Privacy Policy
ParLock is made by 2823683 Alberta Ltd., operating as Brightelm Studios ("we", "us"), in Alberta, Canada. Privacy is the reason ParLock exists, so this policy is short and plain. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA).
The short version
- ParLock is designed so your messages are end-to-end encrypted and we can't read them.
- We do not sell your information, show ads, or track you across other apps and websites.
- To run, protect and improve the service, we and our hosting provider (Cloudflare) process IP addresses and keep technical logs. They never include what you write or say.
- You don't need a phone number or email address to use ParLock.
- Our servers never store your name, phone number, email address or contacts, and can't read anything you write, send or say. A message waiting for someone's phone to connect is held end-to-end encrypted and deleted once it's delivered.
- We keep as little as possible, for as short a time as possible.
Messages and calls
Messages, photos, voice notes and calls are encrypted on your device and can only be decrypted by the people in the conversation. Our servers relay encrypted data between devices. ParLock is designed so that we cannot read, scan or recover the content of your messages.
Calls and your IP address. For the best quality, a call connects directly between the two phones when it can. When it does, the other person's phone can see your IP address (which can show roughly where you are and your internet provider), and yours can see theirs. The call is still end-to-end encrypted. ParLock says "Direct call" on the call screen when this happens. For maximum privacy, turn off Direct calls in Settings → Chats & Calls: your calls then always go through our call relay (run by Cloudflare), which hides your IP address from the other person. The relay sees IP addresses, timing and how much data passes, never what's said.
What our servers hold, and for how long. If the person you're writing to is online, your message passes straight through and isn't stored. If their phone isn't connected, our server holds your message, still encrypted, so it can forward it when their phone connects. It's deleted as soon as it's delivered, and after 30 days at most if it's never collected. Photos and other attachments work the same way: held encrypted until the other phone downloads them, then deleted, 30 days at most. Some signals, such as "typing…", are never stored at all. High security chats are different: by default our server never holds their messages, not even encrypted; if the other person is offline, your message waits on your own phone and goes when they're back. You can choose, per chat, to let our server hold them while the other person is offline; they stay end-to-end encrypted (we can't open them), with the same 30-day limit.
Recovery history. Our hosting provider (Cloudflare) keeps a rolling recovery history of the relay's storage for up to 30 days, to protect against data loss. So after a message or photo is deleted, its encrypted copy can remain in that history for up to 30 days. It stays end-to-end encrypted, so neither we nor Cloudflare can read it, and the relay also wraps everything it stores in a second layer of encryption whose key is replaced every month and destroyed about five weeks later. Once that key is gone, those old copies can't be opened at all.
Information we handle
- Delivery information. To deliver messages, our servers use random identifiers that are not linked to your name, phone number or email. While your phone is connected, the server keeps a record of which of these identifiers your connection is listening on, encrypted so that it can't be used later to link them together; it's removed after you disconnect.
- Notification tokens. To let you know a message has arrived, we store a push-notification token issued by Apple (or Google on Android). Notifications we send contain no message content, names or previews. For calls, a separate call token lets your phone ring even when ParLock is closed; the ring contains only a random call number, so our service and Apple can tell that a call rang your phone and when, but not who called. If someone you've allowed sends you an urgent message, our service marks that notification as urgent so it can break through silence; our service and Apple can tell that an urgent message was sent to your phone and when, but not who sent it or what it says. Which of your delivery identifiers allow urgent messages is stored until you turn it off.
- IP addresses and technical logs. To provide a reliable, quality service, keep it secure and fix problems, our servers and our hosting and network security provider, Cloudflare, process your IP address and keep technical logs: for example connection times, error reports, rate-limit and security events, and traffic statistics. We use them to keep ParLock running, stop abuse and find faults, never for advertising, and we don't use them to work out who talks to whom. Logs never contain your name, phone number, email address, contacts, or your messages, photos, voice notes or calls, which are end-to-end encrypted. They are kept for a limited time; Cloudflare keeps its own logs under Cloudflare's privacy policy.
- Contacts. If you allow it, ParLock reads your phone's contacts on your device only to help you find and invite people. Your contacts are never uploaded to our servers.
- Things you send us. If you email us for support, we keep that correspondence to help you, and delete it when no longer needed.
Information stored on your device
Your conversations, contacts in ParLock and settings are stored on your device, encrypted. Deleting the app deletes this data from your device.
Backups: what to expect
Regular chats are included, encrypted, in your normal iPhone backup (iCloud or your computer), so they can come back when you set up a new iPhone. By default the key that opens them is kept in your iCloud Keychain, which Apple encrypts end to end: Apple can't read it, and your Apple ID password alone can't open it. Someone who had both your Apple ID and your iPhone passcode could restore your regular chats, the same as with other messaging apps that use iCloud backups. To reduce that risk, turn on Apple's Stolen Device Protection and Advanced Data Protection. ParLock's extra protection settings can also make a backup open only with that protection.
High security chats are never backed up. They're for talking, not storing: they stay on your device, are left out of iCloud and computer backups on purpose, and don't move to a new device. We can't recover them for you.
Pre-release testing
If you take part in testing a pre-release version of ParLock, Apple may collect crash reports, usage information and feedback you choose to send, under Apple's privacy policy. Apple shares this with us so we can fix problems; it does not include your messages.
Sharing
We don't sell or rent personal information, and we don't share it for advertising. We use a small number of service providers to run ParLock, such as hosting, network security, and Apple and Google push notifications, only to operate the service. We may disclose information if legally required, but ParLock is designed so that we don't hold message content to disclose.
Where information is processed
ParLock's relay runs on Cloudflare's network in North America and is designed to store only encrypted data that we can't read, and only for as long as it takes to deliver. Some service providers, such as Apple and Google, may process limited technical information in other countries.
This website
parlock.ca uses no cookies and no advertising trackers. We use Cloudflare's built-in traffic analytics to understand how the site is used. It counts visits on Cloudflare's servers from its logs (pages visited, referring sites, browser and device types, countries); it runs no scripts or cookies in your browser and doesn't follow you across other websites. Our hosting provider (Cloudflare) also keeps standard server logs, including IP addresses and pages requested, for security and to run the site.
Children
ParLock is not directed to children under 13, and we don't knowingly collect their information.
Your choices and rights
You can access, correct or delete information we hold about you by contacting us. Because we hold so little, most of your information lives on your own device, where you control it. You also have the right to complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.
Security: no guarantees
We work hard to keep ParLock secure. We use current, widely reviewed security practices, our own reviews, and AI-assisted testing to find and fix vulnerabilities, and we keep improving as we learn. We do our best with what we know at the time.
No software or online service can be guaranteed to be completely secure or free of errors, and we don't promise that ParLock is. The descriptions on this page explain how ParLock is designed to work; they are not a warranty. To the extent permitted by law, ParLock is provided "as is". If you find a problem, please tell us at security@parlock.ca (how to report).
Changes
If we change this policy, we'll update the date above and, for significant changes, tell you in the app.
Contact
Privacy questions: privacy@parlock.ca
2823683 Alberta Ltd. o/a Brightelm Studios, Alberta, Canada