Privacy policy

Last updated: October 22, 2026

Wassil is a messaging app for teams, families and friends: chats, groups, files and calls, on Android and the web. This policy explains what Wassil collects, why, who can see it, and how you can have it deleted.

Who we are

Wassil is made and operated by Shabakett Core, Annaba, Algeria. Contact: contact@shabakett.com.

This policy covers the Wassil service we host at wassil.shabakett.com, the Wassil Android app and the web app. Organizations can also run Wassil on their own servers; on such a server, the organization that runs it decides what happens to your data, and this policy does not apply to it.

What we collect

Your account

• Your name, username, email address and phone number (the ones you give us), your profile photo, language and time zone.
• Your password, stored only as a one-way hash. If you sign in with Google, we receive your Google account ID, name, email address and whether Google has verified it; we never see your Google password.
• Your encryption public key, and your private key wrapped with a link code that only you know.

What you share

• Messages, photos, files, voice notes, and the locations and contacts you choose to send.
• Reactions, mentions, pins, and the names of conversations and topics.

Calls

• Who called whom, who joined, and when each call started and ended. This history appears in the conversation.
• The audio and video of calls are relayed live by our call server and are never recorded.

Your devices and sessions

• A random identifier the app creates for your device, a label such as “Chrome on Windows”, the platform, and when the device was last used.
• A push token, so that we can notify you of new messages and calls.
• Your active sessions, stored as hashes of their tokens.
• The time you were last active. You can hide it from other people.

Organizations

• The organizations you belong to, your role in each, the storage you use, and invitations and join requests.

Technical logs

• Our server logs each request: your IP address, the address requested, the time and the result. We use them to run the service, fix problems and stop abuse.

No tracking. Wassil contains no advertising, no analytics and no crash-reporting trackers, and uses no tracking cookies. The website and the web app use your browser’s storage only to keep you signed in and remember your theme and language.

Encryption

All traffic to and from Wassil is encrypted (HTTPS). Each organization chooses how its messages are protected:

• Standard encryption. Messages, files and voice notes are encrypted when they are stored, with keys our server holds. This protects them against stolen copies of our database. Our server can still decrypt them, which it does to show them to you and to put a short preview in notifications.
• End-to-end encryption. Messages, files and voice notes are encrypted on your device, and only the members of the conversation can decrypt them. Calls are end-to-end encrypted too. Our server cannot read them, and notifications don’t contain the text.

In both modes, some information is not end-to-end encrypted, because the service needs it to work: your profile, the names of conversations and topics, reactions, mentions, pins, file names and sizes, and call history.

How we use your information

We use it only to:

• provide Wassil: deliver your messages, files and calls, and keep your devices in sync;
• sign you in and send you verification codes;
• notify you of new messages and calls;
• keep the service secure, and prevent spam and abuse;
• handle an organization’s subscription and payments;
• answer you when you contact us.

We do not sell your data, show you ads or build advertising profiles.

Who can see your information

Other people on Wassil. People you talk with see your name, profile photo and messages. Whether people outside your organizations can find you, and whether others see when you were last active, depends on your settings.

Your organization’s administrators. They can see the member list with each member’s name, username, email address and phone number, and the storage each member uses. They can invite and remove members, change roles, and create accounts. They cannot read conversations they are not part of.

Service providers who help us run Wassil, only for what each one does:

• Google: confirms your identity when you sign in with Google, and delivers notifications to Android (Firebase Cloud Messaging). A notification contains the sender’s name and the conversation’s name; with standard encryption it also contains up to 100 characters of the message. Apps installed from Google Play are updated through Google Play.
• Email and SMS providers: deliver verification codes to your email address or phone number.
• Payment provider: handles an organization’s payment. It receives the amount and a reference to the organization. Card details are entered with the provider and are never stored by Wassil.

When you open a location that someone shared, it opens in Google Maps, which then receives those coordinates.

The law. We disclose information when the law requires it.

Permissions on Android

Wassil asks for a permission only when you use the feature that needs it:

• Notifications: new messages and incoming calls.
• Microphone and camera: calls, voice notes, and photos and videos taken in the app. During a call, the microphone stays on when you leave the app or lock the screen, and an ongoing-call notification lets you return or hang up.
• Location: only when you share your location in a conversation.
• Contacts: only when you share a contact, on phones whose contact picker needs it.
• Storage (Android 10 and older): saving files to Downloads.
• Install apps: opening an APK file that someone sent you. On copies not installed from Google Play, this permission is also used to install Wassil’s own updates.
• Full-screen notifications: showing an incoming call on the lock screen.

Wassil does not ask for access to your photo library. Files come from the system picker, which shares only what you pick.

How long we keep it

• Your account: until you delete it (see below).
• Messages and files: until they are deleted by you or by the conversation’s administrators. Deleted messages are hidden from everyone at once, and their files are erased.
• Call history: as part of the conversation it belongs to.
• Verification codes: valid for 10 minutes. We store only a hash of each code.
• Sessions: a session expires 30 days after sign-in. You can sign out of any session sooner in your account settings.
• Devices: until you remove the device from your account.
• Server logs: up to 24 months.

We may keep information longer when the law requires it.

Delete your account

To delete your Wassil account, email contact@shabakett.com from the email address of your account, with the subject “Delete my Wassil account”. If your account has only a phone number, tell us your username and phone number, and we will confirm the request by sending a code to that number. We delete the account within 30 days, and tell you when it is done.

When your account is deleted:

• Deleted: your email address, phone number, username, password and Google sign-in link; your sessions, devices and push tokens; and your membership in every organization.
• Kept: the messages you sent to other people stay in their conversations, under your name and profile photo, so that their conversation history remains readable. To remove a message entirely, delete it before you delete your account.

Before deleting your account, you can also:

• delete individual messages;
• leave an organization;
• sign out of your sessions and remove your devices.

Your rights

You can see and correct most of your information in the app, under Account. You can also ask us for a copy of your data, its correction or its deletion, or object to how we use it, by writing to contact@shabakett.com. We answer within 30 days.

We process personal data in accordance with Algerian Law No. 18-07 on the protection of natural persons in the processing of personal data. You can also file a complaint with Algeria’s national personal data protection authority (ANPDP).

Security

We protect your information with encrypted connections, encryption of stored messages and files, password hashing (Argon2id), and by storing sign-in tokens and verification codes only as hashes. No system is perfectly secure, but we work to protect yours and will tell you about any breach that affects you.

Children

Wassil is not intended for anyone under 16. We do not knowingly collect their data, and we delete it when we learn of it.

Transfers outside Algeria

Some of our service providers, such as Google, may process data outside Algeria. They do so only to provide their service to us.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change is significant, we will tell you in the app or by email before it takes effect.

Contact

Shabakett Core, Annaba, Algeria contact@shabakett.com