MelleM Privacy Policy
Version 16 – 1 November 2026 (version 15: 30 October 2026, version 14: 30 October 2026, version 13: 30 October 2026, version 12: 29 October 2026, version 11: 28 October 2026, version 10: 23 October 2026, version 9: 22 October 2026, version 8: 20 October 2026, version 7: 20 October 2026, version 6: 20 October 2026, version 5: 20 October 2026, version 4: 20 October 2026, version 3: 18 October 2026, version 2: 18 October 2026, version 1: 17 October 2026)
In short
- Your conversation goes directly and encrypted between your phone and the other person's phone. Only if the two phones can't reach each other directly does it pass through our relay server, still encrypted so we can't read, hear or see it. With “Direct Only” on, it never does.
- Speech recognition, voice check, translation and reading aloud happen on your phone.
- Kanha's own server in Switzerland helps the two phones find each other. It handles encrypted connection details it cannot read, for a few minutes at most, keeps an invitation you send, encrypted, for up to 7 days, and keeps messages you write to someone who isn't connected, encrypted, until their phone has them (at most 7 days).
- So the people you have connected with can call you, the server keeps your phone's push addresses from Apple, in a room only your two phones know. This is on from the start, and you can turn it off for each person. The server never learns names or what you say.
- If you add a profile photo, it goes only to the people you talk with, directly and encrypted.
- No account, no advertising, no tracking, no analytics. If you answer the question after a conversation, your answer comes to us without your name or what you said.
Who is responsible
Kanha Lönborg, Unterer Deutweg 23, 8400 Winterthur, Switzerland ("Kanha", "we").
Contact for privacy questions: privacy@kanha.ch
What stays on your phone
The following is stored only on your phone. We never receive it.
- Settings: the name you enter in the app to be shown to the other person, the languages you speak and want to hear, and your choices in the app, your profile photo if you choose one, and an app identifier: a random number the app makes when it is first started, not linked to your phone, phone number or any account.
- Voice profile (if you set one up): a set of numbers describing your voice, calculated from a short recording when you set up the voice check. The recording itself is not kept. The profile is used only to recognise whether the voice the microphone hears is yours, so other voices in the room are not sent.
- Saved conversations (if saving is on): the date, the names and languages, everything said with its translation, and a key that lets the two phones find each other again. You can turn saving off and delete conversations in the app.
- Contacts: for the people you have talked with, their name and profile photo as their app sent them, their app identifier, a name you gave them yourself, if any, and a key your two phones share so they can find each other again.
- Call keys: a key derived from the key the two of you share is kept in the phone's keychain, so the app can show who is calling, also when the phone is locked.
- Keys: the conversation keys, the keys for each person and the app identifier are kept in the phone's keychain, for this phone only. They are not synced with iCloud Keychain.
None of this is part of your phone's backup (for example iCloud Backup or a backup on a computer). Deleting the app deletes all of this; if you install it again, it starts empty.
Moving to a new phone: with "Move to Another Phone" in the app's settings, your old phone sends your settings, contacts and saved conversations with their keys directly to your new phone, end-to-end encrypted, after you confirm on the old phone. It does not go through us. Your voice profile is not moved; you set it up again on the new phone.
What goes to the other person
During a conversation your phone sends directly to the other person's phone: the name you entered in the app (it can be any name; MelleM doesn't take your name from the phone or anywhere else), the language you speak, your app identifier (so their app recognises you again, also with a new invitation), your profile photo if you chose one, the text recognised from your speech (while you speak and when a sentence is finished), an identifier for the conversation and, from the person who started the conversation, the conversation key. This is end-to-end encrypted (WebRTC with DTLS). The other person's phone translates your words and may save the conversation on that phone, just like yours.
Your voice: while you talk, your voice also goes to the other person's phone, so they hear you as in a phone call. If you speak different languages, their phone then reads your translated words aloud; if you both speak the same language, there is nothing to translate and speech recognition is off. Your voice is end-to-end encrypted (WebRTC with DTLS-SRTP) and not recorded. If one of you turns reading aloud off, you only send each other text.
