records and sends, on by default; the switch in Settings, "Transcribe my voice notes", turns them off on all your devices. For now ElevenLabs is the speech-to-text provider for every account. The Third parties table now says what each speech-to-text provider may keep and whether it may train on the audio, and that the zero data retention promise covers Lauki the assistant's AI providers only.
- 14 October 2026 - Voice-note transcripts are shown to everyone in the chat. A finished transcript now appears under the voice note for every member of that chat who can see the note, in direct chats and groups, not only for the sender. One still being made, or one that failed, stays visible only to the sender. The audio of each such voice note goes to one speech-to-text provider, ElevenLabs, and nothing else about you. The sender's switch, "Transcribe my voice notes", still stops new ones.
- 13 October 2026 - Voice-note transcripts, with an off switch. Where your account has it, the voice notes you record and send get a short transcript, sealed at rest and visible only to you. Our server opens each such note once and sends its audio to ElevenLabs to turn it into text, logged in the open log. Settings has a switch, "Transcribe my voice notes", on by default, that stops it on all your devices. Forwarded and received voice notes are never transcribed.
- 13 October 2026 - Voice-note transcripts. Where switched on for an account, the voice notes that account sends get a short transcript, sealed at rest and visible only to the sender. Each one opens that voice note once for speech-to-text, logged in the open log.
- 8 October 2026 - No tagging Lauki in direct chats. Lauki no longer sees or answers anything in a direct chat between people, even when someone tags
@laukithere. He reads only your own chat with him and groups he has been added to. - 7 October 2026 - Who Lauki sees, stated plainly. In a group he sees every message while he is a member and nothing when he is not. In a direct chat between people, tagging
@laukior replying to him lets him see that message and what it replies to, and answer there. - 6 October 2026 - Calls are written up only when sent to Lauki. Automatic write-ups are off and the app no longer shows any transcript, summary or action items. Send to Lauki on a recorded call shares your note and the call with Lauki in your own chat with him; only then is the call transcribed, for Lauki alone, logged, and he asks you before acting.
- 6 October 2026 - Calls are written up automatically. A recorded call no longer waits for someone to tap Transcribe: shortly after it ends, its transcript, summary, decisions and action items are made and shown on the call in the chat for everyone who was on it. Anyone on the call can ask Lauki to act on it; Lauki then reads that call's write-up, logged, and the request and its progress show on the call.
- 5 October 2026 - Memory page removed. Settings no longer shows "What Lauki knows about you", and the copy the app kept of it is deleted. Lauki's own notes stay in his container; ask him what he holds or to forget it.
- 5 October 2026 - Calls are recorded. Voice calls between people are now recorded, each phone recording only its own microphone, sealed at rest with keys our server holds. Everyone on a call sees a Recorded label. Transcripts are made only when a participant asks, shown only to the people who were on the call, and every play, read and transcription is logged. The operator can access recordings and transcripts, logged.
- 5 October 2026 - Simpler encryption. Messages are now encrypted in transit and at rest with keys our server holds, not end-to-end. Every message opens on every device you sign in on; the PIN, pairing and device keys are gone. Messages sealed on devices were moved into server storage, each checked against its original, and every move was logged.
- 5 October 2026 - Forgot your PIN. The optional 2-step PIN now has a "Forgot PIN?" path. On a device that was already yours when you set the PIN, the PIN goes at once. On a new phone, the reset waits 7 days, every one of your signed-in devices is told and can cancel it, and entering the right PIN cancels it too. Only then does the new phone get your older messages back through Lauki's recovery key, each chat a logged open. A new phone can no longer remove or replace the PIN without it.
- 4 October 2026 - App activity and errors. The app now records what happens in it (screens, errors, voice notes, notifications, load times, server requests) against your account for 90 days, so a problem you report can be traced. No message content, names, numbers or keys.
- 3 October 2026 - New group members. A member added while no other member's device was online now gets the group key when they open it, through Lauki's recovery key, logged, and only keys from their join onwards.
- 24 September 2026 - Notification text in the app. The Lauki app on iPhone and Android now shows who wrote and what they said on the lock screen. Each install holds its own notification key; the preview is sealed to it on the sender's device (or by us, where we already hold the text) and opened on your phone. Stated plainly that app notifications carry the sender's and chat's name in the clear, and that older app versions received a server-sealed chat's text in the clear.
- 22 September 2026 - Voice call video. Camera frames are held in a rolling in-memory buffer of at most three, expire 60 seconds after uploads stop, are never written to disk or the database, and at most one fresh frame reaches the model per turn. AI providers keep nothing.
- 15 September 2026 - Account deletion, completed. The deletion section now lists everything the step does: keys revoked, Lauki's memory of you deleted, the phone code that confirms it, and that a new signup with the same number is a new account.
- 8 September 2026 - Older files follow the text. In a device-ready chat, photos, videos and voice notes sent before the chat became device-ready now move under your device keys too: your device opens each one a final time (logged), seals it under a key the server never sees, and the server-sealed copy is deleted. Once a chat's text and files have all moved, the server refuses to open anything for that chat.
- 7 September 2026 - Memory visible in Settings. What Lauki holds about you is shown in the app, read only, under Settings. Changing or clearing it still goes through him.
- 6 September 2026 - Profile pictures. Stated plainly that profile and group photos are public to whoever can see them and are served in the clear, without a log entry.
- 6 September 2026 - Removed the in-chat lock badge and key notices; the chat shows messages only. The states they described are on this page, unchanged.
- 6 September 2026 - Memory section. Lauki's memory is his own; no plan to seal it. Ask him what he holds or to forget it. The log section now names the four kinds of open under Lauki's key, including reading a chat when asked to look something up.
- 6 September 2026. Encryption stated as end-to-end, with Lauki's key named as the one key on our side. AI providers: zero data retention. New section on what Lauki remembers about you. Lauki holds a key in every chat; the earlier state where he held none is retired. A new phone is approved with one tap on your other phone. Older history re-sealed under device keys. Notification previews sealed by the sender's device. Restore offers only what can succeed. A recovery route through Lauki's key, every use logged with a written reason.
- 5 September 2026. Page created, the legal policy underneath. Same-day fixes from the security audit: a plain-form backup sealed, file links signed to the reader, keys revoked on leaving in the same step. Recovery by your phone number, with an optional PIN.