What ExcelDisc Chat holds, who else can see it, and how to take it back.

ExcelDisc Chat is built and run by ExcelDisc. Questions about anything on this page, and any request about your own data, go to info@exceldisc.com or through Help & support in the app, which reaches the same people and attaches the build you are running so the first exchange is not about which version you have.

The service runs on a single server we rent from a hosting provider, along with the database and the files people upload. It is not spread across a fleet of third-party platforms, and no copy of your conversations is sent anywhere else for processing, indexing or training.

Everything below is stored because the app cannot do the thing you asked for without it. There is no category collected “for analytics” or kept in case it turns out to be useful later.

Some of these were decisions with a cost attached; they are on the page because a promise not to do something is worth more than a list of the things we do.

• No advertising, no analytics, no trackers. There is no measurement product in the app or on this site, no session recorder, no pixel and no third-party script other than Google’s sign-in script on the sign-in screen. Nothing about you is sold, rented or shared with a data broker, and there is no arrangement under which that could change without this page changing first.
• No profile is built from your messages. They are not scanned to categorise you, not used to target anything at you, and not used to train a machine-learning model of any kind.
• No browser fingerprint, and no tracking identifier. Nothing measures your screen, your fonts or your hardware to recognise you, and there is no advertising identifier anywhere in the app. One thing is recorded against your account and it is not a secret: each time you sign in, that session stores the IP address it was opened from and a short description of the browser or phone — “Chrome on Windows”. It is captured once, never updated, and exists so that Your devices, in the app’s notification settings, can show you your own sessions and you can end one you do not recognise. You are shown exactly what we hold. It is never used to locate you, and it is never joined to anything else. Beyond that, the web server in front of the app keeps the ordinary access log every web server keeps, holding IP addresses for a short period for security and debugging; nothing joins that log to your account.
• No search history. What you type into search is sent to the server to run the query against your own conversations and is then gone. Nothing records it — no table, no file, and nothing on your device — and no suggestion, ranking or profile is built from it. The one exception is the one above: like every request, it passes through the web server’s ordinary access log, which is kept briefly and joined to nothing.
• No location, unless you send one. The app never reads your position in the background. A location card is a thing you deliberately attach, at which point your browser or phone asks you first, and what is stored is the coordinates you chose to send — in one message, in one conversation.
• No access to your camera roll or your address book. The web has no way to read either, and the apps do not ask for one. Attaching a photo opens the operating system’s own picker and hands us the file you picked and nothing else.
• No record of who is online, beyond right now. Presence is held in memory only. It is not written down, not queryable, and it resets whenever the server restarts — there is no history of when you were at your desk.

Importing an address book is the one place where an app can quietly take a great deal about people who never agreed to anything. Here it works the other way round.

• The file is read on your own device. A vCard or CSV export from your phone or mail client is parsed in the app; only the resulting names, addresses and numbers are sent, and only to be matched.
• Matches become contacts; everything else is discarded on the spot. An entry that does not correspond to an existing account is not stored, not counted and not kept for later. A file full of strangers leaves nothing behind on the server.
• Numbers are matched on their last nine digits, so the same person saved as +971 50 123 4567 and as 050 123 4567 is one person. Two numbers in different countries that share those digits look identical to it. The consequence is a contact saved that you did not mean to save, which you can remove.

The exception: an invitation

Inviting somebody who has no account is the one case where a non-user’s address or number is written down, and it has to be: matching them up when they eventually sign up is the entire purpose of the record. So an invitation stores the address or number, the name you typed to address the message, and when it was sent.

It expires after 60 days, you can withdraw it at any time from the pending list, and the number of invitations one account can have outstanding is capped. We do not send it. The message is composed in the app and handed to your own mail app or to WhatsApp, so it leaves your address or your number and any reply comes back to you — this server sends no email and no WhatsApp message to anybody, ever.

The complete list. There is no analytics vendor, no CRM, no support platform and no advertising network in it, because none of those are used.

A notification is the one piece of this app that routinely leaves our server through somebody else’s system and lands on a locked screen. So there are two modes, and the choice is yours, per account, in notification settings.

• Preview on — the notification carries the sender’s name and a line of the message, so a locked screen is useful even with no network. On the web that content is encrypted to your browser and the push service cannot read it. On a phone, Firebase and Apple can.
• Preview off, or “privacy mode” — the notification carries identifiers and nothing else. Your device then fetches the real content from us directly, over TLS, and renders it locally. You lose nothing on the lock screen, and the push services, Apple and Google are told nothing about who wrote to you or what they said.

One thing we cannot do from here. A notification is delivered by your browser’s or your phone’s push service, not by this app, so switching the app to airplane mode does not stop notifications arriving — if anything it makes them more likely, because the server can no longer see a live connection and assumes you need telling. Silencing them is a job for the mute controls and the notification settings, both of which are on our side.

What is true, in order of how much it matters.

• Everything travels over HTTPS. The connection between your device and the server is encrypted in transit, including the realtime connection the app keeps open while it is running.
• Messages are stored in readable form on the server. This is the important one and it is why it is also at the top of the page. Access is limited to the people who operate the service, and it is not casually browsed — but the capability exists, and no wording would change that.
• The cache on your own device is encrypted. The app keeps recent chats, the chat list and profile pictures locally so it paints instantly and works offline, and it encrypts them with a key the browser generates and refuses to hand back to any script. Storage copied off a device reads as ciphertext. This is a protection against a stolen disk, not against somebody holding your unlocked phone — and it is not end-to-end encryption, because the server still holds the originals in the clear.
• A signed-in session lasts 30 days and is a token held on your device. Signing out discards it and wipes the local cache, which matters most on a shared computer: the next person to sign in never inherits the last one’s chats or answers.
• Uploaded files are served only to members of the conversation they were sent to, under generated filenames that cannot be guessed from anything the sender typed.
• View-once messages are enforced on the server, not by the app being polite: the content is never included in a page of messages, the file stops being served once the look is spent, and an unopened one is destroyed after 14 days. What it cannot stop is a screenshot — no app on any phone can, WhatsApp included.

