Controller and contact
Enfermatiko, LLC operates PEZ4 as a platform of the Enfermatiko Network. This policy describes the implemented beta, not every feature in a future roadmap. For privacy questions or requests, email [email protected] with PEZ4 in the subject, or use the authenticated support channel to @p1. Do not send private keys, TOTP seeds, passwords or invitation codes. We may need a safe ownership check before account-specific action.
Account and relationship information
The service holds handles and aliases, public signing/encryption keys, key enrollment/revocation metadata, device labels, hashed session credentials, action proofs, invitation hashes/expiry/usage, contact/block/follow relationships, privacy rules, profile status/visibility and picture hashes. It records policy acceptance version/time and declared adult eligibility. Signup does not require a phone number, email address, legal name, date of birth or government ID. Support email is voluntary and separate from registration.
Aliases are routing names for the same account. Resolving an active alias can reveal its primary handle. Follow counts do not disclose a public list of follower identities through this beta. The system account is represented as following accounts for service purposes; ordinary users cannot follow it back. New accounts initially follow @p1 and may unfollow it.
Private chat, pictures and local collections
Ordinary one-to-one message bodies, picture delivery and one-view images use recipient-device encryption. The courier receives ciphertext plus routing/proof/timing/expiry metadata; ordinary queued deliveries expire after at most 48 hours. This protocol is not a Double Ratchet and does not promise post-compromise security or recipient forward secrecy. A compromised endpoint or altered same-origin application can access content that the endpoint can decrypt.
Read chat history, drafts, selected saved Tin Vault messages and the owner's profile picture use encrypted browser storage tied to that enrolled key. Unopened one-view pictures are stored encrypted locally until consumed, expired or removed. Viewing consumes the local encrypted copy before display; screenshots, recording and modified recipient software cannot be prevented. Only one selected prepared recipient browser receives a one-view image. Other recipients' downloads and previously received copies remain under their control.
Tin Vault, drafts and ordinary local history are not automatically copied to a server backup or another browser. Browser storage removal can permanently lose them and the keys needed to decrypt them. Hungry Whales in this beta removes local vault records for the selected key/browser; it does not promise physical secure erasure or deletion from other people's devices.
Calls, files and remote sessions
Screen/call negotiation is signed and encrypted between enrolled endpoints. Media and selected file bytes use encrypted WebRTC transports directly between peers, or through the configured PEZ4 TURN relay where available. The service and network providers can still observe routing, timing and traffic metadata. Direct peer connections may reveal network addresses to the other endpoint. PEZ4 does not record the live media in this release; a participant may independently capture it.
Native viewing stores a paired key's public metadata, owner, label and broad platform. Its signing key is encrypted locally with a user-chosen passphrase; its session token and fresh Can Opener seed stay in memory. The server routes an encrypted signed PIN envelope and local approval state, not the clear PIN or seed. The selected monitor is captured only after correct code verification and explicit local approval. A global Escape hotkey is used to stop sharing. No shell, keyboard/mouse control, filesystem or audio capture is enabled by this native beta.
Server-readable data
Profile status, visibility metadata, business name/logo/palette, public release notes and legal-version records are server-readable. Business branding is shown to holders of a valid invited-client link subject to account and entitlement checks. Support reports, comments, statuses, reviewed capability summaries and operator notes are readable by the submitting account and the @p1 support operator/service. They are not ordinary end-to-end encrypted chat. Masking assists review but does not detect every secret; submit only what you intend the operator to read.
Infrastructure, cookies and external providers
The application uses TLS and fixed PEZ4 service endpoints. Cloudflare proxies the apex/www website and may process addresses, request/security metadata and website traffic under the operator's configuration. DNS-only signal/TURN records do not mean that connections are anonymous. Hosting, DNS, network and email providers may process operational data. Web-server/reverse-proxy logs can contain IP addresses, user agents, paths, times and response codes; log retention is controlled separately by the server operator.
The ordinary app keeps its bearer in tab memory, display preferences in localStorage when explicitly saved, and a code-free branded display snapshot in sessionStorage. IndexedDB holds keys and encrypted local collections. The separate enabled Founder administration page may use an essential CSRF/session cookie. This beta adds no advertising tracker, third-party analytics, public CDN runtime script or payment processor. It does not sell personal information or share it for cross-context behavioral advertising as part of the implemented app. Mandatory network security behavior may still be applied by infrastructure providers. See Cookies & Local Storage.
Retention and deletion limits
Live courier ciphertext expires within 48 hours. Screen invitations last up to five minutes and sessions up to ten minutes; call/file rooms have their documented one-hour maximum and expired-room metadata is cleaned after a short recovery window. Support threads expire 90 days after their latest update; individual system events expire after 90 days and the mailbox is also size-bounded. Active account/key records, relationship settings and saved brand/profile metadata remain while needed to operate the account. Revoked-key and acceptance/security records may remain for fraud prevention, ownership continuity or legal obligations. Retired aliases are reserved for 1,095 days.
Server backups and security logs are managed separately and can retain historical records until rotated by the operator. Live expiry does not instantly erase every backup, disk block or recipient copy. Restoring a backup requires reapplying current expiry/deletion decisions. Contact us about access, correction, export or deletion requests and applicable rights. There is no automatic account deletion or native filesystem wipe in this beta. We may retain information needed for legal obligations or to prevent impersonation and explain the relevant limit when responding.
Security, international use and children
We use access checks, proof-bound writes, TLS and the stated encryption boundaries, but no system is perfectly secure. We will assess and respond to incidents and give notices when required by applicable law. PEZ4 is operated by a United States company; using it from another country can involve international processing. We do not claim certification under a data-transfer framework or universal legal compliance. Applicable statutory rights are not waived by using the service.
The current beta is restricted to adults aged 18 or older. It is not offered as a children's service or a parental-consent program. If you believe a minor registered, contact us so we can investigate and take appropriate action. The adult declaration is not an identity-verification service. Material policy changes will carry an updated version and app notice.