Last updated 25 September 2026 · Published by AENC Corp ("AENC", "we", "us")
Part A — Privacy Policy
Part B — Conditions of Use
AENC's core is a tool for offline, end-to-end encryption of text, files, photos and voice notes. You build an encrypted package on your device and share it over whatever channel you already use — email, a messaging app, cloud storage, or a USB stick. Only the intended recipient, holding the matching private key, can open it. Used this way, AENC transmits nothing: there is no account, no server that sees your content, no address-book upload.
The Google Play edition additionally offers an optional, opt-in built-in messenger (a paid feature). When you use it, your messages are still end-to-end encrypted on your device first, and are then relayed through our own relay server to the recipient. The relay is a "dumb" store-and-forward spool: it handles only ciphertext and a minimum of delivery metadata, and it can never read your messages, learn your identity from the payload, or recover your keys (see sections 5–9). This messenger is off unless you subscribe and turn it on; if you never do, AENC behaves exactly as the offline tool described above.
AENC has no sign up, no login, no username, no phone number and no email requirement. Any identity you create exists only as an encrypted key file on your removable drive, and in your device's memory while unlocked. We keep no record of it. We cannot list users, because there is no user list.
An AENC identity is a set of cryptographic keys (an X25519 encryption key, an Ed25519 signing key, and an optional post quantum sntrup761 key). Here is where the private parts live.
Argon2id key derivation function.We never receive, escrow, back up, or have any way to recover your private keys. If you lose the removable drive or forget the passphrase, the keys are gone for good, and so is anything only they could decrypt. We designed it this way on purpose.
When you encrypt something, AENC creates a self contained encrypted package using authenticated encryption. That means X25519 key agreement with AES 256 GCM, plus Ed25519 signatures, and an optional hybrid post quantum mode that adds sntrup761. AENC encrypts the sender's identity inside the package ("sealed sender"), so it never shows on the outside.
When you share the encrypted output yourself (offline use), no server of ours takes part, so we hold none of your content or metadata.
Built-in messenger (optional). If you use the paid messenger, the same self-contained encrypted .aenc package is delivered through our relay server instead of being shared by hand. The message is encrypted end-to-end on your device first; the relay only stores the ciphertext briefly at an opaque, rotating "mailbox" address and hands it to the recipient, then deletes it (delete-on-fetch, with a short safety time-limit for messages never collected). Large files stream through the relay as encrypted blobs the same way. On the recipient's device, messages are saved only in an encrypted on-device history (readable only with their removable key) — never on our server. Message addressing uses a Double Ratchet, so the delivery addresses change every message and cannot be linked back to an identity. The relay never receives plaintext, your private keys, or a readable identity; what it can and cannot observe is detailed in sections 6–7.
AENC comes in two editions.
license.aenc.io, which carries your end-to-end-encrypted messages and files (ciphertext only) plus the minimum needed to route and deliver them; and (5) optionally Firebase Cloud Messaging (FCM) — Google's push service — to wake your device for a new message. The push is contentless: it carries no sender, no message, and no readable identity, only a signal to open the app and fetch. FCM push is on by default but can be turned off in the app (delivery then falls back to in-app checking while the app is open). Separately, Google's Play Billing library carries Google's own diagnostic pipeline, which sends standard device and diagnostic data to Google (see sections 7 and 9).In neither edition does any plaintext message, file, media, contact, or private key ever leave your device. When you use the messenger, content leaves only as ciphertext that our relay (and any network in between) cannot read. The other network use above covers only licensing, the Google Play platform, push wake-ups, and Google's bundled components — never your content or keys.
We run no analytics and build no profiles. AENC contains no analytics SDK of our own, no crash reporting that sends data to us, no advertising identifiers, and no telemetry. For the offline core, no AENC server receives anything at all — there is no dataset for us to hold, share, or be forced to produce.
The messenger relay (only if you use the paid messenger). Our relay is a minimal store-and-forward server. It is built so it cannot read your messages. In the course of delivering them it necessarily handles some data:
Honest limits (metadata). Using push means Google's FCM, and our relay, can associate a stable push token with your device to wake it; and a network observer or the relay can see IP, timing and size. These are the ordinary metadata costs of instant online delivery. If that matters to your threat model, you can turn push off (maximising the address-rotation benefit) or use the offline sharing flow, which involves no server at all. Stronger network-metadata protection (e.g. onion routing) is on our roadmap.
Google Play edition, data sent to Google (billing). The Google Play edition includes Google's Play Billing and Play Integrity components; Google's Play Billing library runs its own diagnostic pipeline that sends Google standard device and diagnostic information (device model and build fingerprint, mobile-network operator code, locale, time zone). This is Google's pipeline, required by Play Billing; AENC does not receive or use it, our Play Data Safety declaration describes it, and it contains no message content, files, contacts, or keys.
AENC's core is free. That means you can encrypt, decrypt and share files offline at no cost. The Google Play edition offers one optional paid feature, a built-in messenger that relays your end-to-end-encrypted messages through our own relay server (see sections 5–7 for exactly what the relay can and cannot see). This feature stays off unless you actively subscribe and enable it. Here is what happens when you subscribe.
If you never subscribe, none of the billing exchange above happens.
