Privacy policy

The short version: we collect only what the chat needs, we never sell it, we show no ads and we use no tracking. Your messages are encrypted and, by default, disappear after 7 days.

Who we are

Guff Gaff is provided by Sirnex Tech (Perth, Western Australia). We aim to handle personal information in line with the Australian Privacy Principles. Contact us any time at privacy@sirnex.com.au.

What we collect

• Your sign-in: your email address. If you use Google, Google also shares your name, which we use as your starting display name.
• Your profile: the name you choose, your profile photo (if you add one), your birthday as a day and month only (if you add it, never the year) and your settings, such as text size, online status and read receipts.
• Your passcode: stored only in a scrambled form (a one-way hash). Nobody, including us, can read it.
• What you share: your messages, photos, videos, voice messages, memes, GIFs and reactions, plus which groups you’re in, who invited you, and how far you’ve read in each chat (for unread counts and read receipts).
• Notifications: if you turn on alerts, your browser gives us a notification address for this phone.
• Technical basics: like any website, our hosting providers keep short-lived technical logs (such as IP addresses) to run the service and stop abuse.

What we don’t collect

• Your phone number. Friends never see it.
• Your contacts. If you use “pick from contacts” to invite someone, the contact stays on your phone and is never sent to us.
• Your location.
• Anything for advertising: we use no ads, analytics or tracking tools, and we never sell your information.
• Your online history. The green “online” dot is live only and is never saved.

How your messages are protected

• Everything travels over an encrypted connection (HTTPS).
• Message text is encrypted before it is stored, with a key held only by the app’s server. Photos, videos and voice messages are kept in private storage and shown through links that expire after a few hours.
• Only members of a group can see that group’s messages. Reading them also needs the app to be unlocked with your passcode.
• To be clear: Guff Gaff is not end-to-end encrypted. Our server decrypts messages to deliver them, to send notifications and when Guffu is asked to reply.

Who else handles your information

We use a few trusted services to run Guff Gaff. Each one only gets what it needs:

• Supabase: our database, sign-in and file storage.
• Vercel: runs the app (from Sydney).
• Anthropic (Claude): powers Guffu. When someone in a group calls Guffu, the group’s recent messages (about the last 30) are sent so Guffu can reply. For birthday and festival greetings, only the person’s display name or the festival is sent. Under its commercial terms, Anthropic does not use this to train its models.
• Google: only if you choose “Continue with Google” to sign in.
• GIPHY: GIF searches pass through our server to GIPHY. GIF pictures then load from GIPHY, which sees your device’s internet address, as with any website image.
• Apple, Google or Mozilla push services: deliver notifications to your phone. Notification contents are encrypted so only your phone can read them. Group admins can choose to hide message previews in notifications.

Some of these services store or process information outside Australia, for example in the United States.

How long we keep it

• Messages and their photos, videos and voice messages are deleted automatically after the time the group admin chooses (7 days to start with). Files are removed from storage within a day after that. If an admin chooses “Never”, messages stay until someone deletes them.
• You can delete your own messages at any time. Group admins can also remove messages from their group.
• When you delete your account, we delete your login, profile, messages, photos, videos, voice messages and profile photo. Our providers’ backups may keep copies for a short time before they expire.

Your choices

• Change your name, photo, birthday, text size, online status and read receipts on the Me page.
• Turn notifications on or off at any time.
• Leave any group, or delete your account on the Me page (Delete my account).
• Ask us for a copy of your information, or to correct or delete it, at privacy@sirnex.com.au.

Cookies and storage on your phone

We use only the cookies the app needs to work: one to keep you signed in, one to remember that you unlocked with your passcode, and short-lived ones to finish joining a group or accepting a friend invite. Your browser also remembers two small settings (when you dismissed a tip or the install reminder). There are no advertising or tracking cookies.

Age

Guff Gaff is for people aged 18 and over. See our Terms.

Changes and complaints

If we change this policy, we’ll update the date below and mention big changes in the app. If you have a concern, please contact us first at privacy@sirnex.com.au. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Sirnex Tech · Perth, Western Australia · privacy@sirnex.com.au
Last updated 16 October 2026