Last updated: July 2026
This Privacy Policy explains how Obsidian ("we", "us", "our") collects, uses, and protects your personal information when you use our secure messaging and collaboration platform. We are committed to protecting your privacy and handling your data transparently and responsibly.
We collect the following categories of information: (a) Account Information — your name, email address, and username when you register; (b) Profile Data — optional information you choose to provide such as a profile photo, bio, pronouns, and location; (c) Messages & Content — messages, files, voice/video session metadata, and any other content you create within the app; (d) Usage Data — technical information such as device type, browser, IP address, and pages visited, used solely for service operation and security.
We use your information to: (a) provide, maintain, and improve the Service; (b) authenticate your identity and secure your account; (c) send important notices such as password reset or security alerts; (d) respond to support requests; (e) detect and prevent fraud, abuse, or violations of our Terms. We do not use your messages or personal content for advertising or sell them to third parties.
Your data is stored securely using Supabase (PostgreSQL) with Row Level Security (RLS) enforced at the database level. This means only you and authorised participants can access your conversations and files. All data is transmitted over HTTPS/TLS. We apply industry-standard security practices including key rotation, access controls, and regular audits.
Obsidian is designed with privacy-first principles. While messages are securely stored in our database with RLS protection, we strive toward end-to-end encryption on sensitive content. Messages are never read, analysed, or used by us for any purpose other than delivering them to the intended recipient.
We use the following trusted third-party services to operate Obsidian: Supabase (database and authentication), LiveKit (real-time audio/video), Google Gemini (AI assistant), ElevenLabs (voice synthesis), and Klipy (media content). Each of these providers has their own privacy policy and may process data in accordance with it. We only share the minimum necessary data with each provider.
Obsidian uses session cookies issued by Supabase to maintain your authenticated session. We also use browser localStorage to store your notification history and preferences locally on your device. We do not use tracking or advertising cookies.
We retain your account data for as long as your account is active. If you delete your account, your personal information and messages are permanently removed from our systems within 30 days, subject to any legal obligations to retain certain records.
Depending on your jurisdiction, you may have the right to: (a) access the personal data we hold about you; (b) request correction of inaccurate data; (c) request deletion of your account and associated data; (d) withdraw consent where processing is based on consent. You can exercise these rights through Settings → Account → Delete Account, or by contacting us via the in-app Help section.
Obsidian is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will take steps to delete that information promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.
If you have any questions, concerns, or requests related to this Privacy Policy, please contact us through the Settings → Help section inside the app.
© 2026 Obsidian · Safe & Secure Messaging · Terms of Service