KOYAA private space.
Protection, explained.
Trust begins with clarity. Here is how your words and files are protected, where history lives, and what technical information makes a connection possible.
01 · Your words and files
Messages, photos, videos and documents are encrypted before transfer. The server delivers encrypted data without receiving the keys to read its contents. Protection uses AES-256-GCM, X25519 key exchange, HKDF-SHA256, Ed25519 digital signatures and a separate Double Ratchet session for each pair of participants. These are the mechanisms implemented in the app; an independent audit or certification of KOYA is not currently claimed.
02 · A name, without a questionnaire
KOYA does not ask for your phone number, email or identity documents. You use a chosen name and device keys; a pseudonym is welcome. A connection still needs technical information: the server can see IP connections, public identifiers, display names, room, timing and routing. These details do not reveal encrypted message content, but may show who connected and when. KOYA protects conversation content and lets you register without contact details; it does not conceal your IP address.
03 · Who gets access
An invitation is a room access secret, not a public business card. Share it with trusted people through a protected channel. A display name is not proof of identity: confirm who you are talking to through another means. The administrator controls infrastructure and admission policy. The demo-room invitation on this website is public and intended for testing: anyone can join. Do not use the demo room for private or work conversations.
04 · On-device storage
History is stored with SQLCipher. A PIN protects app access; device biometrics are supported. Use a strong PIN and a screen lock. A compromised device, a phone unlocked by someone else, screenshots and exported files sit outside the protection of the encrypted channel.
05 · Temporary server storage
For offline delivery, the server holds encrypted packets in a separate queue that survives server restarts. A packet is removed after recipient acknowledgement or after 24 hours. Limits are 512 packets per recipient and 64 MiB of encrypted frames in total. When the server cannot accept a packet, the client keeps the message locally and retries. HEAVY attachments use separate encrypted storage with sender-selected availability of one day, one week or no expiry within server policy. Incomplete uploads expire after one day; cancelled uploads are removed. Total file reservations are capped at 512 MiB. Server expiry does not remove cached or exported participant copies. Decryption keys are never sent to the server. Routing metadata and infrastructure logs are a separate category of data.
06 · Delivery and deletion
After an initial key exchange, updated clients can receive queued messages without the sender being online at the same time. Once the queue retention period expires, retry requires the sender’s phone and its saved message. Queue capacity, Android restrictions and network outages can delay delivery; the app shows the reason beside the message. Local clearing does not remove copies saved by other participants.
07 · This website
The landing page uses no advertising trackers, analytics, external fonts or personal-data collection forms. Technical web-server logs may include IP address, request time and path. Language switching opens a separate page and needs no cookie. Downloading the APK requires no registration.
08 · Self-hosted delivery
On-Premise places the server and apps on buyer-controlled infrastructure. You manage access; remote support is agreed separately. The website public demo is a separate test environment. Conversations, purchase enquiries and support enquiries are separate processing contexts. Legal duties follow actual activities.
Privacy and Russian law
Learn what data the website and demo use, how to contact us about privacy and which Russian laws apply to using KOYA. Legal references updated on 7 October 2026.
Website and public-demo operator
Dmitry Nikolaevich Boyko, Russian professional income tax payer (self-employed), INN 190158352451. Email for legal notices and personal-data enquiries: dmitry.boyko@gmail.com. These details apply to this website and public demo. The controller of a buyer installation is determined separately by actual processing activities.
Purposes and data categories
| Process | Information | Purpose |
|---|---|---|
| Website visits | IP connection, time and requested page; request metadata is available to infrastructure. | Serve pages and files, maintain availability and prevent abuse. |
| Public demo | Chosen display name, public keys and identifiers, room and connection/routing metadata; encrypted packets and files. | Demonstrate messaging, deliver messages and files, manage access and establish calls. Content keys stay with participants. |
| Purchase and support | Name, email/phone, project details and enquiry text you supply. | Respond, prepare and perform a contract under the applicable legal basis. Avoid unnecessary personal data. |
Encrypted-queue and attachment retention is described above. It differs from enquiries, access records, technical logs and transaction documents. The operator must set separate periods according to purpose and lawful grounds. Article 21 governs destruction, restriction and incident response; this page does not certify that all historical data has already been deleted.
Legal basis for delivery
Russian law provides for software usage rights under a licence agreement. KOYA is delivered as server and client software on buyer-controlled infrastructure. The agreement defines the software, permitted uses, payment and delivery terms; this page is not that agreement.
Responsibility for data
The website, public demo, purchase enquiries and buyer installations are separate processing contexts. Controller status follows the actual purposes and operations. The buyer controls access to a self-hosted installation; remote support is agreed separately. Encryption and pseudonyms do not by themselves remove personal-data obligations.
Enquiries and consent
Email and phone enquiries may contain your contact details and project requirements. A contract enquiry initiated by the data subject has a statutory processing basis; this does not automatically cover advertising or other purposes. Where consent is required, it must be specific and separate from other confirmed documents. Visiting this website or downloading an APK is not treated as blanket consent.
Your rights
For this website or the public demo, contact dmitry.boyko@gmail.com to request processing information, correction, restriction or deletion on applicable statutory grounds, or to withdraw consent. Statutory response deadlines apply; lawful retention grounds may survive withdrawal. Do not attach identity documents or private keys to an initial enquiry. For an organisation deployment, contact its controller. Regulatory and judicial remedies remain available.
152-FZ, Article 14 ↗ · Article 20 ↗ · Article 21 ↗ · Article 17 ↗
Hosting and external services
Gmail is an external email provider and also processes messages sent to it. Do not send private conversations, sensitive data or keys. A foreign service does not establish compliance with Russian localisation or cross-border rules. The controller must identify storage locations, recipients, legal grounds, retention and required notifications for each process.
Security and controller duties
Encryption and access controls are technical safeguards, not proof that every legal duty has been met. Controllers must define policy, retention, access, request handling, destruction and incident response, and assess notification duties and exceptions. This page does not certify registrations or notifications for KOYA.
152-FZ, Article 18.1 ↗ · Article 19 ↗ · Article 21 ↗ · Article 22 ↗
Messaging-service duties
Software licensing and operating a messaging service are distinct activities. Russian ORI and instant-messaging duties depend on actual operation. Labels such as demo, corporate or On-Premise are not automatic exemptions. The public demo must be assessed separately from buyer installations.
Cryptography and claims
A customer software licence is different from a government licence for regulated cryptographic activities. Applicability depends on the product and business activities; standard libraries alone do not prove exemption. Independent certification, government approval and universal regulatory compliance are not claimed.
Privacy as a legal principle
Private-life protection and restrictions on collecting and disclosing private-life information guide data obligations. KOYA provides technical safeguards; each deployment must combine these with applicable legal and organisational measures.