Privacy policy

This Sotto server is run by Sotto. Contact: contact@sottocall.com · Support: support@sottocall.com · Live Support: Sotto Live Call Center.

Sotto is a calling app built to know as little as possible about you. There are no accounts, no phone numbers or e-mail addresses, no advertising, no analytics and no tracking. This page explains, plainly, what is processed, where, and for how long.

Calls are end-to-end encrypted

Audio and video travel encrypted from one device to the other (WebRTC with DTLS-SRTP). The messages that set up a call, including your name if you send it, are encrypted on your device for the other person's device only (libsodium). This server cannot read them, and it cannot listen to or watch a call.

What this server processes

Never	Names, contact lists, call history, notes, call content (audio, video, call set-up messages). There is no database: nothing about you is stored.
Briefly, in memory only	The public key of each connected device (it is your Sotto ID), and the IP address of the connection, while it is open. Which ID sends an encrypted message to which ID, and when, while the message passes through. A message for a device that is offline is held for at most 60 seconds, then dropped. For calls that go through the relay (when devices can't connect directly, or with "Hide my IP address"): the IP addresses of both devices and the amount of data, for as long as the call lasts. The relay credentials are temporary and contain no ID. Counters to prevent abuse (connections per network address, messages per second), keyed with a random secret that changes when the server restarts.
Logs	The Sotto server writes no request logs and never logs keys, IDs, IP addresses or message contents; it only logs that it started or stopped.

Hiding even this short-lived information would need onion routing (like Tor), which adds too much delay for live calls.

What stays on your device

Apps (Android, Windows, Linux): your identity keys (in the system keystore), and an encrypted file with your profile, contacts, call history and notes, settings and guest links. History is deleted after the period you choose in Settings (30 days unless you change it). Backups are files you create and keep yourself, encrypted with your password.
Browser: nothing is kept after you close the tab, unless you choose "Remember me on this browser". Then the same data is kept in the browser, encrypted with a key the browser cannot export.

What other people see

The person you call sees the name in your profile (or the name you type as a guest), and your Sotto ID. A name that isn't verified is marked "not in your contacts".
When a call connects directly, the two devices learn each other's IP address. With "Hide my IP address" on, calls always go through the relay, so the other person never sees yours.

Other services the apps contact

Update check: once a day the Android, Windows and Linux apps ask GitHub (the site that hosts Sotto's releases) whether a newer version exists. GitHub sees your IP address. You can turn this off in Settings → Updates. The browser never checks.
Connection helper: only if a server offers no STUN/TURN service of its own (this one does), the app asks Google's public STUN server for your public IP address, to find a direct path.
Diagnostic report: the app never sends it. You can see it and copy it in Settings → Help, to give to whoever helps you. It contains no names, contacts, call partners, links or keys.

Recording

Sotto does not record calls.

Your choices and rights

Because this server keeps nothing about you, there is nothing on it to access, correct or delete. Your data is on your device: you can delete history entries, contacts and links in the app, use "Forget this browser", or remove the app. For any question about this server, contact its operator (above).

Changes

If Sotto starts processing anything new, this page will say so before it happens.

See also the terms of use. Sotto is open source (AGPL-3.0): anyone can check what it does.