Pogosov for iOS and Windows — privacy policy

This policy covers the Pogosov apps for iPhone (iOS) and Windows, and the servers they talk to at pogosov.com. The app shows US stock market stories, sends notifications, and has a messenger with voice and video calls between your contacts.

Descriptions of Keychain, Apple notifications, iPhone drafts and the iOS camera behaviour below apply to the iOS version. Windows local storage, notifications and file handling are described in the separate Windows section. The shared server storage and assistant rules apply to both versions.

Responsible for your data: pogosov.com. Contact: help@pogosov.com.

News and notifications

• Installation identifier. On first launch the app creates a random identifier for this installation and keeps it in the iPhone Keychain; our server keeps only its SHA-256 hash. It lets you read the news and get notifications without signing in.
• Your settings. News language, notification settings (level, categories, hourly limit, quiet hours and their time zone), your list of My companies, and the messenger’s notification settings.
• Your device. When the app signs in: the device name as iOS reports it (usually just “iPhone”), the model and the app version. At every launch, to deliver notifications and incoming calls at the right time (also without your permission for notifications — iOS then simply does not show them): the Apple Push Notification service token, the PushKit token for calls, the iOS version, the phone’s language and time zone.

Signing in

• As a guest — nothing but the installation identifier above.
• With Apple — the identifier Apple gives our app for you, and your name if you share it. We do not keep the e-mail address Apple passes on.
• With e-mail — your address, an optional name, and the password only as a hash on our server. The confirmation and password reset codes come in a letter from noreply@pogosov.com sent by our own mail server; a code works 15 minutes, is kept only as a keyed hash and is deleted within a day.
• Team accounts — a few accounts made by the administrator: the login, the name, optionally an e-mail, and the password as a hash on our server.

