Privacy Policy

Introduction

This policy explains how Jeff Mixon handles information in connection with the Knit Android app (package app.getknit.knit), Knit for iPhone (the iOS app, bundle ID app.getknit.knit, not yet released) and this website, getknit.app. Knit is an offline-first messenger whose mesh needs no servers, and this policy covers both apps and the site.

Knit is designed, published and maintained by Jeff Mixon as an individual, independent developer, not a company. Under data protection law, Jeff Mixon is the "controller" for the little personal information that reaches the developer at all: the default relay's connection log, report emails you choose to send, stories you choose to email, the short-lived hash that stops repeat star ratings, and crash logs Apple passes on if you allow it. Everything else stays on your phone, under your control.

By installing or using Knit, or by visiting getknit.app, you acknowledge the practices described here. The contact details are at the end.

Summary

• Your data stays on your phone. Messages, contacts, your profile and your settings are stored on the device. Knit never asks for an account, an email address or a phone number.
• The mesh needs no servers. Phones pass messages to each other over Bluetooth, and Android phones over Wi-Fi as well.
• Internet features are optional. On Android, Internet relays and link previews are off until you turn them on, and a translation or speech model downloads only when you ask for it. Knit for iPhone has no internet features at all.
• Nothing is tracked or sold. Neither app contains analytics, advertising or tracking code, and your personal information is never sold.
• Very little reaches the developer. Five things can: the default relay's connection log, if you switch relays on; a report you choose to email from Knit for iPhone; a story you choose to email from this website; a star rating you choose to send from this website; and crash logs, if you let Apple share them.
• You stay in control. Clearing or uninstalling the app erases what it stored, and you can ask about anything else at the contact below.

Information Knit handles

Here is each kind of information, where it lives and who can see it. Most of it never leaves your phone.

