Privacy policy

Effective from 1 October 2026

What this policy covers

It describes what data the Mandarin IM service receives — the Android app, the web app at web.mandarin.im and classic ICQ clients connecting to it — why it needs that data, who it is shared with, and what you can do about it. By using the service you agree to this policy.

What we receive

• Your phone number — to sign you in with a code sent by SMS and, if you allow it, to let friends find you by your number.
• Your profile — nickname, name, bio, avatar and any other fields you fill in yourself. Other people see your profile and your Mandarin number.
• Conversations and files — messages, reactions, files, and the groups and channels you belong to. They are kept on the server so they can be delivered and shown on all your devices.
• Your phone book — only if you allow it in the app. Its numbers and names are used to find Mandarin users among them. A phone book belongs to a device and is deleted when that device's session ends.
• Devices and sessions — device name and type, app and version, sign-in and last activity times, IP address. This is for security: you see your sessions and can end any of them.
• A push notification token — so the app learns about new messages.
• A password for classic clients — if you turn on signing in over the ICQ protocol. It is used only for signing in from those clients; do not reuse it anywhere else.

Why we need it

• To deliver messages and files and keep them in step across your devices.
• To let you, and nobody else, into your account, and to protect the service from abuse.
• To help friends find you, within your privacy settings.
• To notify you about new messages.
• To find and fix problems in the service.

We do not sell data and do not use it for advertising.

Who we share it with

• Our SMS provider — your phone number and the confirmation code, to send the message.
• Google (Firebase Cloud Messaging) — your device token and a notice about a new message, to deliver it to Android.
• Other people — your profile and whatever you send them.
• Authorities — only when the law requires it.

How we store and protect it

• The app and the web app talk to the server over an encrypted connection (TLS).
• There is no end-to-end encryption: messages and files are stored on our servers in a form the service can read.
• Classic clients connect over the OSCAR protocol without encryption, as the old ICQ did. For anything important, use the app or the web app.
• The database is backed up daily; backups are kept for a few days and then deleted.

How long we keep it

Data is kept for as long as the account exists. Messages deleted for everyone are erased from the server at once, and from backups as those are replaced. A phone book is deleted with the session of the device that uploaded it. When an account is deleted, its data is erased within 30 days.

What you can do

• Change or remove your profile details.
• Choose who can message you, invite you to groups, see your status and find you by phone number.
• Delete your messages, for yourself or for everyone in the conversation.
• End sessions on other devices, and keep your phone book from the app.
• Get a copy of your data or delete your account: write to igor@citron.dev, and we will ask you to confirm the account is yours.

Children

The service is not meant for children under 13.

Changes

We may update this policy. The version in force is always published on this page with the date it takes effect.

Contact

Questions about your data or this policy: igor@citron.dev.