The messenger

• Your profile: the name and the nickname you choose, a profile picture if you set one, and that you accepted the messenger’s rules; your contacts, requests and blocks.
• A profile picture is kept on our server as three small square JPEG copies made from it; the original file, its EXIF data, the place of shooting and the file name are not kept. It is seen by you, your contacts, the people you have a contact request with (either way) and, for 10 minutes, someone who has looked up your exact nickname; a block or a removed contact takes that away at once. When you change or remove the picture, the previous one is deleted.
• The text of messages, including the one sent with a contact request, is stored on our server encrypted (AES-256-GCM); the key is kept on our servers too. This protects stored copies, but it is not end-to-end encryption: our service decrypts messages to deliver them.
• Reactions and the quote in a reply are part of the conversation. An edit replaces the text — we do not keep earlier versions; a message you delete is deleted for both of you together with its files, and the other person sees “Message deleted”.
• Photos, videos and voice messages are stored on our server as files, not encrypted, readable only by the service. Photos lose their EXIF data and location before they are kept. Before sending a video the iPhone removes its metadata, including the place of shooting, and our server refuses a video that still has it; the video’s cover is saved like a photo. The files are deleted after 90 days; the message itself stays. A video that was uploaded but not sent is deleted after a day.
• To let you search your conversations, our server keeps a search index of the words of your messages only as keyed hashes (HMAC-SHA256), not as words; the key is kept apart from the database. This protects the index if the database leaks without the key, but it is not end-to-end encryption. What you search for travels inside the request and is neither stored nor written to logs. The index follows the message: it changes when you edit the message and goes when it is deleted.
• A profile picture is checked once, when you set it, by our own picture-analysis model on a server of ours; no other company receives it, and the model’s log of requests is kept 90 days. Messages are not sent to any model.
• If a message you send contains a web address (http or https), our server — not your phone and not your contact’s — may open the first address once to read the title, description, site name and one picture of the page, and shows them under the message as a card. The site receives our server’s IP address and the address as you wrote it, with everything after the “?”; it does not receive your account, cookies or your own IP address, and sees a visit of “PogosovLinkPreview”. You can switch the card off when you send the message or take it off later; taking it off does not recall a request that has already been made. What a page said is kept 24 hours so that the same address is not read again (5 minutes if the page could not be read); the title and the description of a card are stored encrypted together with the message, its picture — like other files — for 90 days from the day the message was sent; the card goes with the message when it is deleted.
• A forwarded message is a new message of the person who forwards it. It carries the name of the original author — never the nickname; empty if the author has no name. The files of a copy are separate copies kept 90 days from the forwarding. If the original author deletes their account, the copies of their messages are deleted in all conversations (a copy already kept in a filed report stays for the usual period). A forwarded message cannot be edited.
• Your contacts can see whether you are online and when you were last seen — only people who are your contacts and have you as theirs, and only if neither of you has blocked the other; for other people nothing is shown. While the app is open in front of you (on Windows, while its window is active), our server counts you as online for 90 seconds after the last sign of that — it keeps this in its memory only, not in the database, and a restart of the server forgets it. “Last seen” is one time kept with your account: the time of a request you made to our server; a later request replaces it only when the kept time is more than five minutes old, so it is approximate. In the settings, “Who sees when I’m online” lets you choose mutual contacts (the default) or nobody. With “nobody” your status is hidden from everyone and you do not see anyone’s status; if either of two people chooses it, neither sees the other’s status. The choice is kept with your account and is the same on all your devices. Asking for the statuses of a list of people does not make you online.
• In a personal conversation, while you type or record a voice message, the app sends the other person, through our server, a short sign (for one conversation at most once in 5 seconds, however many devices you have), and their app shows that you are typing or recording. The sign contains no text and is not saved in the database: it passes only through the memory of our server to the other person’s apps that are open at that moment, and runs out after 6 seconds; an app that was not connected at that moment does not receive it later. It is not a notification and does not make you “online”. The request itself appears in the web server log like any other request to our server, but its content does not.
• Pinned messages (iPhone from version 1.5, and Windows) are a list of up to five messages of a personal conversation, shared by the two of you; it shows who pinned each message and when. A message leaves the list when it is deleted for both of you, removed by our moderator, or wiped because its author deleted their account. If you only hide a message for yourself or clear the conversation for yourself, the message stays in the shared list and the other person still sees it; for you it shows as unavailable. If the person who pinned a message deletes their account, the pin stays without their name. Pinned conversations are up to five of your conversations in the order you choose; this list belongs to your account, is the same on all your devices and is not shown to your contacts. A conversation leaves it when you delete that conversation or when the other person deletes their account; the whole list goes when you delete your account.
• A message you have typed but not sent (a draft) stays only on your iPhone: it goes neither to our server nor into backups, and it is removed when you send it or sign out, and after 30 days.
• A report about a person, a message or a profile picture goes to our moderator with the reason, your comment if any, and a copy of what is reported — the message, the picture, or the message that came with the person’s contact request. The copy stays with the report even if the message is deleted later. Reports are kept 180 days after they are handled.
• A notification about a message or a contact request shows the sender’s name, and a message’s text, when previews are on in the app’s settings; such a notification passes through Apple. With previews off it carries neither. The message sent with a contact request never appears in a notification, only in the app.

Closed groups (iPhone, from version 1.6)

