KocaXNetwork ← Back

Privacy Policy

Last updated: 19 July 2026

1. Who we are

KocaXNetwork (“we”, “us”) operates the end-to-end encrypted messenger available at https://kocax.nl (“the Service”).

We designed the Service so we see as little as possible.

Account data (you provide):

End-to-end encrypted content:

Messages, attachments, and keys are encrypted on your device before reaching our servers. We cannot read them and do not have access to your encryption keys.

Technical / metadata:

Public key bundle (so others can address messages to you)
Server-side timestamps of message relay (for delivery + rate-limiting)
Standard server logs (IP, user agent) kept only as long as needed to operate the Service securely

Invites and requests:

“Request a key” submissions: the alias and contact info you type, and your IP address (for spam protection)
Issued keys and which accounts they unlock

Safety reports:

If you report abuse, we store the reporter identity, reported identity, selected reason, optional details, timestamp and IP address needed to review the report.

We do not collect: message content, contacts, location, analytics, advertising data, or any third-party tracking data.

Service provision and authentication: Art. 6(1)(b) contract
Abuse prevention, safety reports, security, rate-limiting: Art. 6(1)(f) legitimate interest
Optional fields (status, avatar): Art. 6(1)(a) consent (withdrawable by clearing the field)

We do not sell or share your data with advertisers, analytics providers, or social networks.

Limited sharing required to operate the Service:

Hosting provider: Local self-hosted / private VPS in the EEA
Other users: Your public key bundle, so they can address messages to you
Authorities: Only where legally compelled, and only to the extent required. Encrypted message content will not be intelligible to us or to them.

All data is stored and processed within the European Economic Area (EEA). We do not transfer your data outside the EEA.

You can, at any time:

Access your personal data (Art. 15)
Correct it (Art. 16)
Delete it / close your account (Art. 17)
Restrict or object to processing (Art. 18, 21)
Receive your data in a portable format (Art. 20)
Withdraw consent where processing is consent-based (Art. 7(3))
Lodge a complaint with your data protection authority (Art. 77). In the Netherlands: autoriteitpersoonsgegevens.nl

To exercise any of these rights, use the in-app account deletion option, visit https://kocax.nl/delete-account.html, or email info@kocaexpress.com.

All traffic encrypted in transit (TLS 1.2+)
Message content end-to-end encrypted on your device using authenticated symmetric encryption
Private keys stored locally on your device, never sent to us in plaintext
Account sign-in never sends your password: your device runs it through PBKDF2-SHA-256 and sends only a derived verifier, which the server compares in constant time. Your password and master key never leave your device
Your private keys are held on our servers only as a blob encrypted on your device with a key derived from your password and master key — we cannot read it, and cannot reset your password or master key for you
Digital signatures (ECDSA P-256) authenticate users’ key bundles and messages between devices — a separate mechanism from signing in

The Service does not use tracking cookies or third-party analytics. It uses:

These are strictly necessary for the Service to function and are not used for tracking.

For any privacy question, email info@kocaexpress.com.