CurbOver Messenger — Privacy Policy

Last updated: 4th July 2026

This Privacy Policy explains how CurbOver (“we”, “us”, “our”) collects, uses and protects your personal information when you use the CurbOver Messenger mobile application and the messaging service hosted at matrix.curbover.com (together, the “Service”). CurbOver Messenger is a chat application built on the open-source Matrix protocol, connected to CurbOver’s own homeserver and bridged to Telegram so the community can take part in its existing Telegram groups from within the app.

If you have any questions about this policy or your data, contact us at info@curbover.com.

1. Who is responsible, and how the Service works

The data controller for the Service is CurbOver. Your CurbOver Messenger account lives on our own homeserver at matrix.curbover.com; your account and native Matrix messages are stored on infrastructure operated by or for CurbOver, not on matrix.org or any third-party public Matrix server.

CurbOver Messenger also operates a bridge to Telegram so that members can use the community’s existing Telegram groups from within the app. When you link your Telegram account (see section 2) and send or receive messages in a bridged conversation, that content is relayed to and from Telegram and is subject to Telegram’s own Privacy Policy. Telegram is an independent third party and we do not control how it processes your data.

2. Information we collect

Account information

  • Your username (Matrix user ID), display name, and optional profile picture.
  • Your password, which is stored only in hashed, salted form — we never store it in plain text.

Messages and media

  • Native chats between CurbOver Messenger users (and other Matrix users) are end-to-end encrypted by default. They are stored only in encrypted form on our homeserver and can be read only on your verified devices and those of your recipients — CurbOver cannot read their content.
  • Bridged Telegram chats (any conversation connected to a Telegram group or contact) are not end-to-end encrypted. Because a bridge has to translate between Matrix and Telegram, this content is handled in unencrypted form: it is protected in transit by TLS and stored on our access-controlled servers, but it is technically readable by the Service and is relayed to and stored by Telegram. Please treat bridged conversations as you would any normal Telegram chat. The app shows an encryption indicator on each conversation so you can tell which is which.
  • We process associated metadata required to deliver the Service, such as room membership, timestamps, and delivery/read receipts.

Telegram account and bridge data

  • If you choose to connect your Telegram account, you authenticate directly with Telegram. Our bridge stores the resulting Telegram session/authorisation token on our server so it can keep your chats in sync, together with the Telegram chats, contacts and message history that are mirrored into the app for the groups you belong to.
  • You can disconnect the bridge at any time (for example with the !tg logout command), which ends the bridged session.

Technical and log data

  • Your IP address, device and client/app version, and connection times. These are kept in server logs and used only to operate, secure and troubleshoot the Service, and to prevent abuse. Logs are retained for a limited period and then deleted.

Push notifications

  • To deliver notifications when the app is closed, your device’s push token is shared with Google Firebase Cloud Messaging (FCM), which acts as a processor. Depending on your settings, a notification may include the sender or room name; you can reduce this to minimal content in the app’s notification settings.

Optional features

  • Location sharing: location data is processed only when you choose to share your location in a conversation.
  • Camera, microphone, photos and files: accessed only when you use them to send media or make calls.

3. Sharing — what we do and do NOT do

  • The only third party that receives your message content is Telegram, and only for bridged conversations, as an inherent part of the bridging function described above. Your device push token is shared with Google (see “Push notifications” above).
  • We do not use third-party analytics or behavioural tracking. Analytics and crash/usage reporting are disabled in this app.
  • We do not show advertising or share your data with advertisers.
  • We do not sell your personal information.

4. Legal basis for processing

Where applicable law (such as the GDPR or India’s Digital Personal Data Protection Act) requires it, we process your data on the basis of: performance of our service to you (delivering messages), our legitimate interest in keeping the Service secure and reliable, and your consent for optional features such as location sharing and push notifications.

5. How long we keep your data

Account data and messages are retained until you delete them or your account is removed. Server logs containing technical data are retained for a limited period for security and then deleted. When your account is deleted, associated personal data is removed from active systems within a reasonable period, subject to any legal retention obligations.

6. Your rights

You may access and update much of your information directly in the app. Subject to applicable law, you also have the right to request access to, correction of, or deletion of your personal data, and to object to or restrict certain processing. To exercise these rights, contact info@curbover.com.

7. Security

We use end-to-end encryption for native messages exchanged between CurbOver Messenger and other Matrix users, transport encryption (TLS) for all connections, and hashed password storage. Bridged Telegram messages are encrypted in transit but are not end-to-end encrypted (see section 2). Access to our systems is limited to personnel who need it to operate the Service. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

8. Children

The Service is not intended for anyone under 16 years of age, and you must be at least 16 to use it.

9. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated “Last updated” date.

10. Contact

CurbOver — info@curbover.com — https://curbover.com