Video: if you turn your camera on in a conversation, your video goes directly to the other person's phone, end-to-end encrypted (WebRTC with DTLS-SRTP), and is not recorded. It passes through our relay server only when the phones can't reach each other directly (see below). The camera is off until you turn it on, and you can turn it off at any time.
To connect directly, the two phones exchange their network addresses (IP addresses), so the other person's phone learns yours, as with a phone or video call.
Our connection server
To set up the direct connection, the phones leave each other an invitation and an answer on our server, also when you move to a new phone. These contain the technical connection details (network addresses and connection keys) and are encrypted on your phone with a key that is only in the invitation link or known to the two phones. We cannot read them.
- They are kept only in the server's memory, never on disk, and deleted once the phones are connected, or after at most 10 minutes.
- Your IP address is used briefly, in memory, to protect the server against misuse (limiting the number of requests). It is not logged or stored.
- Relay: if your phones can't reach each other directly, for example on some mobile networks, the connection goes through our relay server in Switzerland instead. It only passes the encrypted data on and can't read, hear or see your conversation. While the connection lasts it knows both phones' IP addresses and how much data passes; it keeps no logs.
- Direct Only: if you or the other person turns on “Direct Only” in the app's settings, what you say, write and show goes only directly between your two phones: never through our relay, and no messages are left on our server, so you can write to each other only while connected. Our server still helps the phones find each other and passes on calls, as described here. Your phone tells the other person's phone whether you have it on, so that their phone does the same.
- Network address (STUN): to find out its public network address, your phone asks our server.
- Invitations: when you send an invitation, our server keeps an encrypted card with your name, and the few words you wrote with it, if any, for up to 7 days, or until the invitation has been accepted or withdrawn. The server can't read it; only someone with the link can. The other person's phone translates your words and keeps them as your first message. Your phone's notification address is kept for the same time, so you can be told when the invitation has been accepted.
- Messages: if you write to someone who isn't connected, the message is encrypted on your phone with a key only your two phones know, and it stays on our server until their phone has fetched it, at most 7 days. We can't read it. Their phone gets a notification through Apple; the name and text in it are encrypted too, so only their phone can show them. So you can see how far your message has come ("Sent", "Notified", "Delivered"), our server notes when their phone showed the notification and when it fetched the message, and keeps these two times for at most 7 days. Only the two phones know where to ask.
- Service messages: the app fetches one public file with messages from us to everyone, for example about planned maintenance, from our server: when it opens, every 5 minutes while it is open, and when something can't reach our server. The file is the same for everyone, and the app sends nothing about you. Your IP address is used only for the request and is not logged.
- The server keeps only counts, such as the number of connections per hour, without any addresses.
- Our servers are located in Switzerland and are run on our behalf by a hosting provider there.
The website mellem.kanha.app (and crosstalk.kanha.app, its address before the app was called MelleM), which opens if you follow an invitation link without the app, and where Help and “Read More” in the app take you, uses no cookies and no analytics and keeps no access logs. The part of the link after "#" (the key) is never sent to any server.
Feedback after a conversation
Now and then, after a conversation, the app asks how it went. Answering is up to you. If you answer, your phone sends us your answer (good or could be better, what could be better, and anything you write), the app version, the iOS version and phone model (for example iPhone 16), the two languages, whether you talked on one phone or two, how many minutes the conversation lasted, whether it went directly or through our relay, how often the connection was lost, and whether a camera was on. It doesn't include your name, your app identifier, what was said, or anything else that identifies you or the other person; please don't write personal details yourself. Our server keeps the answer with the date (not the time) for one year to make MelleM better. Your IP address is used only briefly, in memory, to protect the server against misuse, as above.
Calls
When you tap "Talk with" and the other person doesn't have the conversation open, their phone rings like a phone call. The people you have connected with can call you in the same way. This is on from the start; you can turn it off for a person under "… may call me" on their contact.
- What our server keeps: for each person who may call you, your phone's push addresses (tokens from Apple that let our server reach this phone: one for notifications and one that makes it ring), a random room number that only your two phones can work out, and a random device number. No names, phone numbers, accounts or conversation text.