• A closed group is a conversation of up to 10 people with one owner. The owner makes it from their own mutual contacts, and any member can add more of their own mutual contacts — but not a person who has blocked them or whom they have blocked. There are no open links and no search for groups. Being in a group together does not make people contacts of each other and does not let them write to each other personally.
• Everyone who is in a group now sees the name, the nickname and the profile picture of the other members and who the owner is, also when they are not contacts — never the e-mail address or the login. They see the messages of the group with the names of their authors, reactions, votes and the short “typing” sign. Each member’s place of reading (up to which message of the group they have read) is shared with the other members, and under a message of yours the app shows how many of them have read the chat up to it (“Read by N of M”) — a mark that the chat was read up to that message, not proof that it was opened. Online status and “last seen” follow the usual rules for contacts, so for someone who is not your contact nothing is shown. A block between two members does not hide the group from either of them.
• A person who joins a group sees its messages only from their last joining; what was written before is not opened to them, also if they were in the group earlier. A person who leaves or is removed by the owner loses access at once: they receive nothing new, can open nothing old, and the iPhone app clears its local copy of the group. What they received and saved outside the app, and copies of messages that were forwarded to other conversations, are not recalled. Adding the person again counts as a new joining.
• The messages of a group are stored and protected like those of a personal conversation: the text is encrypted on our server (AES-256-GCM) and travels over TLS, but this is not end-to-end encryption — our service decrypts messages to deliver them. Next to each message the server keeps, encrypted, the name its author had when writing it, so that a message of someone who has left still shows who wrote it. Photos, videos and voice messages of a group are files kept 90 days; the message stays. Link cards, forwarding, the search index and the pins work as for personal conversations. No message is sent to any model. The picture of a group is checked once, when it is set, by the same picture-analysis model on our own server as a profile picture, and is kept as small JPEG copies; it belongs to the group and stays if the person who set it deletes their account.
• The owner can rename the group, set or remove its picture, remove members, hand the group over to another member and delete it for everybody; any member can leave, and the owner can leave only after handing the group over (or when alone, which deletes the group). A member can delete their own messages; the owner can delete also another member’s ordinary message — everybody then sees “Message deleted”. The group keeps short records of what happened in it (“… added …”, “… left”, a new title or picture), shown in the conversation to everybody who is in the group at that moment. For each command you give in a group the server keeps a short receipt (what, which group, when), to answer a repeated request safely, until you delete your account.
• You can report a message of a group, or the picture of a group, that you can see; for that you must be in the group at that moment. The report goes to our moderator with the reason, your comment if any and a copy of what is reported — the message or the picture — as for personal conversations, and is kept 180 days after it is handled; the reports you filed go when you delete your account. The moderator can delete the reported message, take the picture off, or delete the whole group; nobody else sees reports. You can block a member of a group without having them as a contact. A block stops personal messages, contact requests, online status and adding each other to groups, for both of you; it does not remove anyone from the group and does not hide the group’s messages — to stop seeing someone’s messages in a group, leave it.
• A notification about a message of a group shows the name of the group and of the sender, and the text of the message, when previews are on in the app’s settings; without previews it carries neither. A group can be muted: it then sends no notification and no sound. Notifications go only to people who are in the group at the moment they are sent, and through Apple like the others. The records of the group (someone was added, someone left) send no notification.
• When you delete your account you leave all your groups (the record says that a member left, without your name). A group you own goes to the member who has been in it the longest (since their last joining) and may own one; if there is none, it is deleted — a group is never left without an owner. Your messages in groups are deleted as in personal conversations (“Message deleted”, no text and no files; your polls, reactions and votes go), your name is removed from the records of the group and from the saved author names, and the copies that others made by forwarding what you wrote are deleted in all conversations (a copy already kept in a filed report stays for the usual period). The picture you set for a group stays: it belongs to the group. When a group is deleted — by its owner, by its last member who leaves, or by our moderator — all its messages, files, polls, pins, link cards and its search index are deleted for everybody and all members are told; what stays is an empty trace of the group without title and owner, and technical records of memberships. Copies of its messages that someone forwarded to another conversation are separate copies and stay there; reports already filed keep their copies for the usual period.

Voice and video calls (iOS)

• In a voice call the sound goes between the two phones, encrypted by WebRTC (DTLS-SRTP) — directly, or through our relay server when a direct connection is not possible. We cannot hear calls and do not record them. With a direct connection each phone sees the other’s IP address.
• A video call always goes through our relay server, never directly: the picture and the sound are encrypted between the two phones (DTLS-SRTP), and the relay passes them on without being able to see or hear them. We do not record video calls, do not keep any frame of them and do not analyse them. The relay sees the IP addresses of the phones and when and how much data goes through it, but not what is in it.
• During a call the camera works only in a video call that you start or take in the app, and only after you allow the camera to the app. It is switched off when the app goes to the background or the screen locks, and stays off until you switch it on again. The call does not continue in a floating window outside the app (no picture-in-picture).
• About each call we keep who called whom, when, how long it lasted, and whether it was a voice or a video call, and for a video call which sign-in session of each of you made or took it (an internal identifier) — for 90 days, also on the other person’s side after your account is deleted. The technical data to connect the call, which carries IP addresses, is deleted when the call ends.
• An incoming call wakes your phone with a notification through Apple carrying the caller’s name, or just “Pogosov” when previews are off; on a phone with a version of the app that has video calls it also says whether the call is a video call.

