Privacy Policy
Your privacy is our priority. Learn how we collect, use, and protect your information with transparency and respect for your rights.
Last updated: May 2026Data Protection
Your personal information is encrypted and securely stored
Transparency
Clear information about what data we collect and why
Privacy Rights
Full control over your data with GDPR and CCPA compliance
User Consent
You decide what information to share with us
Privacy Policy
Welcome to Public!
At Public, accessible from https://public.kim, one of our main priorities is the privacy of our visitors. This Privacy Policy document describes the types of information collected and recorded by Public across our website, mobile applications (iOS and Android), and desktop applications (including our Windows App), and how we use it.
Important Notice
If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us. This Privacy Policy applies to all our online activities and applications across web, mobile, and desktop.
Consent
By using our website or applications (including our Windows, iOS, and Android apps), you hereby consent to our Privacy Policy and agree to its terms.
Information We Collect
We collect information you provide directly to us and information we obtain automatically when you use our services. All data collection is encrypted in transit for your security.
Personal Information
- •Name: Required for account functionality
- •Email Address: Required for account management (not shown on your public profile)
- •User IDs: Required for app functionality
- •Address & Location: Address, current city, or hometown you choose to add to your profile (optional)
- •Verification phone: Optional, for security (not shown on your public profile)
- •Optional profile details: Nickname, pronouns, date of birth, gender, bio, work, education, languages, hobbies, interests, places travelled, website, relationship status, and public contact info you choose to add — see "Optional profile information" below
Financial Information
- •Payment Info: Securely processed by third-party payment gateway (PayPal) for subscriptions and premium features. We do not store raw payment card numbers on our servers.
- •Purchase History: For account management and analytics
Content & Media
- •Photos & Videos: Content you upload and share
- •Messages: In-app communications and chat history
- •User-Generated Content: Posts, comments, and interactions
- •Files & Documents: Content you upload to our platform
App Activity & Technical Data
- • App Interactions: How you navigate the app
- • Search History: In-app searches for personalization
- • Device IDs: Advertising ID, push notification token, and install referrer for attribution, analytics, and fraud prevention
- • Crash Logs & Diagnostics: Firebase Crashlytics, stack traces, and performance telemetry to improve stability
Data Collection Methods
We support multiple account creation methods including email/password, OAuth (Google Sign-in), and other authentication methods. Some data collection is required for core functionality, while other data is optional.
Optional profile information
Public lets you add voluntary profile details after signup (on web, Windows, Android, and iOS). These prompts are never required — you can skip them or leave fields blank.
What you may optionally provide
- •Names: Nickname, other names, maiden or former name
- •Identity: Pronouns, date of birth, gender, bio, profile photo and cover
- •Places: Current city, hometown, places travelled
- •Work & education: Employer, job title, school, degree, years
- •Personal tags: Languages, hobbies, interests
- •Links & status: Website, relationship status
- •Public contact block: Phone, alternate email, and social handles you explicitly add in profile settings
Visibility: Optional fields you fill in may appear on your public profile to other users. Your login email and verification phone used for authentication are not published on your profile. If you add phone, email, or social links in the public contact section, you are choosing to share them.
We use optional profile data to personalize your experience (for example, people recommendations based on location or interests), display your profile, and improve the service. We do not sell this information to third parties. You can edit or clear any optional field in Settings → About you, or remove all profile data by deleting your account.
Password Vault (End-to-End Encrypted)
Public provides an optional in-app Password Vault that lets you save website credentials (site name, URL, email or username, password, and notes) and sync them across your devices. The vault is designed as a zero-knowledge system: your credentials are encrypted on your device before they ever reach our servers, and we cannot decrypt them under any circumstances.
How your passwords are protected
- • You choose a master password known only to you. It is never sent to our servers and is never persisted on your device.
- • Your master password is run through Argon2id, a memory-hard key-derivation function, to derive a 256-bit key.
- • That key is used only to unwrap a randomly generated vault key, which in turn encrypts every saved credential with AES-256-GCM on your device.
