Privacy policy

Version 1 · in force from 3 August 2026 · applies to the LiquidOpinion app, the web app at /app, and the public window at /p

Most privacy policies describe what a company promises not to do with your data. This one mostly describes what our server is unable to do, because the data never reaches it. Where that is not true — and there are places where it is not — this document says so in the same breath.

1. Who is responsible

The controller for the processing described here is Oumworld AB, a Swedish limited company (aktiebolag), Stadiongatan 65, 217 62 Malmö, Sweden, registered with the Swedish Companies Registration Office (Bolagsverket) under 556994-1304, VAT SE556994130401.

Privacy questions and data-subject requests: privacy@liquidopinion.com. There is no data protection officer; the size and nature of this processing does not require one, and the address above reaches the person who wrote the system.

2. The short version

LiquidOpinion is a ledger of what you thought about things. It is stored encrypted on your own device. The server exists to carry sealed messages between friends who have already met in person, to hold a catalog of things that have names, to hold the opinions people chose to publish, and to take €7.90 a year.

It holds no name, no email address, no phone number and no password for you. An account is an identifier and two public keys. Your journal, your ratings, your friend list, the weights you give your friends and every subject you have ever looked at are on your device and are not sent to us — not in a form we can read, and for most of them not in any form at all.

There is no advertising here, no analytics, no tracking pixel, no third-party script, and nothing about you is sold or shared for anyone else's purposes. The subscription is the entire business model, which is the reason there is nothing else to disclose in this paragraph.

3. What the server holds

This is the complete list. Everything the database can contain is here.

Your account: An account identifier, your signing public key, your key-exchange public key, and a mailbox identifier. No name, no email address, no password. The identifier is generated on your device at signup; nothing about it derives from you.
Your devices: One row per device you have authorized: a device identifier, its public key, the label you typed, when it was added, and when it was revoked if it was. We learn how many devices an account has and roughly when each appeared. We do not learn what kind of device it is or where it is.
Your mailbox: Sealed envelopes your friends' devices left for yours. We cannot open them. Every one is padded to a fixed size, so their lengths tell us nothing either. What we do see is that some address delivered to this mailbox at a given time — see section 6, because that is a real leak and not a footnote.
Published opinions: The opinions, comparisons and lenses people chose to publish, as signed public documents. They carry no account identifier and no name. Each one carries a one-time key that appears nowhere else, and a per-subject pseudonym (a "nullifier") that lets a reader count people rather than rows — see section 6 for exactly what that pseudonym reveals. Published ratings do not exist: the drops you give something never leave your device unencrypted, and never appear in the public corpus at all.
Publishing counters: How many anonymous publishing tokens an account has been issued in the current period, the set of tokens already spent (so none can be spent twice), and one row per account recording that it enrolled for a credential. The token you spend is cryptographically unlinkable to the token you were issued, which is what stops these counters from becoming a record of what you published.
The catalog: Subjects — films, restaurants, bikes, anything with a name — their identifiers, categories and cover images. This is data about things, not about people, and it is the same for everybody.
Your subscription: Your account identifier, a Stripe customer identifier, the status of the subscription and the date it is paid through. No card number, name, billing address or email address ever reaches our server — payment happens on Stripe's own pages, and Stripe tells us only whether an account is paid up.
Technical logs: Ordinary web-server logs: IP address, time, path, response code. They exist to keep the service running and to stop abuse, and they are kept for at most 30 days.

4. What stays on your device

All of this lives in an encrypted store on your own device and is never transmitted to us in any form:

Your journal — every opinion you wrote, published or not, with its date and your words.
Your ratings — the drops. Private permanently, including from your own network's public standings.
Your friend list — who you have inked, and the keys that relationship runs on.
Your trust weights and endorsements — how much each friend counts, and what you think they know about.
Your reading history — every subject you looked up. Reads are unauthenticated, so nothing ties them to an account.
Your keys, including the one-time keys that let you delete something you published.

You can export the lot as a spreadsheet whenever you like, and you can write an encrypted key backup file from the account screen. Uninstalling the app destroys the store. We cannot restore any of it, because we never had it.

