Privacy Policy

Who this covers

This policy describes the Ananse Keyboard website and the Android Ananse Stroke Book keyboard and writer (also identified as Ananse Stroke Keyboard), including its private messenger, operated by The Ananse Stroke Foundation. It covers browser writing, shared links, private messaging, website license features, and the Android app. It does not cover iPhone or other native apps.

Writing and data on your device

The web keyboard saves your draft text, manual marks, layout, style, ink color, and character-design preferences in this browser's local storage. Images you select for custom family heads are read in the browser and can be stored locally as data URLs; they are not uploaded by that feature. You can remove these by clearing this site's browser data. Saving an image or copying text may put it in your downloads, device share destination, or clipboard.

The private area stores device identity keys and consent in browser IndexedDB, separately from keyboard preferences. Losing or clearing that browser data can permanently remove access to your private identity and conversations; there is no key recovery.

Android keyboard and writer

The Android system keyboard enters text into the app you choose. It can read up to 128 characters before the cursor from the active input field to decide local punctuation behavior (such as quotation marks); the receiving app controls its own text and storage. The keyboard's input code has no network calls and does not send what you type to Ananse servers for prediction. It cannot read or encrypt an entire conversation in another app.

The Android Ananse Writer keeps its draft text, manual value marks, keyboard layout, writing style, glyph designs, and other display preferences in app-private SharedPreferences so they can be restored. Its word predictions use an on-device fixed word list and the text near the writer's cursor, not a prediction service. Writer drafts and settings are separate from the Keystore-encrypted private messenger store. Clearing app data removes them; erasing only the private identity does not clear writer drafts or keyboard settings. The Android app disables Android OS backup in its manifest.

When you choose Save or share image in Android, the app renders the draft locally to a PNG in its app cache and grants the recipient app temporary read access through Android's FileProvider. The selected recipient or save destination controls copies after sharing; the cached image may remain until overwritten, removed by the app or OS, or app data is cleared. Copying text also places it on the Android system clipboard.

Android camera and invitations

The Android app requests camera permission only if you open Scan invitation QR. Scanning processes QR camera frames on the device to parse an invite; the app does not upload camera images. You can instead paste an invite without camera permission. Invitation URLs or QR codes carry invitation details and should be shared only with intended recipients. The Android app has Internet permission for private messenger requests; the system keyboard and writer work locally.

Links and sharing

A note link contains the note text and marks encoded in its URL query string. A shared setup link contains design choices and ink color in its URL. Anyone who receives a link can see its contents; URLs may be retained in browser history, copied messages, server or intermediary logs, and the services through which you share them. Do not put sensitive information in shared note links.

Private communication

Private communication uses a pseudonymous user ID, public identity keys, an optional handle, devices and sessions, contacts, invitations, and group membership or key-distribution metadata on the server. Live message contents are end-to-end encrypted in compatible Ananse conversations; the server relays encrypted messages to online recipients rather than maintaining an offline message inbox. Message contents may remain visible in an open browser until that conversation ends or the page closes. A system keyboard in another company's app does not encrypt that app's messages.

You can erase your private identity from the private area; the server deletes that identity and associated contacts and devices, and the browser then clears its private local data. If server deletion fails, the browser warns you instead of claiming it succeeded. Other people's devices, messages they copied, shared links, or infrastructure logs are not erased by this action.

On Android, the messenger saves identity material, contacts and conversation keys in app-private files encrypted with an Android Keystore key. Consent is recorded separately as a boolean in app-private SharedPreferences. Ordinary live messages are in memory during the conversation, rather than stored as message history. If you deliberately save a private conversation copy, that copy is stored encrypted in the app's no-backup files until you delete the copy or clear app data.

Android's Messenger screen offers Erase Local Identity: when an identity exists, it first requests authenticated deletion of the server account, then removes local identity, contacts, keys and the Keystore wrapping key. If server deletion fails it keeps local credentials so you can retry. Erasing the private identity does not clear writer drafts, keyboard preferences, independently saved conversation copies, images already shared with others, or hosting logs.

Optional retained conversations

Live-only messaging remains the default. You can choose to turn on saved conversations after reading and accepting the separate kept-message consent. Both participants must enable this mode before sending retained messages. Encrypted messages are stored on the server so you can reopen a conversation and read its history, and so a recipient can receive messages after reconnecting. The server stores encrypted message envelopes, message identifiers, sender and conversation identifiers, key-generation identifiers, timestamps, and each participant's saved, mute, read and deletion preferences. The server does not receive the keys needed to read message content. Previously expired live-only messages cannot be recovered by turning this feature on.

For this optional mode, the browser stores non-extractable invitation-key generations and ciphertext-only pending sends in its separate secure IndexedDB database. Android wraps retained key generations and its pending-send outbox with Android Keystore encryption. Pending sends retain the same identifier and ciphertext for retries. No recovery is available if device keys are lost. Android and web do not provide closed-app notifications in this update.

