Privacy Policy

WolfChat is a messaging app for talking to a customer service team. You use it to reach the staff of a company you do business with. This page explains what data we collect, what we use it for, who else can see it, and what you can ask us to do.

We have kept it as short and as honest as we can. One thing you should know up front: conversations in WolfChat are not end-to-end encrypted. Authorised staff can read them. Section 8 explains this in full.

1. Who we are and how to reach us

WolfChat is published by PT Prima Sentra Digital Solusi, a limited liability company domiciled in Jakarta Utara. "Wolfgang 77" is the name of our infrastructure, not the publishing legal entity. The controller of your personal data is that legal entity:

We aim to answer requests about personal data within 14 working days. If your request is complex and takes longer, we will tell you why.

The service operates in Indonesia and is governed by Indonesian law, including Law No. 27 of 2022 on Personal Data Protection (UU PDP).

2. What data we collect

2.1 The content of your conversations

Everything you send in a chat: message text, replies, edits, reactions, photos, videos, documents and voice notes. This includes attachment file names, the sender's display name, and the time each message was sent.

2.2 Your account details

Your username on our system, your display name, your profile picture, and your password in scrambled form (we do not store your actual password and cannot read it).

You sign up yourself from the app. Registration is gated by a third-party anti-bot challenge, and passwords must be 8–20 characters, must contain letters and numbers, must not contain the symbols &, < or >, and must not contain your username or email address. Before registration can proceed you must tick a statement that you are 18 or older; that tick collects no personal data at all — see section 12. On the registration path we run today, we ask for your email address. We do not ask for a phone number. We send a confirmation link to that address so registration can finish, and we may send a password-reset link to the same address. We do not use it to broadcast chat messages to that address.

You may also add or change an email address in Settings. If you add one there, we store that address and send a confirmation link to prove you control it. We may send a password-reset link to that address when recovery is requested. We do not use it to broadcast chat messages to that address.

2.3 Activity signals inside chats

Whether and when a message was read, the "typing" indicator, whether you are online, and the record of who joined or left a group. This also includes the delivered-to-device mark: when your app receives a message, it tells the sender that the message has reached your device — before you read it. This mark follows the same switch as read receipts: if you turn off "Send read receipts" under Settings › Security, your app sends neither the delivered mark nor the read mark.

2.4 Device and connection data

The name and identifier of the device you use, the app and operating system type, your IP address each time the app connects, and your last access time. Your IP address is also recorded in our web server logs.

2.5 Link previews

When you paste a link into a chat, our server opens that link to fetch its title, short description and preview image. It is our server that visits the site, not your device — so the site does not see your IP address, but it does learn that its link was shared.

2.6 Location

Location sharing is not available in WolfChat, and we do not collect your location data. Location permission is not in the Android app's permission list, so the app cannot ask the system where you are. The browser version never asks for your location either.

2.7 A copy on your own device

The app keeps a copy of your chat history and downloaded media on your device or in your browser, so it opens quickly and stays readable on a poor connection.

2.8 What we do NOT collect

3. What we use it for

4. Our legal basis for processing

Under UU PDP, we rely on the following:

• Performance of a contract. To deliver messages, maintain your account and send notifications. Without this the app cannot work at all.
• Legitimate interest. For system security, abuse prevention, fault handling, and customer service quality assessment. We have weighed these interests against your privacy and kept the data involved to a minimum.
• Legal obligation. Where there is a lawful official order under Indonesian law.
• Consent. For things that are genuinely your choice, such as turning on notifications. You can withdraw consent at any time, and withdrawing it does not undo processing that already happened.

5. Who else receives your data

We do not sell your data. We run our own servers, and the app is not connected to any other messaging network — your messages never leave for another company's server.

Only three outside parties are contacted directly from your device, and all three only in the Android app. If you use WolfChat in a browser, none of them are touched. (Separately from these three: a website whose link you paste into a chat is visited by our server, not by your device — see section 2.5.)

5.1 Google (Firebase Cloud Messaging) — notifications on Android

For your phone to alert you when a new message arrives, we have to go through Google's notification service. On Android there is no alternative that does not drain your battery.

What Google receives each time you get a notification:

• Your device token — a unique code Google itself issues for your phone, which lets Google know your device and IP address.
• The message identifier and the conversation room identifier.
• Your unread message count.
• The app identity, and the time each notification is sent.

What is not designed to be included:

Notifications that pass through Google are designed to carry only a pointer to a message, not the message text. The sender name and message body you see on screen do not come from that notification: once your phone receives the pointer, the app fetches the message itself from our server over an encrypted connection, and then assembles the notification inside your phone.

We say "designed" rather than "guaranteed" deliberately. This setting lives on the app side. We checked this path directly on our own server on 14 August 2026: every active notification registration uses the pointer-only format, without exception. What we cannot guarantee is an old or modified version of the app, because that format is chosen by the app when it registers — not by our server.