5. What the server cannot work out

These are properties of the design rather than promises of good behaviour. They hold against us, against anyone who steals the database, and against anyone who compels us to hand it over.

Who your friends are. Friendship is established by an exchange between two devices standing next to each other. There is no friendship row, no key identifier in an envelope, and no account key involved in the handshake.
Who wrote a published opinion. Publishing spends a blind token: the server can check "a real account, within its limits" and cannot connect that check to the account that was issued the token.
Whether two published opinions share an author — with one bounded exception, on the same subject, described in the next section.
What you read. Subject and opinion reads carry no account.
What you think of your friends. Weights and endorsements are computed on your device and never transmitted.

A seized database yields a list of accounts and public keys, ciphertext nobody can open, the public opinion corpus, and some counters. It does not yield the friend graph, authorship, or anybody's ratings. There is no plaintext pile to hand over, which is the point of building it this way.

6. What this design does not protect you from

A privacy policy for a privacy product that quietly omits the attacks it does not defend against is worse than no policy. Here are ours.

Writing style can identify you, and nothing here prevents it

Published opinions are prose, and prose carries a fingerprint. Anyone holding the public corpus — us, a scraper, a search engine, a determined acquaintance — can use stylometry to group texts by the way they are written and to compare them with things you have written elsewhere under your own name. Cryptography does not touch this and no part of LiquidOpinion's design prevents it. It is permanently out of scope rather than a gap we intend to close.

The same goes for what the text says. "As the only dentist in Kiruna, I can tell you…" identifies its author no matter how the message was carried. If an opinion would be dangerous to have written, the safe assumption is that publishing it can be traced to you.

Traffic patterns. We see which addresses deliver to which mailboxes and when. Sustained observation of that over time can approximate the shape of a friend network. We fight it — fixed envelope sizes, delayed and jittered sending, relays held back by minutes — and it is not eliminated.
Your address at the moment of publishing. The token that pays for a publish is blind, but the request still comes from an IP address. Requesting a token is authenticated and publishing is not, and the two currently sit near each other in time from one address, which is a correlation someone with our logs could try to exploit. Publishing is deliberately delayed by several jittered minutes to weaken it. For an opinion where this genuinely matters, publish over a VPN or Tor.
Two opinions about the same thing. Every published opinion carries a per-subject pseudonym so that readers can count people instead of counting rows. The consequence, stated plainly: if you publish twice about the same subject, anyone holding the corpus can tell that the two came from one unknown author. It names no person and no account, and it does not extend across subjects. If you do not want two of your opinions on one thing grouped, publish once.
Your friends. You send opinions to people. People can copy things, screenshot them, and talk. No protocol fixes that, and the network is built on meeting them in person for exactly this reason.
Losing your device. There is no key escrow and no password reset. If you lose every device on an account and have no key backup file, the account, its friendships and the ability to delete your own published opinions are gone. We cannot help; we do not hold anything that would let us.
A government with a global view of the network. Nation-state traffic correlation across the whole internet is out of scope, and always was.

7. Lawful basis

Performance of a contract (Art. 6(1)(b) GDPR): Your account record, your devices, mailbox delivery, the publishing tokens, and the subscription record. Without these there is no service to provide.
Legitimate interests (Art. 6(1)(f) GDPR): Technical logs, rate limiting and the spent-token set, for keeping the service available and preventing abuse. Our interest is running a service that works; the impact on you is minimal because the logs are short-lived and hold nothing about what you wrote or read.
Legal obligation (Art. 6(1)(c) GDPR): Tax and accounting records for payments, which arise at Stripe rather than here.

We ask for no consent because there is nothing here that needs it: no advertising, no analytics, no profiling, and no cookie used for anything but the app functioning on the device in front of you. The app stores data locally on your device — that is where your ledger lives — and does not use it to track you across sites or services. There is no automated decision-making with legal or similarly significant effects, and no profiling in the sense of Art. 22.

