Vero Messenger – Privacy Policy
Last updated: 5 October 2026
Vero Messenger ("Vero", "we") is a private messenger made by Vyoma Group. This policy explains what data Vero handles, why, and what control you have. Contact: vyomagroupofficial@gmail.com
1. The short version
- Your messages, photos, files, voice notes, calls and stories are end-to-end encrypted on your device. Our servers store and deliver only encrypted data and cannot read it.
- We keep only what we need to run the service: your account, your profile, your devices' public keys and the delivery metadata listed below.
- We do not sell your data, show ads, or use your data to train AI models.
2. Data we process
| Data | Why | Where |
|---|---|---|
| E-mail address (and, if you sign in with Google, your Google name and e-mail) | Sign-in, account recovery | Our backend (Supabase) |
| Username, display name, "about", profile photo | So contacts can find and recognise you | Our backend |
| Device public keys, device names, push-notification tokens | Encryption and notifications | Our backend |
| Delivery metadata: who is in which chat, when messages are sent, message type, call times and outcome | Delivering messages and calls | Our backend |
| Encrypted messages, attachments and stories | Delivery to your devices and contacts | Our backend, encrypted; deleted when you delete them or when they expire |
| Optional: hashed e-mail / phone for "find friends" | Only if you turn on discovery | Our backend (hash only) |
| Optional: encrypted chat backup | Only if you turn on backup | Vero cloud or your own Google Drive, as you choose |
The decrypted copies of your messages live only on your devices. If you do not turn on backup, your chats stay only in your device's local storage.
Channels (public broadcast channels) are not end-to-end encrypted; the app says so on every channel screen.
3. Google user data
If you choose Sign in with Google or Connect Google Drive, Vero asks Google for:
openid,email,profile– to create and sign in to your Vero account with your Google name and e-mail address.https://www.googleapis.com/auth/drive.appdata– access only to Vero's own hidden application folder in your Google Drive. Vero cannot see, read or change any other file in your Drive.
How we use it:
- The Drive folder is used only to store and restore your end-to-end
encrypted chat backup file (
vero-backup.bin), which is encrypted on your device before upload with a key only you hold (your recovery key or passphrase). Neither Vero nor Google can read its contents. - Google access and refresh tokens are stored only on your device. When an access token expires, the device sends the refresh token to our server function solely to obtain a new access token from Google; it is not stored or logged.
- We do not transfer Google user data to anyone, use it for advertising, sell it, or use it to train AI/ML models, and humans at Vero do not read it.
Vero's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove Vero's access at any time from the app (Settings → Chat backup → Disconnect Google Drive) or at https://myaccount.google.com/permissions. Deleting the backup in the app deletes the file from your Drive.
4. Service providers
- Supabase – database, authentication, storage and realtime delivery.
- Expo / Apple / Google push services – notification delivery. Notification content says only "New message" unless you enable sender names.
- Google – only if you use Sign in with Google or Drive backup.
- GIF search provider (Tenor/GIPHY) – only search terms, through our proxy, when you search for GIFs.
5. Retention and deletion
- Disappearing messages and stories are deleted from the server when they expire.
- Deleted messages are wiped from the server (a tombstone remains).
- You can delete your backup at any time. To delete your account and its server data, e-mail us from your account's address; we delete it within 30 days.
6. Security
End-to-end encryption (X3DH + Double Ratchet), row-level security on every database table, private realtime channels, and app lock. No system is perfectly secure; please keep your device and recovery key safe.
7. Children
Vero is not intended for children under 13 (or the minimum age in your country).
8. Changes
We will update this page and the "Last updated" date when this policy changes.
9. Contact
Vyoma Group – vyomagroupofficial@gmail.com