• Your profile. A name, status and avatar you choose, plus an alias Knit generates and a random identity key. It is created and stored on your phone. People nearby see your name, status and avatar, which is how they recognise you. No email address, phone number or other real-world identifier is asked for.
• Messages, photos, contacts and groups. These are stored on your phone. They travel to other people's phones over Bluetooth, and between Android phones over Wi-Fi too. Direct and group chats are end-to-end encrypted on the way (see Security, below).
• Your location, only when you send it. Knit does not track your location. From 2.6.0 the Android app lets you send where you are from a chat's menu: it reads your position only between that tap and the send, and the position goes into that chat as a card that opens in any maps app. Knit for iPhone never reads your location.
• Link previews, if you turn them on. This Android setting starts off. With it on, your phone fetches a page's title and picture when you paste a link, and sends that card with your message. The website you linked sees your IP address, as it would if you opened it. The people you send to never contact it.
• Translations and transcripts stay on your phone. From 2.11.0, the Android app can translate messages and turn English speech into text, and does both on your phone: no message, voice message or call is sent anywhere to be translated or transcribed. A translation, or the transcript of a voice message, is kept with that message on your phone and goes into a backup with it. Captions during a call and walkie-talkie transcripts are not kept once the call ends. Knit for iPhone has neither feature.
• Model downloads, only when you ask. Each translation language, and the speech model, is a one-time download from getknit.app that the Android app makes only when you choose to download it. As with any visit to this website, the web host may log your IP address, the time and the file you fetched, which names its language. A contact can also send you translation models phone to phone with Direct file send, once you accept, and your phone checks every file before using it.
• The languages you write and read, while Translation is on. From 2.11.0, the Android app's Translation switch, in Settings › Chats, starts on. While it is on, a message you send can also say which language you typed it in and which language you read, so the people you write to can translate it. In direct and group chats that travels encrypted with the message, and in the Nearby room it is as public as the message itself. Turning the switch off stops sending it.
• Your voice, only during a call. From 2.10.0, the Android app can make voice calls in a one-to-one chat. Knit uses the microphone only during a call, and saves no call audio: your voice goes to the other phone as you speak, end-to-end encrypted. A short record of each call (who called, when, and how it ended) stays in the chat on your phone, and calls stay out of Android's call log. Knit for iPhone has no calls.
• Backups you make. From 2.7.0, the Android app's Settings › Backup and restore can write your identity, contacts, groups, messages and photos into one encrypted file, saved wherever you choose. If you pick a cloud folder, the encrypted file goes there. A recovery key that Knit shows once and does not keep locks the file, so nobody without it can open the backup, Jeff Mixon included. Knit never makes or uploads a backup on its own. Knit for iPhone has no backup feature and keeps its data out of iCloud and computer backups.
• Crash reports. From 2.3.0, the Android app records its own crashes on the device, with ids, names and message text removed. You can read a report in Diagnostics and copy it, share it, or open a pre-filled bug form on GitHub, where anything you post is public. Knit for iPhone has no crash reporting of its own. If you have turned on Share With App Developers under Analytics & Improvements in iOS Settings, Apple may pass crash logs from Knit to Jeff Mixon, and you can turn that off in the same place. Neither app contains code that uploads a report.
• The field log, if you turn it on. From 2.9.0, the Android app's Diagnostics can keep a three-day record of how your phone's radios behaved: when links to other phones came and went, how strong they were, how fast files moved and how long messages took. It holds no names, messages, contacts, phone ids or locations, and other phones appear only as short codes. It stays on your phone unless you share the file yourself.
• Reports you choose to email. In Knit for iPhone, reporting someone deletes the message and blocks them on your phone, and sends nothing over the mesh. If you choose Report and Email Knit, your mail app opens a message to iosreports@getknit.app that you can read, edit or cancel. It holds the person's name and Knit id, where you saw them (Nearby, a direct message, a named group, a message request or their profile), the reported words and when they were sent, their status line if you reported from their profile, a note if the message had a photo, the app version and when you made the report. It never includes a photo itself. The message ends with room for you to add more, so it also holds anything you write. If you send it, Jeff Mixon receives the email and your email address.
• Relay connection data, if you switch relays on. Android only. A relay sees your IP address, a random number for each active conversation, and when you send and roughly how much. It cannot read anything you send. The Internet relays section below has the details.
• Call connection data. Android only. On a call that connects directly, the other person's phone sees your IP address. A server your phone asks for help connecting a call sees your IP address too, and one that relays the call also sees theirs, how long it lasted and how much data it carried. None of them can hear the call. The Voice calls section below has the details.
• Direct links, if you turn them on. From 2.11.0, the Android app has a Connect directly to contacts switch on the Internet relays screen, and it starts off. With it and relays on, on your phone and a contact's, Knit can connect the two phones straight over the Internet. A contact Knit tries to connect with learns your IP address, even if no connection comes up. Your phone may ask a server named by one of your relays for its public address, and that server sees your IP address too. Direct and group chats stay end-to-end encrypted on a direct link.
• Visits to this website. The web host may log your IP address, the time and the page you asked for. A light or dark theme choice is kept in your browser. See Cookies, tracking and this website, below.
• Ratings and stories you send from this website. On getknit.app/stories you can rate Knit and share a story. A star rating goes to the site's server, which stores the number and the date. To stop one person rating again and again, it also keeps a keyed hash of your IP address, not the address itself, for 30 days and then deletes it; the hash is stored apart from the rating and is not linked to it. A story never goes to the site's server. Share on GitHub opens a pre-filled GitHub discussion that you read, edit and post under your own GitHub account, so it is public and GitHub's own policy covers it. Share by email opens a message to hello@getknit.app that you can read, edit or cancel. If you send it, Jeff Mixon receives the email and your email address, and asks before quoting any of it.
• No analytics or advertising. Neither app contains third-party analytics, advertising or tracking code, and neither builds a profile of you for marketing. Knit for iPhone's privacy manifest declares no tracking.

How information is collected

You enter some of it yourself: your profile, your messages, any report you decide to email, and any rating or story you decide to send from getknit.app. Your phone receives the rest from nearby phones as the mesh passes messages along. A few things are recorded automatically, and only when you use the feature that needs them: a relay sees your connection while relays are on, a linked website sees your IP address when a preview is fetched, and the web host logs visits to getknit.app, including a model download your phone makes when you ask for one. Jeff Mixon receives nothing about you from other companies, apart from crash logs Apple shares with your permission.