No system is perfectly secure, and this one is small. It is one server, run carefully, without a security team behind it. That is the right size for what it does and it is worth knowing when you decide what belongs in a chat and what belongs somewhere built for secrets.

• Messages and files — until they are deleted. There is no automatic expiry on an ordinary message, because a business conversation is worth as much two years later as it was on the day.
• Deleting a message for yourself — it disappears from your copy of the conversation and stays in everybody else’s. Nothing is destroyed.
• Deleting a message for everyone — within five minutes of sending it. The text, any card and the attachment record are wiped and a tombstone is left in their place, so the conversation keeps its shape.
• Editing a message — within five minutes, text only, and the bubble says it was edited.
• A view-once message — destroyed once everyone has looked, and destroyed unopened after 14 days.
• Invitations to people without an account — 60 days, or until withdrawn.
• Backup archives — the newest three per account; older ones are deleted along with their file.
• Device registrations — kept while the device is in use. One the push service reports as permanently gone is retired on the spot, and reinstalling the app revives it rather than starting again.
• Reports and support tickets — kept after they are resolved, because a pattern of reports about one account is the thing that makes any of them meaningful. They are destroyed when either account involved is deleted.
• Sign-in sessions — kept until you end them or delete your account, including ones already signed out: Your devices has to be able to say a device was signed out rather than quietly losing the row. Each carries the IP address and browser description captured when it was opened.

All of these are in the app, and none of them require asking us.

• Whether an offer can reach you. Broadcasts are opt-in: the first one anybody sends you arrives as a request rather than as the message, and the content never reaches you until you agree. You can change that answer later, in either direction, and you can mute a sender’s broadcasts without telling them — the mute is private on purpose, because a refusal they could see would cost you something socially and nobody would use the polite option.
• Blocking. One-directional and never announced. A blocked person can still write; you simply never receive it, are never notified of it, and never see it.
• Your contact link. The /c/ link you print on a card is a name you chose, not your email address, and changing it withdraws every copy already handed out.
• What a notification says, per the two modes above, and what you are notified about at all — per conversation, with mutes that expire, and account-wide.
• Airplane mode, a switch inside the app that stops it reaching the network at all while staying signed in. Everything paints from the encrypted local cache.
• Your profile. Every optional field can be cleared, and cleared means removed rather than blanked. The email address cannot be changed, for the reason given above.

In the app, in your profile, without emailing anybody and without a retention period on the way out. It takes effect immediately. The steps, and how to delete individual things without deleting your account, are set out here — that page is also the address the app stores publish, so somebody who has already uninstalled the app can still find it.

What goes: your profile and its picture, your contacts and the nicknames you gave them, your group and channel memberships, your blocks, your broadcast lists and consents, your device registrations and notification settings, your sign-in sessions and the addresses recorded with them, your starred messages, your reactions, your invitations, your support tickets, the reports you made and the reports made about you, and your backup archives — the archive files on disk as well as the records naming them.

What stays: the messages you sent. They remain in the conversations you sent them to, with your account detached from them. This is deliberate, and it is the one thing on this page most likely to be unwelcome: deleting your account would otherwise silently rewrite other people’s conversations — a quoted reply losing what it was replying to, an agreement losing the half that made it an agreement. The alternative was judged worse for them than this is for you. If a specific message needs to go, delete it for everyone within the five-minute window, or ask the people in that conversation to delete their copies.

Reports go too — both the ones you made and the ones made about you. That is the privacy-respecting answer rather than the convenient one: it does mean a pattern of reports about somebody cannot outlive the account they were made about. A backup file that someone already downloaded is on their computer and is beyond anyone’s reach, ours included.

Depending on where you live you may have formal rights over personal data — to see it, to correct it, to have it deleted, to receive a copy in a portable form, and to object to some uses of it. Whether or not they apply to you, they are honoured here, and most of them are built into the app so that exercising one takes a tap rather than a letter.

• See it and take a copy — Chat backup produces an archive of every conversation your account can see, as ordinary pages and files, and Contacts exports a .vcf that any phone or mail client will import.
• Correct it — the profile screen, at any time.
• Delete it — the account deletion above, with the one stated exception, or delete particular things and keep the account.
• Object or restrict — write to us. There is no automated decision-making here and no profiling to object to, so in practice this means telling us to stop doing something specific, which we will.
• Complain — to us first, at info@exceldisc.com, and to your local data protection authority if that gets you nowhere.

We hold this data to run a service you asked us to run: to deliver your messages, to keep your conversations where you left them, to notify the devices you asked to be notified on, and to keep the service secure and free of abuse. We do not rely on your data being useful to us for anything else, which is why there is no “legitimate interests” section here doing heavy lifting.

This is a tool for business, and the app says so at the door — the join form’s first line is that sentence, before it asks anything. It is not designed for, aimed at or marketed to children, and accounts are not knowingly created for them. If you believe a child has an account here, tell us and it will be removed.

The date at the top is the whole changelog. If something material changes — a new category of data, a new party who sees it, a different retention rule — the change is made here first and announced in the app rather than slipped in and dated quietly.

This page describes the service as it actually works today. Where the app grows a feature that stores something new, this file is part of building it, not a document updated afterwards.

info@exceldisc.com, or Help & support in the app, which reaches the same place and comes back as an ordinary conversation with a person rather than a ticket number. Either way, say what you want done and it will be done or you will be told why not.