signal.org privacy policy — score 72/100 (medium risk)
Última análise
O conteúdo do relatório (resumo, conclusões, citações) foi gerado em inglês e não está localizado.
Signal Messenger LLC · signal.org
Detalhes do relatório
medium riscoSignal genuinely collects almost nothing and encrypts everything, but its legal documentation is outdated and missing critical GDPR-mandated disclosures like transfer safeguards, retention periods, and user rights procedures.
Signal's architecture and data practices are among the most privacy-friendly in the industry—end-to-end encryption by default, no data monetization, and minimal collection. However, the privacy policy has not been updated since May 2018 and lacks formal GDPR compliance elements: no description of data subject rights, no legal bases for processing, no retention periods, no DPO contact, and no mention of appropriate safeguards for US transfers. The mandatory California jurisdiction clause is also problematic for EU consumers.
Avaliação por categoria
Repartição da política pelas principais áreas de conformidade. Bom = sólido, razoável = misto, fraco = preocupante.
Only the phone number is mandatory; profile data is optional and end-to-end encrypted; technical metadata is limited to the minimum required to operate the service.
The policy is clear about encryption and what is collected, but lacks retention periods, legal bases for processing, and has not been updated since May 2018.
Sharing is limited to verification code providers and optional third-party services like Giphy, but no subprocessor list is provided and no contractual safeguards are described.
Data is explicitly transferred to the US and other countries, but no GDPR-compliant transfer mechanism (SCCs, adequacy decision, BCRs) is mentioned anywhere in the policy.
The policy is silent on AI training, but Signal's firm no-monetization stance and minimal data collection make it unlikely; however, it is not explicitly prohibited.
No explicit description of GDPR rights (access, rectification, deletion, portability, objection, restriction); only a vague reference to managing info in app settings.
Conclusões principais
Cláusulas relevantes, problemas ou boas práticas identificadas (críticas primeiro)
No GDPR transfer safeguards for US data flows
The Terms state users agree to 'the transfer of your encrypted information and metadata to the United States and other countries where we have or use facilities, service providers or partners,' but the policy mentions no Standard Contractual Clauses, adequacy decisions, or Binding Corporate Rules. Post-Schrems II, this is a significant compliance gap for EU users.
GDPR data subject rights are not described
The privacy policy does not enumerate or explain any GDPR rights (Articles 15–22): no right of access, rectification, erasure, restriction, portability, or objection. The only mention is that users can 'manage your personal information in Signal's application Settings,' which is insufficient under GDPR Article 13(2)(b).
No data retention periods specified
The policy states that support data is 'kept only for the purposes of researching the issue' and that technical information is 'limited to the minimum required,' but no specific retention periods are provided for any data category, as required by GDPR Article 13(2)(a).
Mandatory US jurisdiction clause conflicts with EU consumer rights
The Terms require disputes to be resolved exclusively in 'the United States District Court for the Northern District of California or a state court in San Mateo County, California,' which may be unenforceable against EU consumers under the Brussels I Regulation and is inconsistent with GDPR Article 79(2).
Privacy policy outdated — last updated May 2018
The privacy policy has not been updated since May 25, 2018, raising questions about whether it reflects current data practices, third-party relationships, and regulatory requirements that have evolved since then.
No legal basis for processing specified
The policy does not identify the legal basis under GDPR Article 6 for any processing activity (e.g., contract performance for account registration, legitimate interest for security), as required by GDPR Article 13(1)(c).
Third-party providers lack contractual detail
The policy mentions 'Third-Party Providers' that send verification codes and states they 'are bound by their Privacy Policies to safeguard that information,' but does not name them, describe contractual safeguards, or provide a subprocessor list as expected under GDPR accountability principles.
Strong no-monetization commitment
The Terms explicitly state: 'Signal does not sell, rent or monetize your personal data or content in any way – ever.' This is a strong, unqualified commitment that goes beyond typical industry language.
Resumo para o utilizador
Your messages and calls are genuinely private and encrypted, but if you need to exercise GDPR rights or want clarity on how your data moves to the US, the policy leaves you without clear answers.
Postura de conformidade
Strong on technical privacy, weak on legal documentation. The substance is excellent but the formal GDPR compliance framework is incomplete.
Transferências UE
The Terms explicitly acknowledge transfers to the US and other countries but mention no GDPR transfer mechanism (SCCs, adequacy decision, or BCRs). This is a significant compliance gap post-Schrems II.
Sinais detetados
Dados e práticas específicas identificadas no texto
Fragmentos de evidência
Citações diretas da política que suportam estas conclusões
Signal does not sell, rent or monetize your personal data or content in any way – ever.
you agree to our data practices as described in our Privacy Policy, as well as the transfer of your encrypted information and metadata to the United States and other countries where we have or use facilities, service providers or partners.
You can manage your personal information in Signal's application Settings. For example, you can update your profile information or choose to enable additional privacy features like a Registration Lock PIN.
Signal limits this additional technical information to the minimum required to operate the Services.
You agree to resolve any Claim you have with us relating to or arising out of our Terms, us, or our Services exclusively in the United States District Court for the Northern District of California or a state court in San Mateo County, California.
These providers are bound by their Privacy Policies to safeguard that information.
Em falta ou pouco claro
- No GDPR legal bases for processing
- No data retention periods
- No subprocessor list
- No DPO contact information
- No GDPR transfer mechanism (SCCs, adequacy, BCRs)
- No explicit AI/model training policy
- No cookie or tracking technology disclosure
- No DPIA references
- No data breach notification procedure
- No explicit GDPR rights enumeration
Perguntas a fazer
- What Standard Contractual Clauses or other transfer mechanisms does Signal rely on for EU-to-US data transfers, and can you provide the relevant documentation?
- What are the specific retention periods for each category of data you collect (phone numbers, technical metadata, support data)?
- Who are the 'Third-Party Providers' that process verification codes, and what contractual data protection obligations do they have beyond their own privacy policies?
- How can an EU user exercise their GDPR rights (access, erasure, portability, objection) — is there a dedicated process or contact beyond the general privacy@signal.org email?
- Has Signal conducted a Data Protection Impact Assessment for its contact discovery feature, given that it involves hashing and transmitting address book data?
- Why has the privacy policy not been updated since May 2018, and does it accurately reflect all current data processing activities and third-party relationships?
Partilhar esta análise
Qualquer pessoa com esta ligação pode ver o resultado acima.
Criado pela DentroChat
Chat de IA 100% europeu para todos
Converse com IA, trabalhe com ficheiros, gere imagens e pesquise na web. Os dados permanecem na Europa.