- • Only the resulting opaque ciphertext, the random nonce, and the public KDF parameters are transmitted (over HTTPS) and stored on our servers.
What we store on our servers
- •Encrypted blob: the AES-GCM ciphertext for each saved entry
- •Random nonce: a 12-byte initialisation value per entry
- •KDF parameters: salt, memory cost, time cost, and parallelism
- •Wrapped vault key: your random vault key encrypted by your master-password-derived key
- •Verifier blob: a tiny known constant encrypted with the same key, used by your device to detect a wrong master password
What we cannot see
- •The plaintext of any saved password
- •The websites, apps, emails, or usernames inside your vault
- •Your master password — at any point, on any device
- •Any data that would let us or a third party recover your vault without the master password
Master password is unrecoverable
Because zero-knowledge encryption means we never hold your key, we cannot reset or recover your master password. If you forget it, the encrypted data on our servers becomes permanently unreadable and we will not be able to restore your saved credentials. You can change your master password from within the app while your vault is unlocked; this re-wraps the same vault key without re-encrypting individual entries.
Additional safeguards on your device
- • Vault screens use Android's FLAG_SECURE and Windows desktop security to protect sensitive content from being captured in the app switcher or background thumbnails.
- • Your unlocked vault key is held only in memory and is automatically wiped after a short period of inactivity.
- • When you copy a password to your clipboard on Android or Windows, it is marked as sensitive and automatically scheduled for clearing within 30 seconds.
- • You can delete individual entries or your entire account at any time from within the app.
The Password Vault is an opt-in feature. If you never create a vault, no credential data of this type is collected. The vault is independent of the password you use to sign in to your Public account — the two are stored and protected separately.
Windows App & Device Capabilities
When using the Public Windows App (available via the Microsoft Store or MSIX distribution), the application requests specific device capabilities to deliver a full-featured desktop experience. You can review and revoke any of these hardware permissions at any time through Windows Settings.
Camera & Webcam
Used only when you take photos, record videos, or update your avatar directly within the Windows app. The camera is never accessed in the background.
Microphone
Used only when recording voice messages, audio notes, or media with sound. We never record or listen to ambient audio when voice features are not actively in use.
Windows Toast Notifications
Sends real-time toast notifications for incoming messages, mentions, and friend activity to the Windows Action Center. You can customize banner alerts and sounds or disable notifications via Windows Settings → System → Notifications.
Internet Connection
Connects over encrypted TLS/HTTPS and WebSockets (Socket.IO) to keep your messages, feed, and notifications synchronized in real time.
Local Storage & Container Data
Stores temporary cached media, user preferences, and encrypted offline session state in your local app container (%LOCALAPPDATA%). Uninstalling the Windows app removes all local cached data from your PC.
Desktop Diagnostics & Error Reports
Non-personally identifiable diagnostic and crash logs (such as Windows Error Reporting) are collected solely to troubleshoot stability issues and improve performance on Windows 10 and Windows 11.
Android App & Device Permissions
When using the Public Android App (available on Google Play), the application requests specific device permissions to deliver messaging, multimedia sharing, notifications, and optional mini apps. You can review or revoke any runtime permission at any time through Android Settings → Apps → Public → Permissions.
Camera
Used only when capturing photos or videos for posts, stories, profile pictures, or cover photos within the app. Camera access is strictly user-initiated and is never accessed in the background.
Microphone
Used only when recording audio notes, video posts, or multimedia content. Ambient audio is never recorded when recording features are not in active use.
Push Notifications (Android 13+)
Uses Firebase Cloud Messaging (FCM) to deliver push notifications for incoming direct messages, post reactions, mentions, and community activity. You can customize channel alerts or disable notifications in Android system settings.
Location (Optional for Mini Apps)
Approximate and precise location permissions (ACCESS_COARSE_LOCATION / ACCESS_FINE_LOCATION) are requested solely at runtime when an interactive Mini App explicitly invokes the geolocation bridge. The core social network never tracks or stores your real-time GPS location in the background.