Google processes this data under its own Firebase Cloud Messaging policies, including how long it keeps it. That is outside our control. Turning WolfChat notifications off in your phone settings does not stop this path — it only hides them from your screen. Section 11 explains how to actually stop it.

5.2 OpenStreetMap — maps in location messages

5.3 Cloudflare — when signing in from the Android app

Each time you sign in from the Android app, the app asks our main domain wolfchat.id where our server is. That domain sits behind Cloudflare. Cloudflare sees your IP address, the time of the request, and the fact that the device is running WolfChat.

No message content, password or account data passes through here — only the question "where is the server". How long Cloudflare keeps that record is outside our control. The browser version does not go through Cloudflare.

5.4 Inside our own organisation

Authorised customer service staff read service conversations. Today that access is not restricted per staff member or per role: any authorised staff member can read all service conversations, not only the ones they handle themselves. Per-role restriction is not yet in effect; this page will be updated if it is. Service quality reviewers also read service conversations in order to assess staff replies. System administrators have technical access to the servers. This is part of how the service works, and section 8 explains it further.

6. How long we keep it

Some periods are already fixed and already running on our servers today. The rest we have not set yet, and we state that as it is rather than giving you a number we might not honour.

6.1 What is already fixed

A few things so the numbers above are not misleading:

• Deletion runs once a day, so there can be a gap of up to about 24 hours after a retention period expires.
• For photos and videos, the 180 days counts from the last time the file was opened, not from when it was uploaded. A frequently opened photo will last longer.
• The most recent message in a conversation is not deleted, so the conversation does not become completely empty.
• Technical records of a conversation — group names, topics, and the record of who joined or left — are not deleted after 180 days. That is structural information rather than message content, but you should know about it.
• We deliberately keep backups for a shorter period than messages, so that a deletion promise is not undone by an older backup. Even so, a message already removed from the live system can still exist inside a backup for up to about 5 months.

6.2 What we have not set yet

7. Your rights and how to use them

Under UU PDP, you have the right to:

• Be informed and get access. Request a copy of the personal data we hold about you and an explanation of how we use it.
• Correct it. Ask us to fix data that is wrong or out of date. You can change your display name and profile picture yourself in the app.
• Delete it. Ask us to erase your personal data, or delete your own account. Section 9 explains how.
• Withdraw consent. For anything you previously agreed to, such as notifications. Withdrawal does not undo what already happened.
• Object. Object to particular processing, including decisions made purely automatically.
• Postpone or restrict. Ask us to pause processing of your data while we look into an objection you have raised.
• Take your data with you. Ask for your data in a machine-readable form, so far as this is technically possible.
• Claim compensation for a breach of your personal data protection, and complain to the competent authority in Indonesia.

One thing we must say honestly: if you ask us to delete your messages, those messages are also on the screen of the person you were talking to and inside our backups. We remove them from our systems, but we cannot pull back copies already delivered to someone else's device.

8. Your conversations are not end-to-end encrypted

In the clearest terms we can manage, this means:

• Your messages are stored on our servers in a form that can be read. The server is not blind to their contents.
• Authorised service staff can read your conversations with the service team. That is how customer service works: the person answering you has to read what you write, and a colleague can pick it up if the case is handed over.
• Service quality reviewers also read service conversations to judge whether staff answered politely, clearly and correctly. When they read a staff reply, they also read your messages in the same conversation.
• System administrators have technical access to the servers, as on any self-hosted service.

What we still do to protect it:

• All connections between the app and our servers use TLS, so nobody can eavesdrop in transit.
• Staff access is protected by credentials separate from user accounts, and actions on accounts are logged. Restriction by role is not yet in effect — see section 5.
• Your messages never leave for another company's server.

9. How to delete your account

There are two routes, and both are valid.

9.1 In the app

1. Open Settings.
2. Choose Security.
3. Choose Delete account.
4. Confirm, then retype your full WolfChat ID — it looks like @username:wolfchat.id. The dialog does not show that ID up front, so have it ready; if you mistype it, the dialog tells you the correct form. This is deliberately a little awkward so that it cannot be triggered by accident.
5. Enter your password if asked.

The same steps work in the Android app and in the browser version.

9.2 By email

If you cannot sign in, email abuse@wolfchat.id with the subject "Delete Account" and your WolfChat username. We will verify that the account is yours before deleting it.

9.3 What happens after deletion

• The account is permanently deactivated and you can no longer sign in.
• Your display name and profile picture are removed.
• The email address you gave at sign-up or bound in Settings is removed.
• All of your device sessions are disconnected.
• Messages you already sent follow the normal retention periods in section 6 — they do not vanish instantly, and can still exist inside backups for up to about 5 months.
• Messages already received by other people remain on their devices.
• We may keep the minimum records required by law or needed to finish an ongoing abuse investigation.