App permissions

Android. To discover the phones around you, the Knit Android app asks for the nearby-devices permission. Older versions of Android also require a location permission for Bluetooth and Wi-Fi scanning, and Knit never uses that permission to read where you are. Knit works best when it can run in the background, so it can keep relaying messages for the people nearby. Sending your location from a chat asks for the location permission the first time, and only then. Recording a voice note or making a call asks for the microphone the first time. Calls also use Android's calling features to ring and to route their audio, and Android may ask you to let Knit show an incoming call on the lock screen. You can review or revoke these permissions in Android's settings, though that may stop the app from finding nearby devices. Knit requires Android 10+.

iPhone. Knit for iPhone asks for Bluetooth, to find and link with the phones around you, and keeps those links open in the background. It asks to show notifications, which your iPhone builds itself, with no push service. It asks for the camera the first time you scan someone's code, and for add-only photo access the first time you save a photo, which lets it add to your library without reading it. Photos you send come through the iOS photo picker, which hands Knit only the ones you choose. It never asks for your location or contacts. You can change any of these in the iOS Settings app. Knit for iPhone requires iOS 18 or later.

How information is used

On your phone, Knit uses your information to run the app: to show your messages and relay them to nearby phones, to carry sealed copies through relays you switch on, to connect the calls you make and answer, to show your profile and the profiles of people around you, and to run content filtering.

Content filtering runs entirely on the phone. Models bundled with the app check what other people send, and hide abusive text and explicit images until you tap them. In the public Nearby room, and the Meshtastic room on Android, they also stop abuse and explicit images before they are sent, and they check a profile photo when you set it (group photos too, on Android from 2.9.0). On Android, the Content filtering setting turns this off. Images and text are never uploaded for analysis, and the filter only changes what your own screen shows and sends.

What reaches the developer is used narrowly. The relay's connection log keeps the service running, a report email is read to look into the report, crash logs help fix bugs, a story email is read and quoted on the site only if you agree, and the rating hash exists only to stop repeat ratings. Ratings are averaged into a score the site may publish. None of it is used for advertising, sold, or shared with anyone for their own purposes.

Legal basis for processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, the GDPR asks for a legal basis for each use of your personal information. Information that stays on your phone is never processed by Jeff Mixon at all. For what does reach the developer:

• The default relay. Carrying sealed copies is how the relay provides what you asked for when you switched relays on. Its connection log rests on legitimate interests: keeping the relay running and protecting it from abuse.
• Report emails. Legitimate interests: keeping people safe and enforcing Knit's terms of use. Sending one is always your choice.
• Crash logs from Apple. Your consent, given in iOS Settings. You can withdraw it there at any time.
• Ratings and the repeat-rating hash. Legitimate interests: keeping the published rating honest by stopping one person from rating over and over. Sending a rating is always your choice.
• Story emails. Your consent, given by sending the email. Quoting any of it on the site needs your agreement first.
• Website logs. Legitimate interests: keeping getknit.app secure and working.

Data sharing and third parties

Jeff Mixon does not sell, rent or share your personal information. The Knit mesh holds nothing on a server, the default relay holds nothing it can read, and report and story emails are not passed on. If the law ever required a disclosure, only what the developer actually holds could be handed over: the relay's masked connection log, any report or story emails, and the ratings and address hashes the site stores.

Links from the apps or this website take you to services run by others, each governed by its own privacy policy. Jeff Mixon has no control over, and is not responsible for, how they handle your data. They are:

• Ko-fi, Liberapay and GitHub Sponsors. Where you can support development. A contribution is made on that platform, under its terms; getknit.app takes no payment itself and never sees your card or bank details.
• Google Play and F-Droid. Where you install Knit. A store may collect information about the download in accordance with its own policies.
• GitHub. Where the Knit source code is published, and where a story you choose to post from the stories page goes, under your own account.
• Mastodon. Where Knit posts news, at mastodon.social.
• Bluesky. Where Knit posts news, at bsky.app.
• What's New (whatsnew.fyi). An index of every Knit release.
• YouTube. Where the trailer plays from, and only once you press play (see This website, below).
• Hosting providers. The companies whose data centers run the default Internet relay and its supporting servers. When you have relays switched on, they carry those servers' network traffic under their own terms; they cannot read the sealed copies the relay holds.