Windows on your computer

• Signing in and registration. The login or e-mail address, password, optional name and confirmation code you enter are sent to pogosov.com over HTTPS. Sign-in and registration also send the computer name, CPU architecture, Windows version and app version. Registration fields awaiting confirmation stay in memory; no registration draft is saved to disk. Sign-in tokens and session data are saved locally so you can reopen the app without signing in again; they are protected with Windows DPAPI for the current Windows user.
• Remembering credentials. If “Remember login and password” is selected, the full login and password are saved in a separate DPAPI-protected local file after a successful sign-in or registration. Ordinary sign-out does not erase this remembered pair. Turning this option off removes the saved pair; after changing or resetting the password the remembered password is cleared.
• Drafts, history and the send queue. Text drafts, cached message contents, queued message contents and prepared attachment bytes are kept separately for each Pogosov account and protected with DPAPI. The SQLite file itself is not fully encrypted: technical account, conversation and message identifiers, queue states and sizes remain ordinary database metadata. This local protection is not end-to-end encryption. Drafts and unsent queue entries have no automatic time limit. Ordinary sign-out closes access to that account in the app but retains its local drafts, cache and queue for the next sign-in to the same account. Clearing a draft or cancelling a queued item removes its local entry; an accepted send removes the queue entry, while the sent message may remain in the history cache. The history cache is reduced by size and message-count limits.
• Files and Save As. The app reads a file you explicitly select. Ordinary documents and archives are sent as their original bytes with a display file name; internal metadata such as an author name is not stripped. The original full local path is not saved in the send queue. The recipient receives the file through the conversation. Save As writes an ordinary, unencrypted file to the folder you choose and does not open it automatically. Your saved copies remain your files after sign-out, server-side message deletion or account deletion. Media preparation and playback can also use ordinary temporary working files; this differs from the encrypted persistent queue.
• Notifications. Windows receives messages through the app connection to pogosov.com; its desktop message notifications do not use Apple push tokens. The default app popup, or Windows notifications if you choose them, can show the sender name and a message preview. You can turn notifications or previews off in the app settings; without previews the notification is generic. System notifications are passed to the Windows notification subsystem on your computer and are also subject to Windows settings. Notification and interface preferences are ordinary local settings, not message or password storage. Signing out or locking Windows clears the currently owned popup.
• Maps and address search. The Windows map does not determine your device location: you choose a point or search for an address yourself. To display the map, the app requests tiles directly from OpenStreetMap; that service receives your network IP address and tile coordinates describing the area and zoom you view. Qt keeps an ordinary local map-tile cache, separate from the DPAPI-protected messenger cache. An address search you start sends the query to pogosov.com, which forwards it to the configured HTTPS geocoding service — Nominatim OpenStreetMap by default. That provider receives the query and our server’s network IP address, without your Pogosov account identifiers, sign-in credentials or original client IP being forwarded. Sending a location message sends the coordinates, title and address you chose to pogosov.com and the other participant.
• Microphone, camera and screen. A microphone is needed for voice recording, calls and a microphone test you start. In a video call, you decide whether to use the camera or share a screen or a window you select; the other participant receives that sound and picture. Windows calls use WebRTC in the Microsoft WebView2 component with a separate temporary component profile, rather than your usual browser profile. The media is encrypted by WebRTC (DTLS-SRTP). A voice call may connect directly or through our relay; with a direct connection the participants can see each other’s network IP address. Windows video calls, including screen sharing, use the relay. The relay sees connection IP addresses, timing and data volume, rather than the encrypted media contents.
• Conversation controls and local copies. Windows can hide a message only for you or delete it for both participants where the server permits it. Forwarding sends a copy of the selected message and attachments to the chosen conversation, including the original sender display name. Pins make a shared ordered list of selected messages in that conversation. These actions do not remove files you or another participant saved outside the app. Windows drafts and cache are separate from the server history; the 30-day iPhone draft rule above does not apply to them. For account deletion from Windows or questions about your data, contact help@pogosov.com.