Save & leave keeps the conversation in your saved list so you can reopen it with previous retained messages. Contacts use the other person's shared Ananse profile name or handle when available. You can give a conversation a personal name; that name is stored encrypted on the naming device, is not sent as plaintext message metadata, and does not rename the other person's profile or chat. We do not request your device address book.

Delete for me removes your access to the conversation's existing retained history and removes it from your saved list. After the server confirms deletion, the app clears that chat's pending sends and personal name on the device. If the request fails or you are offline, the app reports the failure rather than claiming deletion succeeded. Pending sends prepared before your deletion cannot restore that deleted history. Other app-managed copies can only reflect the deletion after reconnecting.

Your deletion does not remove the contact relationship, your other chats, your account, or the other participant's retained copy. Each person chooses independently whether to keep their history. When neither participant retains a message, its encrypted content and associated pending delivery jobs are physically removed from the active server database. Future messages can still arrive, but do not restore your deleted history. Separately removing a contact relationship deletes its server-side retained messages and preferences for both people; erasing an identity deletes its associated retained messaging records.

Deletion cannot recall screenshots, exports, independently saved copies, or copies held outside Ananse. Removing content from the active database does not promise immediate erasure from hosting backups or infrastructure logs. We do not currently specify a verified backup deletion interval; contact the foundation about backup retention before using saved conversations for information that requires a guaranteed deletion deadline. The live-only descriptions elsewhere in this policy apply to live-only mode, not this optional retained mode. Features available in the Android app depend on the installed version.

Encrypted photos in compatible chats

Updated clients can exchange one selected still photo at a time in individual and group conversations. Photo selection grants access to the selected item, not your whole gallery. Photos are prepared on the sending device: orientation is normalized, location and other original metadata are removed, and the image is compressed to JPEG with a maximum 2048-pixel edge. Source limits are 20 MiB and 40 megapixels; unsupported or animated formats are rejected. We do not automatically save received photos to your gallery.

The sending device encrypts photo bytes before they reach private file storage. Fresh file keys, nonces and image dimensions travel inside an end-to-end encrypted message, not public links or plaintext upload metadata. The server holds ciphertext and the object, sender, conversation, generation, size, expiry, integrity and entitlement references needed to deliver and clean it up. The server does not possess photo decryption keys or plaintext thumbnails. All participants must open a compatible updated messenger before photo sending is enabled.

Live-only photos require a separate acknowledgement before first use because encrypted files are temporarily staged on the server. Reservations and live-only photo access expire after one hour; an ended direct session or changed group membership generation can revoke access sooner. This staging is not an offline photo inbox. Retained photo messages are available only while the requesting person remains eligible for the corresponding history copy. Group newcomers cannot retrieve pre-join photos, and a departed or removed member loses app-managed access.

Deleting your own history revokes your photo access, not another person's eligible retained photo copy. Once no eligible retained or unexpired live copy remains, cleanup marks the attachment deleted and retries file deletion. Cleanup runs while the API service is running; unprocessed work persists across restarts. Minimal tombstone metadata remains for eight days from reservation, or longer when cleanup cannot run, to handle late uploads. Uploads are limited to 10 MiB of ciphertext, 30 reservations per sender per hour and 100 MiB of outstanding files per sender. Cancelled uploads continue counting until their write capability is closed and their file is removed. These are active-service cleanup rules, not a guaranteed backup-purge deadline.

Screenshots, downloads, exports and copies outside Ananse cannot be recalled. Plaintext previews and viewed photos are held temporarily in device/browser memory and cleared when the conversation closes or the app backgrounds; local encrypted retry/history storage follows your existing retained-mode choices. Features depend on the installed app version. No closed-app photo notifications are introduced.

Licenses and accounts

Website license features, where available, may process a supporter account email, password-derived authentication data, sessions, license acceptance and activation records, and download records. The font storefront is currently hidden from the public website, but server-side account and license code exists. Do not assume that deleting a private messaging identity also deletes a separate supporter account.

Analytics, infrastructure, and other services

Website code includes optional Umami event analytics for categories such as layout changes, image saves, invitations, and message-send outcomes; it is a no-op unless analytics is configured by the publisher. These events are designed not to include typed text or message contents. Hosting or an enabled analytics provider may process visit and network information. The API records ordinary request paths, status and timing, but suppresses automatic request logs for private routes; other infrastructure or error logs may still exist. The license location check logs a network address and country lookup result. The website loads Inter fonts from Google Fonts, which may receive your network address and browser request data.

The browser keyboard does not request camera access. Image selection may offer the device's camera through its own file picker. The website does not request your address book or location permission; a server-side license eligibility check can infer country from your network address.

Retention, choices, and contact

Browser-stored writing and preferences remain until you clear them or the browser removes site data. Android writer drafts and preferences remain until cleared or app data is removed; optional saved private copies can be deleted in the messenger, while shared image cache and recipients' copies require separate handling. Server-side identities, contacts, group metadata, invitations, sessions, and license records have different lifecycles; some invitations and sessions expire, but expiration does not by itself guarantee immediate physical deletion. No verified universal retention period or full deletion schedule is available for infrastructure logs, analytics, or license records. Contact the foundation to ask about access, deletion, or other privacy questions.