- How long: on the server's disk while calls from that person are allowed, and deleted when you turn it off or delete the contact, when Apple tells us an address is no longer valid, or after 90 days without the app renewing it. A room holds at most six phones; when a seventh registers, the one that renewed longest ago is removed.
- A call: their phone asks our server to ring your phone, and the server sends a call notification through Apple's push service. Who is calling (the name they entered in the app) is encrypted on their phone, so only your phone can read it; neither we nor Apple can. The server keeps the call's random number and which phones have answered or declined only in memory, for at most 2 minutes, so the other phones stop ringing.
- On your phone: the call is shown with iPhone's call screen (CallKit). Calls are not added to the Phone app's recent calls, so they are not in your iCloud call history either.
- Replies: when your phone waits for the other person, it may lend its push address so they can answer "Coming in 5 minutes". The server keeps a lent address only in memory, for at most 15 minutes.
- Apple delivers the notifications and calls, and so knows that our server sent something to your phone, as with any app's notifications.
- When you answer, the conversation is set up as described above: directly between the phones and end-to-end encrypted.
Other services your phone uses
- Google STUN server: only if our server can't be reached for this, your phone asks Google's public STUN server (stun.l.google.com) for its public network address instead. Google then receives your IP address. No conversation content is sent. See Google's privacy policy.
- Apple: speech recognition, translation and voices are Apple features on your phone. The language models are downloaded from Apple when needed. These are covered by Apple's privacy policy.
- TestFlight (test versions only): if you test MelleM through TestFlight, Apple may share crash reports and feedback you choose to send with us under Apple's TestFlight terms.
Microphone, camera and local network
- Microphone: used only while a conversation is running, or while you record your voice profile. Audio is processed on your phone and never sent.
- Camera: used only to scan the other person's QR code and, if you choose to, to take your profile photo. A photo you take or pick from your library is reduced to a small square picture without location or other details before it is stored or sent. MelleM only receives the photo you pick.
- Local network: used to connect directly to a phone on the same network.
Overview
| Data | Where | How long |
|---|---|---|
| Settings, voice profile, saved conversations | Your phone only | Until you delete them or the app |
| Conversation text | Directly to the other phone, encrypted | As long as the other person keeps the conversation |
| Encrypted invitation and answer | Our server's memory | Until connected, at most 10 minutes |
| Encrypted invitation card with your name and any words you wrote, and your notification address | Our server's disk; Apple (notification) | Until accepted or withdrawn, at most 7 days |
| Encrypted messages to someone not connected | Our server's disk | Until their phone has them, at most 7 days |
| When a message's notification was shown and when the message was fetched | Our server's disk | At most 7 days |
| Service messages (the same file for everyone) | Fetched by your phone from our server | Nothing about you is kept |
| Relayed conversation (only if the phones can't connect directly, and never with “Direct Only”) | Passed on by our relay server, encrypted | Not stored |
| IP address | Our servers' memory (misuse protection; the relay while you're connected through it); the other phone; Google STUN only as a fallback | A few minutes, or while connected through the relay; not logged |
| Push addresses (calls) | Our server's disk; Apple | Until you turn calls off for the person or delete the contact, at most 90 days without use |
| Answers to "How did the conversation go?" (only if you answer) | Our server's disk | One year |
Legal basis
We process the data above to provide the connection you ask for (Art. 6(1)(b) GDPR) and, for misuse protection, on the basis of our legitimate interest in a secure service (Art. 6(1)(f) GDPR) and, for answers to the question after a conversation, on the basis of our legitimate interest in making MelleM better (Art. 6(1)(f) GDPR), in accordance with the Swiss Federal Act on Data Protection (FADP).
Your rights
You can ask us about the data we process about you and have it corrected or deleted, and you can object to processing. Our server keeps messages and invitations encrypted for at most 7 days, and we can't read them, so there is usually nothing we could show you. Answers to the question after a conversation can't be linked to you, so we can't find or delete a single answer. Everything else is on your phone, where you can delete it yourself. You can also complain to a data protection authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).
Changes
If we change how MelleM handles data, we will update this policy and its version and date.