Kept only on your phone. None of it is sent to Unixeer, because there is no Unixeer server.
Channel codes are never stored. A working channel's code, and the key made from it, are held only in the app's memory while you are on that channel, and are never written to storage.
The microphone is used for one thing: carrying your voice to the other phones on your channel while you are holding the push-to-talk button. It is opened only while the floor is granted to you and closed the instant you let go — the app does not listen between transmissions. Nothing is recorded to a file and nothing is sent to Unixeer.
The app keeps a rolling two minutes of received audio in memory so you can replay what you missed. It lives only in memory, is overwritten continuously, and is gone the moment the app closes.
The camera is used only to scan a channel join code, and only while that scanner is on screen. No image is stored, kept or transmitted. If you refuse camera access, everything still works — you type the code instead.
On Android, the scanner is Google's ML Kit. When you use it, ML Kit sends Google diagnostic information about the scanner itself — the device's make, model and system version, the app's name and version, and performance figures such as how long a scan took — over an encrypted connection. Google states that it does not pass this to third parties. The camera picture and the code you scan are processed on the phone and are not sent. On iPhone and iPad the scanner is Apple's own and sends nothing. If you would rather nothing is sent, type the code instead of scanning it.
Voice, text messages and station names travel as UDP datagrams directly to the other phones on the same Wi-Fi network, and to nowhere else. Stations find each other with Bonjour/mDNS on that same local network. The app has no backend, opens no connection to the internet, and works with the internet unplugged — which is the point of it.
Traffic on the twelve working channels is encrypted end to end with XChaCha20-Poly1305, with the key derived from the channel code using Argon2id (the open-source libsodium library). Anyone who has the code can read that channel; nobody else can. The CALL channel is deliberately unencrypted: it is the meeting place. Because none of this is radio, the amateur rules against encryption on the air do not apply to it.
Ham Chatting never transmits on the amateur bands and cannot key a radio. No amateur licence is needed to use it, which is deliberate: unlicensed family, helpers and visitors are meant to be able to join a field-day team on equal terms.
The Extra page can open your email app with a diagnostic report pre-filled: the app version, your callsign, which network you are on, who the app can see, and what it has tried. A report about a station does the same with that station's details. Nothing is sent unless you press send in your own email app, and you can read and edit every word of it first.
We collect nothing from anyone, of any age — the only data that leaves a phone for anyone other than the people on your channel is the Android QR scanner's diagnostics to Google, described above. The app is designed for amateur radio operators and the people with them at a site.
Everything is on your device. Settings → Reset clears your details and preferences (blocked stations are kept on purpose; unblock them on the Net page); Settings → New station identity replaces your device identity. Deleting the app removes everything, including the keystore entries. There is nothing held elsewhere for us to delete on your behalf.
If this policy changes, the date at the top of this page changes with it and the new version is published here.
Questions about privacy? Email unixeer@gmail.com. We typically reply within a few days.