8. Who else touches it

Stripe: Payments, invoicing and VAT. Stripe collects your payment details, name and email on its own pages under its own privacy policy and acts as controller for that; we receive a customer identifier and a status. The contracting entity for EU customers is Stripe Payments Europe, Ltd. (Ireland); its privacy policy is at stripe.com/privacy.
Hosting: Google Cloud (Google Cloud EMEA Limited, Ireland), with servers in the Netherlands, as a processor, for running the server and its database.
Nobody else: No analytics provider, no advertising network, no CDN in front of the app, no error-reporting service, no email provider handling your data — we hold no email address to send anything to. The app fetches from our own origin and nowhere else, which is enforced by a check in our build.

We are based in Sweden and, where our infrastructure lets us choose, we run and store data in the EU/EEA. Stripe may transfer payment data to its affiliates outside the EU/EEA (notably the United States); where that happens it relies on Standard Contractual Clauses or an equivalent safeguard recognized under the GDPR.

9. How long we keep things

Account and device rows: Until you delete the account. A revoked device's row is kept, without its usefulness, so a revoked key can never be resurrected.
Mailbox envelopes: Deleted once every device on the account has read them, after a short grace period — about a day in normal use. Anything undelivered is deleted after 14 days regardless. We delete rather than keep because a stored envelope is exactly the metadata this design is about.
Published opinions: Indefinitely. They are anonymous public documents and there is nothing in them to expire. See section 11.
Publishing counters: Token issuance counts per period; spent tokens for as long as replay protection needs them.
Subscription record: For the life of the account. Stripe keeps its own payment and invoice records for as long as tax law requires of it.
Technical logs: At most 30 days.

10. Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, and to receive it in a portable form. You can complain to a supervisory authority — our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY), www.imy.se — or the one where you live.

Two of these work differently here, and the difference is in your favour:

Portability and access are a button, not a request. Everything we could hand you is already on your device, and the app exports it as a spreadsheet whenever you like. What sits on our server beyond that is your account identifier, your public keys and your subscription status.
We usually cannot identify you. We hold no name and no email address, so an email asking us to erase "my account" names nothing we can find. A request is authenticated by your account key, from the app. If you have lost every device and your key backup, we are unable to identify you and Art. 11(2) GDPR applies: we cannot act on the request, and we are not going to start collecting identifying information in order to be able to.

11. Deleting your account, precisely

"Delete my account" has three different answers here, and only the first one is the ordinary one. The app's delete screen says the same thing this section does.

What is deleted

Your account row and public keys, every device registered to it, your mailbox and every envelope still in it, your token counters and credential enrolment, and the link between your account and its Stripe customer. A live subscription is cancelled at the same time, so nothing continues to be charged. Stripe keeps its own record of the payments already made, as its own controller and as tax law requires.

What was never ours to delete

The encrypted store on your device — your journal, your ratings, your friends, your keys. It is yours; deleting the app destroys it. We never had a copy.

What cannot be deleted, and why

Opinions, comparisons and lenses you published are anonymous by construction. Our server cannot find them — there is no account identifier on them, and there is nothing to search by. That is not a limitation we would remove if we could; it is the same property that stops anybody else from finding out what you published.

Your own device holds the one-time keys for the ones it still knows about, and can sign a deletion for those. Anything already relayed onward is already on other people's devices, and cannot be recalled. If you have lost your keys, even that is gone.

So: publishing is permanent, and erasure covers your account row, your keys and your mailbox — not the anonymous corpus. We will not promise a deletion the protocol cannot perform.

Separately from account deletion, we operate a signed suppression list for content that is illegal or that must come down for legal reasons. Apps honour it and stop displaying the item. That is a suppression, not an erasure, and it is described here so the difference is not mistaken for one.

12. Children

LiquidOpinion is not directed at children and is not intended for anyone under 16. We hold no age or date of birth, so we cannot verify this; if you believe a child has an account, the address in section 1 is the way to tell us.

13. Changes

If this policy changes materially, the app will say so before the change takes effect, and the version and date at the top of this page will move. Previous versions are available on request.