UU Chat does not require a UU Labs account, email address or phone number for messaging. Beta invitation emails are separate from the app. Optional external media connects to third-party providers and has a different privacy boundary from peer messages.
Messaging and your identity
The app creates a cryptographic identity on your device. Your public Token ID lets a contact locate and authenticate that identity. You choose who receives it; it is contact information, not a password.
Peer messages and file transfers use encrypted sessions over Tor onion connections. UU Labs does not operate a central account directory, message relay, attachment store or cloud conversation history. UU Chat adds its own end-to-end encryption between the communicating devices, on top of Tor’s network encryption. Tor relays do not have the UU Chat session keys and cannot read the contents of your messages or transferred files.
Protecting message contents is different from guaranteeing anonymity. Tor is external network infrastructure, and an observer may still try to identify people through traffic patterns. Neither Tor nor end-to-end encryption can protect a conversation if a participant’s device is compromised.
Information on your device
The app stores identity material, verified contacts, preferences, encrypted message history, outgoing queues and received files as needed for its features. Contact information includes trust-verification information and connection state. The app lock and encrypted storage provide protection within their documented limits; they are not a guarantee against root access, malicious software or an unlocked device.
Receiving a delivery acknowledgement tells a sender that the receiving device committed the message to storage. Ordinary messages do not send a general read receipt. For burn-on-read content, the first reveal produces a message-specific acknowledgement, so the sender can infer that the protected item was opened.
Timers, deletion and exports
Conversation settings can control message lifetime and burn-on-read behaviour. Changes apply to future messages. A timer or deletion cannot retract a copy someone has already made, an exported file, or information captured outside the app. Feature availability depends on the beta build.
Choosing to save or share an exportable file creates access outside UU Chat. The destination app, folder or person then controls that copy. Notifications may be visible to Android, authorised notification-listener apps and connected devices such as watches.
Optional external media
External-media features can load content from YouTube, Instagram, TikTok, Facebook, X, image hosts and GIF providers. These requests go directly to providers and their infrastructure over HTTPS, outside the peer Tor messaging path. They may receive your IP address, requested content, device/browser information and request timing. A sender-selected image host can also observe a request.
You control permitted media categories and contact preferences. Switching a provider off keeps its links from loading in the app; it cannot undo requests already made. Playing third-party media does not become anonymous merely because it appears inside a private conversation. Third-party services apply their own privacy policies.
Beta requests and support
If you email UU Labs, we receive your email address, message and any information or attachments you choose to send. We use this to reply, arrange beta access and investigate reported issues. Please do not send private chat contents, passwords, identity keys or unrelated personal documents.
Correspondence is handled by our email provider. If Google Play is used to distribute a beta, the Google account address you provide for that purpose may be added to its tester list. Google processes store and testing information under its own policies. A beta request is not a sign-up to marketing.
UU Labs does not sell personal information. Support and invitation correspondence is retained as needed to handle the request and maintain relevant support records. You can ask us to remove your invitation request or delete personal information we hold; legal obligations and necessary records may limit deletion. Information held only on your device is not accessible to UU Labs through a central history service.
This website
This website has no advertising trackers, analytics scripts, account system or tracking cookies added by UU Labs. Its fonts and interface assets are served locally. Microsoft Azure hosts the site and may process connection information such as IP address, request time and browser information to deliver and secure it.
The introduction video is not loaded from YouTube until you choose to load it. Loading the player connects to YouTube and its service providers. We use YouTube’s privacy-enhanced embed domain, but that does not mean no data is processed. You can instead follow the link to YouTube. See Google’s privacy policy and Microsoft’s privacy statement.
Diagnostics and beta limitations
A support report may include diagnostic information you deliberately provide. Field-test builds can have diagnostic and screenshot behaviour that differs from release builds. Follow the instructions for your particular beta build and review any log before sending it. This statement does not promise an independently certified security audit or protection from all device attacks.
International processing
Hosting, email, distribution and optional media providers may process information outside Australia. The provider’s terms and privacy policy apply to information handled by that provider.
Questions, access or deletion requests
Contact support@uulabs.com.au with the subject “UU Chat privacy request”. Tell us which correspondence or information your request concerns, without including sensitive app keys or private conversations. We will respond and work with you to address the request.
Changes
We will update this page as the app, beta distribution or website changes. The date above identifies the current statement. New features may have additional in-app explanations or choices.