The assistant

A chat with an assistant is open only to team accounts. Its messages, voice and photos are processed on our servers; when the assistant searches the web, the search query goes to Google or Yandex. The conversations stay until you delete them; their files go after 90 days.

What we do not do

• We do not collect your device location automatically, your address book, browsing history or advertising identifiers. If you choose a place to send in a message, its coordinates, title and address are sent to our server and the conversation recipient; of your photos and videos we get only those you send or set as your profile picture; the picture and the sound of a call pass through our relay encrypted and we do not store them.
• No ads, no analytics, no crash reporting and no tracking SDKs in the iOS app. The only third-party library is WebRTC for calls; it connects only to our servers and to the other phone.
• We do not track you across other apps or websites, and we do not sell or share your data.

Who else sees what

• Apple delivers notifications: it receives the device token and the notification itself — a market headline and its score, and for the messenger what is described above.
• The people you talk to see your name, nickname, profile picture, messages and calls, and in a video call the picture of your camera while it is on; our moderator sees what is reported.
• A site whose address you put in a message receives our server’s IP address and that address when the card is made (see “The messenger”).
• The members of a group you are in see your name, nickname, profile picture and your messages there, and up to which message you have read; our moderator sees what is reported.
• Google and Yandex receive the assistant’s search queries (team accounts only).

How long

• Your account, settings, contacts and messages — until you delete them. A guest installation with no device registered for notifications and not seen for 90 days is deleted together with its settings.
• A contact request and the message sent with it — until the request is accepted, declined or withdrawn; an unanswered request expires after 14 days and is deleted within a day after that; once accepted, the message stays in your conversation like any other.
• Photo, video and voice files — 90 days (a video uploaded but not sent — a day); a profile picture — until you change or remove it; drafts — on your iPhone, up to 30 days; call records — 90 days; reports — 180 days after they are handled.
• Sign-in sessions — up to 30 days after they end; sign-in attempts and letter limits — 7 days; the notification log — 90 days; e-mail codes stop working after 15 minutes and are deleted within a day.
• Link-card data in the cache — 24 hours (5 minutes after a failed read); the picture of a card and the files of a forwarded copy — 90 days from sending; the log of the profile-picture check — 90 days.
• Groups: messages — as long as the group exists; their files — 90 days (the message stays); the picture of a group — until it is changed or removed or the group is deleted; the receipts of your group commands — until you delete your account; reports on the picture of a group — 180 days after they are handled (an unhandled report — until it is); the log of the picture check — 90 days.
• Most periods above run from the moment a record is made; some run from its end or from the last use (reports — after they are handled, sign-in sessions — after they end, a guest installation — after it was last seen). What has outlived its period is deleted once a day, by the next daily cleanup — so a record can stay up to a day longer than its period.
• Your IP address appears in the web server logs, kept about two weeks; in the error log of our call relay, kept up to 8 days; and — to limit sign-in attempts and new installations — in our database for up to 7 days.

Deleting your data

In the iOS app: Profile → Delete account (for a guest: Delete my data). Deleted at once: your profile and its picture, settings, My companies, devices, contacts and blocks, the reports you filed, the assistant’s conversations with their files, and your messages in the messenger with their search index — at your contacts too: they see that a message was deleted, without its text or files; copies of your messages and of your picture in reports go as well. Questions: help@pogosov.com.

Groups: deleting your account removes you from every group and deletes your messages there, as described in “Closed groups”.

What stays: call records for their 90 days; if you had a conversation in the messenger, an empty account without name, nickname or e-mail, so your contacts see “Deleted account”; nobody can take your nickname for 30 days; your e-mail can be used again at once. Messages your contacts sent you stay with them. IP addresses in the web server logs, the relay’s error log and the sign-in limits are not linked to an account; they go after the periods above.

Children

The app is about the stock market and is not directed at children.

Changes

We publish changes to this policy on this page with a new date.

Questions: Pogosov — support.