10. Other technical safeguards

• In transit. All traffic between the app and our servers uses TLS. The Android app refuses unencrypted connections.
• On the server. The servers are self-hosted and are not connected to any other messaging network. Self-registration is open, gated by an anti-bot challenge and a password of 8–20 characters, must contain letters and numbers, must not contain the symbols &, < or >, and must not contain your username or email address. Message content is filtered automatically, and the creation of public rooms is restricted.
• On your phone (Android). The copy of your chat history on the device is stored in an encrypted database, with the key held in the Android system keystore. The app also blocks automatic backups to Google Drive.
• In your browser. Here is the difference, and we will not hide it: in the browser version, the local copy of your chat history is not additionally encrypted. Anyone who can use your browser profile on a shared computer can read the chat history stored there. If you use a shared computer, sign out when you are done.

No system is completely secure. If a personal data breach occurs, we will notify you and the competent authority as required by UU PDP.

11. Device permissions the app asks for

The WolfChat Android app declares a number of device permissions. Five of them matter to you. The first three are only requested when you use the feature that needs them. Biometrics is never put to you as a permission request at all — what you see is the fingerprint or face prompt when you unlock the app. The fifth — notifications — is asked by Android itself a few seconds after you sign in, on phones that use Google services. You may always refuse. Refusing one permission does not disable the app, only the feature concerned.

• Camera. To take a photo or record a video straight from a chat, and to set a profile or group picture. Requested the first time you choose "Take a photo" or "Record a video". If you refuse, you can still send photos and videos already on your device. The camera never switches itself on.
• Microphone. To record voice notes. Requested the first time you record one. Recording begins only after you press and hold the voice note button, and stops when you send or cancel it — outside that the microphone is not active. The result is sent only after you press send; if you cancel, the recording is discarded. If you refuse this permission, everything else keeps working and you only lose voice notes.
• Storage and files. To attach photos, videos or documents from your device, and to save files you download from a chat. On newer Android versions, choosing a file goes through the system's own picker, so the app only receives the files you pick yourself — not the whole contents of your storage. If you refuse, you can still send and receive messages, but cannot attach files from your device or save files you receive.
• Biometrics — fingerprint or face. Used only to unlock the app, and only if you switch on the app lock yourself under Settings › Security. Your fingerprint and face data are checked by the Android system; they are never sent to our servers and never seen by us. If you refuse or do not use it, the app lock can still be opened with a PIN you set yourself.
• Notifications. To show an alert when a new message arrives. On Android 13 and later the system asks for this a few seconds after you sign in, on phones that use Google services — rather than waiting until you open a particular feature, and it is the only permission on this page that appears on its own. If you refuse, the app keeps working fully and you simply see no alerts on screen. One thing we will not soften: turning notifications on also switches on the Google path described in section 5.1, and neither refusing this permission nor turning notifications off in your phone settings stops that path — both only stop them being shown on your screen, because the notification has already passed through Google before it reaches your phone. There are two places inside WolfChat that bear on this path, and only one of them survives a restart of the app. Open Settings › Notifications: that page carries a Mute all notifications switch, which by its own description overrides all other rules and disables all notifications — turn that switch on. It is stored with your account on our server, so it still applies after you close the app. On the same page, under the Devices heading, are the registrations our server uses to push notifications through Google — one for each Android phone you are signed in on. You can tap one and choose Delete, and that registration stops being a destination; any registrations for your other devices remain. But the app registers it again by itself the next time the app starts, so deleting it on its own only lasts as long as the app is not started again.

You can revoke any of these at any time under Android Settings › Apps › WolfChat › Permissions. The app will ask again when you next use that feature, and will not press you. One exception: the notification permission is not tied to a feature — it is requested again when the chat list loads, and Android may stop showing the dialog at all once you have refused it.

12. Children

WolfChat is only for users aged 18 and over. The service is not intended for children and we do not knowingly collect children's data.

That age limit is enforced by the registrant's own declaration: before registration can proceed, the registrant must tick a statement that they are 18 or older. We do not verify age beyond that — we ask for no date of birth, we check no documents, and we collect and store no personal data at all for this purpose. If we find out, or are told, that an account is being used by someone under 18, we will deactivate that account and delete its personal data, except what we are legally required to keep.

If you are a parent or guardian and believe your child is using WolfChat, contact abuse@wolfchat.id.

13. If this policy changes

We will update this page whenever the way we process data changes.

• The document status and version number at the top of the page are always kept current.
• For significant changes — a new category of data, a new recipient, or a new purpose — we notify you inside the app before the change takes effect.
• If a change requires your consent under UU PDP, we will ask for it first rather than assume it has been given.

The Indonesian version is the master text. If the two versions are read differently, the Indonesian version prevails.