Privacy Policy & Warrant Canary
Last Updated: August 2026 • Published by PANAS NETWORK
1. Information We Never Collect
- No Phone Numbers or Real Names: You never register with a phone number, SMS confirmation, or email address.
- No Contact Books or Address Graphs: The app never scans, uploads, or references your device contacts.
- No Plaintext Messages or Files: All text, photos, voice notes, and attachments are encrypted with AES-256-GCM prior to transmission.
- No IP Connection Logs: Relay nodes do not record persistent access logs or bind IP addresses to identity hashes.
- No Telemetry or Tracking Pixels: Zero third-party SDKs, Google Analytics, Firebase trackers, or advertising IDs.
2. Mathematical Interception Impossibility
Symmetric channel keys are derived exclusively on client devices via PBKDF2-SHA512 (100,000 iterations) with salted entropy or ephemeral ECDH P-256 key exchanges. The cloud relay acts strictly as a blind packet forwarder.
Because PANAS NETWORK possesses no decryption keys, it is technically and mathematically impossible for PANAS NETWORK or any third party to decrypt intercepted packets.
3. Data Retention & Auto-Purging
Relay storage is ephemeral. Encrypted envelopes in Cloudflare Workers KV operate on automatic expiration timers and are overwritten or purged on schedule. Local device databases (Room on Android, IndexedDB on Web) are strictly under user control and can be wiped with one tap.
4. Government & Law Enforcement Subpoenas
If presented with a lawful court order, subpoena, or government demand:
- We cannot provide user message history, because we do not store plaintext or retain history logs.
- We cannot decrypt messages, because keys never leave the end-user's device hardware.
- We cannot identify user identities, because identities are randomized client-generated hashes.
5. Warrant Canary Statement
As of August 2026, PANAS NETWORK has received:
- Zero (0) National Security Letters (NSLs).
- Zero (0) Foreign Intelligence Surveillance Court (FISA) orders.
- Zero (0) Gag orders prohibiting disclosure of government requests.
- Zero (0) Backdoor insertion requests or key-escrow compromises.
If this canary is ever removed or modified, users should assume that server relay infrastructure has been subject to legal coercion. However, because end-to-end encryption is client-enforced, your communications remain mathematically protected.