Advertising ID & Attribution
Uses Google Play Services Advertising ID (AD_ID) and the Google Play Install Referrer API strictly for marketing attribution (e.g. referral codes, install campaigns), aggregate analytics, and anti-abuse. You can reset or delete your Advertising ID via Android Settings → Google → Ads.
Crash Reporting & Diagnostics
Uses Firebase Crashlytics and Google Analytics for Firebase to collect anonymous crash traces, NDK stability data, and navigation metrics to diagnose bugs and improve app reliability.
Zero-Knowledge Password Vault Security
On Android, the Password Vault enforces the FLAG_SECURE window flag to protect sensitive data from screenshots and recent app previews, and schedules automatic clearing of copied passwords from the clipboard within 30 seconds.
How We Use Your Information
We collect and share your information for the following purposes, in compliance with applicable data protection laws:
App Functionality
- •Core app features and services
- •User authentication and account management
- •Content delivery and sharing
- •Communication features
Analytics & Improvement
- •App performance monitoring
- •Usage analytics and insights
- •Feature development and testing
- •Bug fixes and improvements
Personalization
- •Customized content recommendations
- •Personalized user experience
- •Targeted content delivery
- •User preference settings
Communications
- • Service updates and announcements
- • Customer support responses
- • Marketing communications (with consent)
- • Important account notifications
Security & Compliance
- • Fraud detection and prevention
- • Security monitoring
- • Legal compliance requirements
- • Platform safety measures
Advertising & Marketing
- • Relevant advertising delivery
- • Marketing campaign effectiveness
- • Promotional content targeting
- • Partner integrations
Data Sharing and User Control
Your Data Collection Choices
Required Data
Name, email, and user IDs are required for core app functionality and cannot be turned off.
Optional Data
Profile details (bio, location, work, education, languages, hobbies, interests, public contact info, and more) are optional. Only provide information you are comfortable sharing on your public profile.
Data Sharing Practices
- • We share data with trusted service providers for app functionality
- • Analytics partners help us improve our services
- • Advertising partners deliver relevant content
- • We never sell your personal data to third parties
Data Processing and Storage
Your data is not processed ephemerally — we retain it to provide continuous service and maintain your account. All data transmission is encrypted for security.
Account and Data Deletion
Request Account Deletion
You have the right to request deletion of your account and associated data. We provide an easy-to-use account deletion process directly in our app settings across web, mobile, and Windows desktop.
Account Deletion URL:
https://public.kim/settings/delete-account-infoVisit this link to learn about the account deletion process and permanently delete your account.
Log Files
Public follows standard procedures for logging server and API activity to ensure platform security, prevent abuse, and maintain operational stability. When accessing our services (via web browser, Android app, iOS app, or Windows app), server logs record client IP addresses, app user agents, timestamps, authentication events, and feature interactions. Client IP addresses are resolved to approximate regional locations (country, state, and city) solely for account sign-in history, security audits, and fraud detection, and are never sold to third parties.
Cookies and Web Beacons
Like any other website, Public uses "cookies" to store information including visitors' preferences, and the pages on the website that the visitor accessed or visited.
The information is used to optimize users' experience by customizing our web page content based on visitors' browser type and/or other information.
Advertising Partners
Some advertisers on our site may use cookies and web beacons. Each of our advertising partners has their own Privacy Policy for their policies on user data.
Google uses DART cookies to serve ads based upon visits to our website and other sites on the internet.
Google Privacy Policy →Your Privacy Rights
CCPA Privacy Rights (California)
- • Request disclosure of personal data categories collected
- • Request deletion of your personal data
- • Opt-out of personal data sales
GDPR Data Protection Rights (EU)
- • Right to access your personal data
- • Right to rectification and erasure
- • Right to data portability
- • Right to object to processing
Children's Information
Another part of our priority is adding protection for children while using the internet. We encourage parents and guardians to observe, participate in, and/or monitor and guide their online activity.
Public does not knowingly collect any Personal Identifiable Information from children under the age of 13. If you think that your child provided this kind of information on our website, we strongly encourage you to contact us immediately.
Contact Us
If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us.
We have one month to respond to your privacy-related requests.
Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. These changes are effective immediately after they are posted on this page.