Internet relays (optional)

Relays are off until you turn them on. Out of the box, Knit opens no connection to the internet: Internet relays and link previews are each a switch in the Android app's Settings that starts off, a translation or speech model downloads only when you ask for it, and Knit for iPhone has no relays at all. Relays keep a direct or group chat moving when nobody is in radio range. With them on, Knit uploads sealed copies of those messages to the relays on your list, and a phone that connects later collects them. The public Nearby room never touches a relay.

A relay cannot read what it holds. It stores ciphertext it has no key for and no way to ask for one, so it cannot read your messages, reactions, receipts or attachments. It does not know who is talking either: no names, no numbers, no device identities, no contact list. What it can see is your IP address, that a conversation (identified by a random number) is active, and when you send and roughly how much. Knit shows you this before the switch goes on.

Copies expire within 48 hours. A relay deletes each sealed copy of a direct or group message within 48 hours of receiving it, whether or not it was collected. Turning relays off stops new uploads immediately; copies already on a relay are unreadable to it and expire on the same clock. A relay holds recent traffic, not a backup of your conversation.

Shared rooms, if you join one. From 2.11.0, a private relay can also run shared rooms, which you join in the Android app only with an invite from that relay's operator. Everyone in a room becomes one of your contacts and receives your profile. Posts are sealed with one key that every member shares and that comes with the invite. The relay is never given it, but anyone who holds the invite can read the room, the operator who made it included, along with the earlier posts the relay still keeps. The relay sees the same connection metadata as for any conversation, and keeps a room's posts for as long as its operator sets rather than 48 hours. Leaving a room removes it and its history from your phone, and its members stay in your contacts.

The default relay is run by Jeff Mixon. Knit comes with one relay on its list, public-1.spool.getknit.app, which Jeff Mixon operates on servers rented from commercial hosting providers. The relay runs Knit Spool, the open-source relay software (AGPL), and sealed copies sit on its disk only until they expire. The proxy in front of it keeps a short connection log that overwrites itself as it fills, with part of each IP address masked and no browser or device identifiers. That log exists to keep the service running and is not analysed, shared or sold. You can remove the default relay, add relays run by anyone else, or run your own.

Knit Hosted is a separate, paid service. Jeff Mixon also runs Spools for people who would rather not run their own, as Knit Hosted at hosted.getknit.app. If you sign up there, that service's own privacy policy and terms apply, and both are published on that site; this policy covers the Knit apps and getknit.app. To Knit it is a relay like any other: it stays off until you add it, it holds sealed copies it cannot read, and it sees the same connection metadata described above. Knit works without it.

Voice calls

Calls go straight between phones where they can. A live call between nearby phones can run over a Wi-Fi Direct link the two phones make themselves, or over a Wi-Fi network you share, with no internet needed. Across the Internet, the ringing travels as sealed messages through a relay you both have switched on, and the audio goes directly between your phones whenever the networks allow it. A mesh call travels over Bluetooth and Wi-Fi Aware, through up to three other Knit phones, and through a relay only when the radio path is unavailable and a relay you use offers it. Knit saves no call audio, and a relay carrying a mesh call passes it on as it arrives and stores none of it.

Nobody along the way can listen. Both kinds of call are end-to-end encrypted between the two people on a one-to-one call. A mesh call is sealed like a direct message, and a live call sets up its own keys and checks them against both people's Knit identities. Phones, relays and servers that carry a call cannot hear it or join it.

What stays visible. On a direct live call, the person you call sees your IP address, as on most Internet calls. To find your public address for an Internet call, your phone may ask a STUN server named by a relay you use, and that server sees your IP address. When a direct path is not possible, the call goes through a TURN server from one of your relays. Whoever runs it sees both IP addresses, when the call happened, how long it lasted and how much data it carried, but never what was said. A relay carrying a mesh call sees both IP addresses and when, and for how long, each side talks. Phones passing a mesh call along can see that call audio is going by, and when.

You decide how calls connect. With Relay all calls on, every call goes through a TURN server, so the person you call never sees your IP address; the server sees both addresses instead. You can also choose which kinds of incoming call Knit accepts, on the Calls screen in Settings.

