Most privacy policies are written so you won't finish them. This one is short on purpose, because there isn't much to disclose, the whole product is built so we don't hold the things a normal app would collect. Last updated 30 June 2026.
WingPost is built by AnA Devyra, an independent team based in India. This policy covers the WingPost Android app, the message relay and API at api.anadevyra.com, and this website at anadevyra.com.
No phone number. No email. No real name. No address-book upload. No advertising ID, and no device fingerprinting for tracking. Your identity is a cryptographic node ID generated on your own device, not tied to anything about you in the real world.
To move a message from one device to another, the relay processes:
It may observe coarse online/offline presence, which you can hide. System logs are ephemeral and are not retained to profile you. The server never sees your message content, media, call audio or video, your contact list, or any private key.
Your messages, contacts, media, and call history are stored locally and protected by your app lock and the platform keystore. They are not mirrored to us. If you lose the device without a backup, that data is gone, there is no copy on our side to restore from.
If you enable push notifications, Android's platform push service is used to wake the app, the readable content you then see is decrypted on your device, not carried through the push in the clear. Push is optional: you can run in a strict mode with no push token registered at all, trading instant alerts for the smallest possible footprint. When push is on, a push token is held by the platform provider under their own terms.
There is no third-party analytics SDK, no ad network, and no behavioral tracking in the app or on this site. We don't build a profile of you, because we don't collect the inputs that would let us.
The app is distributed as a direct APK, including via GitHub Releases. When you download from GitHub or load this site, which is hosted on GitHub Pages, GitHub acts as the host and may log standard request data such as your IP address under its privacy terms. That's GitHub's processing, not ours, and we receive no analytics back from it.
We can only provide what we actually hold. Message content is ciphertext we cannot decrypt, no real-world identity is bound to an account, and we don't keep retained access logs to correlate a person against. There is very little to hand over because there is very little kept.
Delete your account from inside the app, it's a true deletion, not a hidden flag. Use burner identities for throwaway conversations. Export an encrypted backup of your session to storage you control. Manage last-seen visibility, read receipts, and ghost mode in settings.
WingPost isn't directed at children under 13, and we don't knowingly collect identifying data from them, or, frankly, from anyone.
If this policy changes in a meaningful way, we'll update this page and the date at the top. Continuing to use the app after an update means you accept the revised policy.
Privacy questions: hello@anadevyra.com. Security reports: security@anadevyra.com, see our responsible-disclosure policy.