Privacy Policy

1. Introduction

ENCOM CORP ("Company," "we," "us," "our") operates the Council encrypted messaging application ("Council," "the App," "the Service"). Council is built on the D4TE protocol, a post-quantum end-to-end encryption protocol where encryption keys are generated and stored exclusively on user devices.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the Council mobile application, the Council website (councilapp.com), and all related services.

If you have questions about this policy, contact us at support@encomcorp.co.

2. Information We Collect

Account Information

When you create a Council account, we collect:

Phone number or email address -- used solely for two-factor authentication and sending confirmation codes. This information is never shared with other Council users, never used to build a social graph, and never shared with third parties for marketing.

Safety ID -- your public pseudonym within Council (e.g., "XX123456"). This is not tied to your real name.

Password hash and salt -- we never store your plaintext password. Only a cryptographic hash is retained for authentication.

Device push tokens -- iOS APNS or Android FCM tokens used to deliver push notifications. Notification content does not include message text.

Messages and Content

Encrypted message content. All message content is end-to-end encrypted on your device before it reaches our servers. We store the encrypted ciphertext to facilitate message delivery and sync. We cannot read, decrypt, or access your message content.

Message metadata. To deliver messages, we process: sender ID, Network ID, timestamp, envelope type, and sequence number. This metadata is required for routing and synchronization.

Encrypted profiles. Your display name, nickname, and avatar are encrypted on your device and stored on our servers as opaque binary data. The server cannot decrypt or read your profile information.

Network Information

Network ID, creation date, join codes, and member relationships. For Networks using zero-knowledge encryption, the server stores an encrypted metadata blob and cannot read the Network name or description. Member roles (owner, admin, proven member) and notification preferences.

Purchase and License Information

License key activation records (key, activation date, expiration) and order references (order number, date, number of keys generated). We do not store credit card numbers, billing addresses, or payment details. All payment processing is handled by Stripe (web purchases) or the Apple App Store / Google Play Store (in-app purchases).

Automatically Collected Data

Server request logs -- IP address, user agent, and timestamp. Retained for 30 days for security and debugging, then automatically purged.

Application performance telemetry -- anonymized error traces and response times via Azure Application Insights. No individual user tracking.

3. What We Cannot Access

Due to Council's encryption architecture, the following data is inaccessible to us:

We cannot read your messages, Network names, display names, or profile information.

We cannot decrypt encrypted profile blobs or Network metadata.

We cannot recover your data if you lose your encryption keys or passphrase.

We cannot comply with requests for message content because we do not possess the decryption keys.

This is not a policy choice -- it is a consequence of our cryptographic architecture. We designed Council so that we cannot access your content even if we wanted to.

4. How We Use Your Data

Authentication. Your phone number or email is used to send verification codes when you sign in. It is never used for marketing or shared with other users.

Message delivery. We route encrypted messages to the correct recipient devices using message metadata.

Push notifications. We send alerts when you receive messages. Notification content does not include message text.

License validation. We check whether your account has an active license key to determine feature access.

Network limits. We count the Networks you own to enforce free-tier limits.

Security and abuse prevention. We use server logs and metadata-level signals to detect and prevent abuse, spam, and unauthorized access.

5. Data Retention

Messages: Stored until the Network is destroyed ("burned") by the owner.

Notifications: Automatically deleted after 30 days.

Account data: Stored until you delete your account.

Server logs: Retained for 30 days, then automatically purged.

License records: Stored for the duration of the license. Deleted when you delete your account.

When you delete your account ("Burn Account"), all server-side data is permanently and immediately destroyed via cascade delete. No backups are retained. No data is staged for future deletion. When it's gone, it's gone.

6. Third-Party Services

We do not sell your data. We do not share your data with advertisers. We do not use third-party analytics that track individual users.

The following third-party services process limited data as part of operating Council:

Stripe processes web payments. Stripe receives your email and payment information when you make a purchase on our website. See Stripe's privacy policy.

Apple App Store / Google Play Store process in-app purchases directly. We receive only a transaction confirmation -- no payment details.

Azure (Microsoft) hosts our servers and databases. Data is stored in Azure SQL and Azure Blob Storage.

SendGrid (Twilio) delivers confirmation code emails. SendGrid receives only the recipient email address and the confirmation code.

7. Data Location

All server data is stored in Microsoft Azure data centers in the United States (South Central US region). If you are accessing Council from outside the United States, your data will be transferred to and stored in the United States.

8. Your Rights

Access. You can view your account information within the Council app at any time.

Deletion. You can permanently delete all your data using the "Burn Account" feature. Deletion is immediate and irreversible via cascade delete.

Data portability. Due to end-to-end encryption, we cannot export your message content on your behalf. Messages are accessible only on your device.

Correction. You can update your account information (email, phone number) within the app.

Objection and restriction. You can stop using Council at any time. To cease all data processing, delete your account.

To exercise any of these rights, use the in-app features or contact us at support@encomcorp.co.

9. Children's Privacy

Council is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has created an account, we will delete the account and associated data as soon as reasonably practicable. If you believe a child under 13 is using Council, contact us at support@encomcorp.co.

10. Cookies

The Council website (councilapp.com) uses only essential cookies for security and spam prevention. We do not use cookies for tracking, advertising, or analytics. We do not use third-party cookies. Your cookie preference is stored locally in your browser via localStorage.

11. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

Right to know what personal information we collect, use, and disclose (described in this policy).

Right to delete your personal information (available via "Burn Account").

Right to opt-out of sale. We do not sell your personal information. No opt-out is necessary.

Right to non-discrimination. We will not discriminate against you for exercising your CCPA rights.

To make a request, contact us at support@encomcorp.co.

12. International Users

Council is operated from the United States. If you use Council from outside the United States, your information will be transferred to, stored, and processed in the United States. By using Council, you consent to this transfer. We process data in accordance with this Privacy Policy regardless of your location.

For users in the European Economic Area (EEA) or United Kingdom: the legal basis for processing your data is (a) your consent when you create an account, (b) the performance of our contract with you (these Terms), and (c) our legitimate interest in operating and securing the Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will provide notice of material changes through the App or via other reasonable means at least thirty (30) days before changes take effect. Your continued use of Council after the effective date constitutes acceptance. If you disagree, discontinue use and delete your account.

14. Contact Us

If you have questions about this Privacy Policy or your data, contact us:

ENCOM CORP
8 The Grn STE A, Dover, DE 19901
Email: support@encomcorp.co
Web: councilapp.com

Council is a registered trademark of ENCOM CORP. Last reviewed: February 7, 2026.

↑ Back to top