Accessibility security check. Apart from the subscription, the Google Play edition has an anti tapjacking safeguard. When you enable an accessibility service on your device, the app can send a request to play.google.com to check whether that service is a published Play app. This request tells Google the package name of the enabled accessibility service. It carries no AENC content, files, contacts, or keys. It warns you about accessibility or overlay apps that could be malicious. A future update may run this check locally and drop the network request. The standard offline edition skips this check and never contacts any server.
You add a contact by importing their public contact file (.aepair). This is a small self signed blob that holds only public keys and a display label. Usually you scan a QR code in person or tap the file they shared. AENC stores contacts and contact books encrypted, on a removable drive you control or on the phone, and never on any server. AENC never uploads, syncs, or reads your device's system address book.
AENC contains no advertising, no third party trackers of our own, no analytics reporting to us, and no fingerprinting. We do not use cookies or identifiers to follow you across apps or sessions, and we build no user profiles. There is one exception. The Google Play edition bundles Google's Play Billing library, which carries Google's own diagnostic and telemetry pipeline to Google (see section 7). That pipeline is Google's, Google Play Billing requires it, and AENC does not use it for analytics, advertising, or profiling.
For the offline core we hold nothing, so there is nothing on our side to keep or delete. For the messenger relay, retention is deliberately minimal: an encrypted message is deleted the moment the recipient fetches it (delete-on-fetch), with a short safety time-limit for messages that are never collected; the encrypted prekey directory entry and your push token persist only while your account is active and are removed if you turn push off or stop using the messenger. None of it is readable by us.
On your device, you stay in control. You can delete your key file and contact files; the messenger's on-device history can be cleared per chat or set to auto-delete; and AENC has an emergency wipe that securely removes sensitive AENC files (including chat history and messaging keys) from the device. Uninstalling the app removes its app-side data. Once a message is delivered to a recipient, it is outside your control, and ours, for good.
AENC uses well proven cryptography. That is X25519 (ECDH) with AES 256 GCM authenticated encryption, Ed25519 signatures, Argon2id passphrase hashing, and an optional post quantum hybrid using sntrup761. AENC holds private keys in locked, guarded memory and wipes them after use.
No client side protection is absolute. A determined attacker with full physical control of an unlocked device can, in principle, try to pull data from memory. AENC makes that as costly as possible and leaves nothing at rest, but it is not a replacement for physical device security.
The messenger relay is operated by AENC Corp (us), not a third party. The one third party involved is Google, and only in the Google Play edition: Google handles distribution, optional Google Play Billing, Google Play Integrity, the accessibility store check, the diagnostic data its Billing library collects, and — if you leave push on — Firebase Cloud Messaging, which delivers the contentless wake-up notification and therefore sees your device's push token and delivery timing (see sections 6, 7 and 9). Google's own terms and privacy policy govern these. You can install the standard edition without any app store; it involves no third parties and no relay.
We may update this policy. Material changes will be reflected here with a new "Last updated" date. Because AENC has no way to contact you (we hold no address for you), we recommend reviewing this page after significant app updates. Continued use of the app after an update constitutes acceptance of the revised policy.
Questions about this policy or AENC's privacy practices: support@aenc.io. For business, licensing or partnership enquiries: sales@aenc.io.
The AENC app contains no tracking or analytics code, and it makes no network activity beyond what is essential. You must not modify it in a way that weakens or removes its end to end encryption, or that makes it send user content or keys.
You are solely responsible for keeping your removable key drive, your passphrase, your device, and any exported files safe. AENC cannot recover your keys or data. Loss of the key drive, loss of the passphrase, deletion of files, or uninstalling the app may result in permanent, unrecoverable loss of access to your identity and to anything encrypted to it. Keep backups of your key drive if continued access matters to you.
You may use AENC only for lawful purposes and in compliance with all applicable laws. You are responsible for the content you encrypt and for how you use the encrypted output. AENC provides a general purpose cryptographic tool and does not monitor, and cannot access, what you encrypt.
AENC is not a communications carrier and does not provide access to emergency services. Use the normal emergency contact methods available on your device and network.
You retain all rights to the content you create and encrypt. We claim no license to it and never receive it. Once you share an encrypted package with a recipient, that recipient can keep and decrypt it. No "delete" feature can guarantee removal of content already delivered to another person's device.
Some AENC modes give you a repudiation property. A recipient can check that a message came from someone able to use a given key, but cannot prove to a third party who wrote it. This is a deliberate privacy feature, not a defect.
AENC is provided "as is" and "as available", without warranties of any kind, whether express or implied, including but not limited to merchantability, fitness for a particular purpose, non infringement, security, or freedom from error or interruption. You use AENC at your own risk. No cryptographic tool can guarantee protection against every possible adversary, and you are responsible for assessing whether AENC meets your threat model.
To the maximum extent permitted by law, AENC Corp and its contributors will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, keys, profits, or goodwill, arising out of or relating to your use of or inability to use AENC. Where liability cannot be excluded, it is limited to the greatest extent permitted by applicable law. Some jurisdictions do not allow certain exclusions, so parts of this section may not apply to you.
We may change, suspend, or discontinue the app or any of its features at any time. App updates may be required for continued security, so you are responsible for installing updates as they arrive.
We may revise these conditions. Continued use of AENC after revised conditions are posted here constitutes acceptance of the changes.
Questions about these conditions: support@aenc.io.