International data transfers

Knit can be used anywhere. The mesh keeps your data on your own device and sends nothing to a central server, so using it does not involve Jeff Mixon moving your information across borders. The default Internet relay is the exception: it runs in commercial data centers whose locations can change and may be outside your country, so if you switch relays on, your connection metadata may reach a server in another country. Choose a different relay, or run your own, if you would rather it did not. Knit for iPhone has no relays. A report email, or a crash log shared through Apple, may also be stored outside your country.

Data retention

• On your phone. Your profile, messages and settings stay on the device for as long as the app is installed, or until you delete them. Clearing the app's data or uninstalling it removes them. On iPhone, iOS keeps the Keychain item that holds your identity keys after the app is deleted, so reinstalling brings back the same identity with an empty history; erasing the iPhone removes it.
• On a relay. Sealed copies of direct and group messages expire within 48 hours, and a shared room's posts when its operator sets. The default relay's connection log has a fixed size and overwrites its oldest entries as it fills.
• Files you made. A backup file stays wherever you saved it until you delete it; uninstalling the app does not remove it. The field log keeps three days and is deleted when you turn it off.
• Report emails. Kept only as long as it takes to deal with the report, then deleted.
• Ratings, address hashes and stories. A rating is a number and a date, and is kept for as long as the average is published. The address hash is deleted after 30 days. A story email is kept until you ask for it to be deleted. A story you post on GitHub stays there until you delete it.
• With the people you wrote to. Messages you have already sent may still exist on the devices of the people who received them.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or export personal information about you, to object to or restrict how it is used, and to withdraw consent you gave. Most of your data is on your own phone, so you exercise those rights there: edit your profile in the app, and clear or uninstall the app to erase it.

What the developer holds. Jeff Mixon holds no account, profile, message or contact data for you on any server. The default relay's connection log holds only masked addresses and cannot be searched by person. A report you emailed from Knit for iPhone, or a story you emailed from this website, can be found, sent to you or deleted on request. A stored rating is only a number and a date, with nothing that identifies you.

In the EEA and UK, you can also complain to your local data protection authority.

In California, the CCPA gives you the right to know what personal information is held about you, and to have it deleted or corrected. Personal information is never sold or shared for advertising, so there is nothing to opt out of, and nobody is treated differently for using these rights.

To make a request, email the contact below. You will get an answer within one month. For a report email, writing from the address that sent it is enough to confirm it is yours.

Cookies, tracking and this website

getknit.app is a static site served from a standard web host, with one small script that records star ratings. It sets no cookies and runs no analytics or trackers. If you use the light/dark switch, your choice is kept in your browser's local storage, one value read only by this site, and nothing else is stored.

The trailer loads from YouTube only when you press play, through YouTube's privacy-enhanced embed. From that moment the player is Google's, and Google's privacy policy applies to what it does.

The host may keep standard server access logs (IP address, time and requested URL) for security and operations, as is typical for any website. These logs are not used to identify or profile visitors.

Security: how your messages are protected

Direct and group chats are end-to-end encrypted. The message body, mentions and image attachments in your one-to-one and group conversations are sealed so only the participants can read them, even though each message relays hop by hop through other people's phones. You can confirm you are talking to the right person by comparing a safety number or scanning a QR code together in person.

The public Nearby broadcast room is plaintext by design. It has no fixed set of recipients, so anyone within range can read what is posted there. Treat it like speaking out loud in a crowd: it is not a private or encrypted channel.

Those chats are forward-secret, within limits. Knit derives fresh keys as a conversation goes back and forth and deletes the ones it has finished with. Someone who records mesh traffic as it passes cannot decrypt it later, because the keys that would open it no longer exist on either phone. Two limits come with that. Keys turn over in blocks of messages rather than one key per message, so anything recovered covers the block around it. And a conversation with someone still running an older version of Knit falls back to the previous scheme, which has no forward secrecy at all, until they update. Knit for iPhone uses that previous scheme for now, so the same holds for chats with an iPhone until it gets the newer one, which is the next thing on its list.

