Privacy and security
What Croft does, what it does not, and what it will not claim.
The promises, and why each holds
Croft Caller and Croft Contacts have no internet permission
They ask Android for no network access, so they cannot send anything anywhere.
No ads, no analytics, no tracking, no Google services
No advertising or analytics code is in any app. Only Croft Messaging and Croft Plus have network access: for signed updates, and for Plus.
Every download and update is signed
Phones and computers refuse anything not signed by the project's release key or not matching its checksum. A computer's installer also refuses to put an older release over a newer one.
Messages between Croft people are end-to-end encrypted
Plus seals each message on the phone with a double ratchet, a new key for every message, and the service stores sealed bytes that expire after 14 days. Each message also carries its own random salt.
The people you talk to are checked
You can compare the safety number on both phones (also shown on your computer) to prove nobody sits between you.
What each app can reach
| App | Internet | Why |
|---|---|---|
| Croft Messaging | Updates only | Checks the signed list for new versions |
| Croft Caller | None | |
| Croft Contacts | None | |
| Croft Plus | Yes: its job | Sealed messages, the computer link, updates |
The apps talk to each other only through private links that work between apps with the same signing key, and each link answers only the app that owns the feature. With the app lock on, the lock screen shows only that a message arrived.
What the plan service sees
- Scrambled number tags, public keys, and sealed messages waiting for delivery.
- That a device connected, roughly how much it sent, and when.
- It cannot read a message and it is not told who asked about which number.
What we do not claim
- That Croft makes you anonymous or untraceable: the service sees which devices talk and when.
- That it has been independently audited: it has not yet.
- That every message is encrypted: texts to people not on Croft are ordinary SMS and MMS, which are not. They go through the carrier and are effectively public record.
- That your messages are safe if your phone is lost: the message database on the phone is not encrypted by the app. Use the phone's screen lock and the app lock.
Reporting a problem
Please do not post a security problem publicly. Write to the project privately with what you found and how to repeat it. Testing is welcome on your own phone and computer; do not run tests against the live service.