Who can read your chats
Your data stays in Brazil, on the Bipe server in São Paulo. And chats arrive there locked: only the devices of the people in the chat hold the key. This page shows who can read what, with no fine print. The Portuguese version is the reference text.
What end to end means
Your phone locks the message
Before a message leaves, the app locks the text, photo or voice message with a key. That key exists only on the devices of the people in the chat.
The server carries a closed box
The Bipe server stores the message and delivers it to each device. It has no key, so what it keeps is scrambled and nobody can read it.
Only the people in the chat open it
The receiver's phone unlocks the message and shows it on screen. In a one-to-one chat, that is your devices and the other person's. In a group, the devices of the people in the group.
A new device gets the key only if you approve it
A device you did not approve gets no keys. So not even the people who run the server can slip a hidden device into your account to read your chats.
Every new chat is locked. The Bipe server requires it, even if an app asks otherwise.
Who sees what
Each card is someone who might want to read. Each line says what that person or company can see.
You and the people in the chat
- Sees what you write, photos, voice messages and files
- Sees group names and photos
- Sees who is in each chat and when each message arrived
- Doesn't see your IP address and when you connect
The devices of the people in the chat hold the key and open everything. Someone who receives a message can copy it, take a screenshot or forward it, as in any app.
The Bipe team
- Sees group names and photos
- Sees who is in each chat and when each message arrived
- Sees your IP address and when you connect
- Doesn't see what you write, photos, voice messages and files
The team runs the server but has no key to the chats. It sees what the server needs to deliver messages. Connection logs stay for 6 months because Brazil's Marco Civil da Internet requires it.
Someone who breaks into the server
- Sees group names and photos
- Sees who is in each chat and when each message arrived
- Sees your IP address and when you connect
- Doesn't see what you write, photos, voice messages and files
Gets what is on the server: scrambled messages, without the key to open them.
Police or courts, with a court order
- Sees group names and photos
- Sees who is in each chat and when each message arrived
- Sees your IP address and when you connect
- Doesn't see what you write, photos, voice messages and files
Bipe can only hand over what it has. What you wrote stays locked, and Bipe has no key to open it.
Apple, which delivers iPhone notifications
- In part who is in each chat and when each message arrived
- Doesn't see what you write, photos, voice messages and files
- Doesn't see group names and photos
- Doesn't see your IP address and when you connect
Gets only a signal that a message arrived, with the chat's ID. The text does not pass through Apple: the app fetches the message from the Bipe server and opens it on the phone.
Someone who picks up your unlocked phone
- Sees what you write, photos, voice messages and files
- Sees group names and photos
- Sees who is in each chat and when each message arrived
- Doesn't see your IP address and when you connect
The lock protects the message on the way and on the server. On your phone it is already open for you to read. That is why a screen lock matters.
What end to end does not hide
- A group's name and photo are open on the server. If the group is called "Silva Family", the server knows that name.
- The server knows who is in each chat and when each message arrived. It needs that to deliver, and Bipe does not promise to hide who talks to whom.
- Someone who receives a message can copy it, take a screenshot or forward it. The lock does not change that.
- If you lose all your devices and your recovery key too, old messages are gone. Bipe keeps no copy of your key, so it cannot give them back.
Common questions
Does Bipe read my messages?
No. The server stores messages locked, and the Bipe team has no key.
What if a court asks for my chats?
Bipe can only hand over what it has: connection logs, who is in each chat and when, and group names and photos. Bipe cannot open what you wrote, so it cannot hand it over.
What if I get a new phone?
You get back into your account. To see old messages, approve the new phone on an old device or use your recovery key.
Does any data leave Brazil?
The server is in São Paulo. iPhone notifications pass through Apple, with only an ID and without the message text. The full list is on the LGPD page.
What kind of lock is it?
It is Matrix encryption, an open standard anyone can check. Bipe does not change its code.
Each piece of data, what it is for and how long it is kept is on the LGPD page. The plain-language text is in the privacy policy.