— Document

Privacy policy

Last updated: 2026-10-27

Controller under the GDPR: Balane GmbH · Balanstraße 84 · 81541 Munich · Germany Commercial register: HRB 301320, Amtsgericht München · VAT ID: DE455102718 Represented by the managing director Jonas David Höttler support@balane.tech

Balane Dialog is the Balane Office app for team conversations, for macOS, iOS, iPadOS, Android and Windows. It works without a server and without an account: the participants' devices exchange rooms and messages directly, end-to-end encrypted. Because that needs a network, this policy describes exactly who sees what. The app only uses a provider service for notifications on iPhone, iPad and Android, and only if you switch them on (section 6).

1. Identity and devices

Your identity is a key the app creates on the device; it is kept in the operating system's secure storage. Members of your rooms see the name you enter during setup together with a short identifier of your device. You pair further devices of your own with a code. There is no account, no phone number and no email address.

2. Rooms and messages

Every message is end-to-end encrypted with Olm and Megolm and signed by its sender. Only the members' devices can read it. On each device the history is kept in an encrypted store in the app's own folder, whose key sits in the operating system's secure storage.

  • Anyone who pastes an invitation (as text or QR code) makes a request; the room admin approves or declines it. New members only see earlier history if the room allows it.
  • Members see who is online, along with delivery and read receipts.
  • If you retract one of your own messages, its text is deleted on the members' devices as soon as they receive the update.
  • Files go to the members' devices encrypted, in parts.
  • A backup is written, encrypted, to a place you choose; it can only be opened with the recovery key the app shows you for it.

The provider is not responsible for the content members share in a room and has no access to it.

3. Network: who sees what

While the app is running, the device is reachable through the open-source network Iroh.

  • Devices find each other through the public Mainline DHT, a distributed directory run by many independent computers. There the app publishes the device's identifier and the address of its relay, not its IP address. The DHT nodes the device talks to see its IP address.
  • Devices connect directly where possible; the members' devices then see each other's IP addresses. On the same network this can happen locally, which is why iOS asks for access to the local network and macOS may ask about incoming connections.
  • If no direct connection can be made, relay servers pass on the encrypted data: by default the public relays of n0, the developer of Iroh, or only your own relays if you switch the public ones off in the settings.
  • Relays and DHT nodes see IP addresses and connection times, never content.
  • You pass on the invitation yourself, by a route of your choice; what the service you use for it processes follows that service's terms.

4. Anchor (optional)

A team can set up an always-on device as an anchor. It keeps rooms available in encrypted form and passes them on when nobody else is online. The anchor cannot read the content. It is run by your team, not by the provider.

5. Translation (optional)

Translation only happens if you add your own DeepL key; it is kept in the operating system's secure storage. The text of the messages you have translated, together with protected terms from the glossary, then goes directly from your device to DeepL (DeepL SE, Germany). The terms of your contract with DeepL apply; for free keys (DeepL API Free) they may differ from those of paid plans. Translations shared in the room go to the members encrypted. For a room you can specify that its content goes to no translation service; Balane apps respect that.

6. Notifications on iPhone, iPad and Android (optional)

Notifications while the app is closed are off by default. They need a wake-up service whose address you enter in the settings; the provider runs one at wecken.balane.tech. When you switch notifications on, the system asks for your permission and the app registers the device with the wake-up service.

  • Per device, the wake-up service stores: a push token from Apple (APNs) or Google (Firebase Cloud Messaging), the platform, the language, the app's identifier, the identifiers of your rooms, a hash of the device secret and the date of the last registration; per room, a wake-up key. No content, no names, no member lists, no IP addresses. It briefly keeps IP addresses in memory to limit requests.
  • When you send a message, the app asks the wake-up service to wake the room's other devices. Apple or Google see the token, the time, a room identifier, a counter and a fixed text (“New message”), but neither the sender nor the content.
  • On Android the app uses Firebase only to obtain the token.
  • If you switch notifications off, the app unregisters the device. The service removes invalid tokens itself, and registrations that aren't renewed lapse after 60 days.
  • If you enter a different wake-up service, its operator is responsible for the processing.

The legal basis for the provider's wake-up service is providing the feature you switched on (Art. 6(1)(b) GDPR). There are no remote notifications on the desktop; the app syncs when you open it.

7. App lock and biometrics

If you like, an app lock protects the app with a code. Only a hash of it (PBKDF2 with a random salt) is stored, in the operating system's secure storage. Face ID, Touch ID, Windows Hello or a fingerprint are checked by the system; the app never sees biometric data, the system only reports whether unlocking succeeded. With “Hide previews” the app shows no content in notifications and preview images.

8. Distribution, updates and store data

The app is distributed through the App Store (Apple), Google Play (Google) and the Microsoft Store (Microsoft). Downloads, installation and updates run through the respective store; the app does not check for updates itself. The store operators process data as independent controllers under their own terms, including crash reports if you have allowed sharing them in your system settings. In the store consoles the provider sees aggregated statistics (such as download counts) and the crash reports you share with developers; these don't tell the provider who you are.

9. No analytics, no telemetry

The app contains no analytics, tracking or crash-reporting libraries. It sends no usage data to the provider, aggregated or otherwise, and there is no account.

10. Your rights

Through its wake-up service, the provider processes the data listed in section 6. For that data you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a supervisory authority. The simplest way to delete your registration is to switch notifications off; otherwise an email to support@balane.tech is enough. Beyond that, the provider receives no personal data through the app. For email or form support requests, the general privacy policy of this website applies: https://www.balane.app/en/privacy

You remove your local data by uninstalling the app. Depending on the system, entries in the operating system's secure storage may remain in the keychain afterwards.

Back to Balane Dialog