Reactions and delivery receipts are sealed too. In direct and group chats on Android, an emoji reaction and the tick that says your message arrived are encrypted like the message itself, so a phone relaying them cannot tell who reacted to what, or when something reached you. Both fall back to their older cleartext form toward someone still running an older version of Knit, and in the public Nearby room they stay cleartext with the room. Knit for iPhone still sends reactions and receipts in cleartext in direct and group chats, so a relaying phone can see who reacted to a message, though never what the message says, and its group messages carry the group's name and member list in the clear.

Your messages are encrypted on the phone as well. The Android app keeps conversations, contacts and key material in an encrypted database. Its key is wrapped by a hardware-backed key in Android's keystore, which never leaves the device and is excluded from cloud backup, so the files are unreadable if they are copied off the phone. On iPhone, iOS Data Protection encrypts the database with a key tied to your passcode, when the phone has one, and the database is excluded from iCloud and computer backups. Knit for iPhone keeps your identity keys in the iPhone's Keychain, marked to stay on that device, so they are never backed up, synced or moved to a new phone. None of this replaces your screen lock: someone who can unlock the device and open Knit sees what is in it, as with any messenger.

A paired Meshtastic radio adds range on its own switch. If you pair a Meshtastic board with the Android app over Bluetooth, your short direct messages and Nearby posts can cross it at kilometre range; it sends nothing else of yours and nothing of anyone else's. A direct message goes to your contact's own board end-to-end encrypted, but that short copy is sealed with a key that never changes, so someone who records it could read it later if either of your identity keys were ever stolen. The two boards, the timing and the size travel in the clear on a channel anyone in range can listen to, which is why LoRa for direct messages has a switch of its own. While LoRa is on, your profile names your board so your contacts can reach it. To get a message through, Knit may give your board a contact's key from their profile, and that contact then shows as a favourite in Meshtastic apps connected to your board. Group chats and attachments never ride the radio. Knit sets up its own channel on the board with position sharing turned off, and never reads your phone's location for it. The Meshtastic room mirrors the board's primary channel, which sits outside Knit's encryption like the Nearby room; nothing posted there crosses Knit's mesh or touches the internet.

Encryption still has limits. It hides what you say, not that you are saying something. An observer watching the mesh sees frames moving between phones, and can tell that your phone sent something shortly after a message reached it, without reading either one. No system is perfectly secure, and both apps are open to security reports.

Children's privacy

Knit is not directed to children under 13 (or the equivalent minimum age where you live), and Jeff Mixon does not knowingly collect personal information from children. The apps keep their data on the device and the mesh sends nothing to a server, so Jeff Mixon gathers no personal information about any user, child or adult, beyond the connection metadata a relay sees if relays are switched on, or a report someone chooses to email. If you believe a child has sent such a report, write to the contact below and it will be deleted.

Supporting Knit

Knit is free. It is built and published by Jeff Mixon as an individual, not a company, charity or non-profit. Contributions through Ko-fi, Liberapay and GitHub Sponsors are voluntary support for development and are not tax-deductible. Supporters on GitHub Sponsors or Ko-fi at the level named at anywhere.getknit.app/sponsor receive Knit Anywhere as a thank-you, which Jeff Mixon runs: calls through Knit's own call relay (a TURN server) and larger files in chats over Knit's public relay, which carries small files for everyone. Its own terms and privacy policy apply, and both are published on that site. Liberapay supports Jeff Mixon personally and carries no perks. Apart from that thank-you, a contribution carries no goods, services or perks, and nothing is owed in return. Each payment is made on that platform, under its terms and whatever refund or cancellation policy it offers. getknit.app takes no payment itself and never sees your card or bank details.

No sale of personal information

Jeff Mixon does not sell or share personal information, as the CCPA uses those words, and has not done so in the past 12 months. Nothing from either app or this website is used for targeted advertising.

Changes to this policy

This policy will change as Knit gains features or the law changes. When it does, the "Last updated" date at the top of this page moves. Continuing to use Knit or getknit.app after a change means you accept the updated policy.

Contact

This policy, the Knit Android app, Knit for iPhone and this website are maintained by Jeff Mixon, who answers privacy questions and rights requests personally, within one month. To ask about your privacy or about how Knit works, you can reach out by email at hello@getknit.app.