Back to the home page

Privacy notice

Last updated: 4 October 2026

This notice explains which personal data Walkie Link processes, why and for how long, under Regulation (EU) 2016/679 ("GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003). In short: you have no account, we use no cookies or tracking tools, we cannot see the content of your messages and files, and the only thing our server keeps on disk is anonymous, aggregate statistics.

1. Data controller

iDev S.r.l., registered office at Via Luigi Goia 102, 27036 Mortara (PV), Italia, VAT number 02656830185. For any privacy request: privacy@walkielink.app Certified email (PEC): idevsrl@pec.it

2. Data that stays on your device

Your personal code, secret keys, nickname, contacts, conversation history (including the voice messages you send and receive), received files and settings are saved only in your browser, in the site's local storage. iDev does not receive them and cannot read them. You can delete them at any time with "Delete everything" in Settings or by clearing the site data in your browser. If you use the camera to read a QR code, the image is processed only on your device and is not sent to anyone. The microphone is used only when you press the button to record a voice message: the recording happens only on your device, only the people you send it to (in groups, the members) can listen to it, we cannot, and the voice is not processed to recognise people.

If you are in a group, your device also stores the group invitation link (whoever obtains it can join the group), the list of members with their codes and the group history. Groups are not included in the backup file.

3. Data processed by our server

The server helps devices find each other and, when needed, passes encrypted chat messages and short voice messages along. It processes only the data below, only in working memory (never on disk and never in logs), and forgets it within the times stated:

  • Your device's IP address: used to connect you, to tell your device its public address (needed for the direct connection) and to enforce anti-abuse limits. It stays in memory for the duration of the connection; usage counters tied to your network (the IP address or the address block it belongs to) are deleted within 24 hours at the latest.
  • Personal code and public keys: sent to the server when you open the app, to prove that the code is yours and to let others contact you. They stay in memory only while you are connected.
  • Connection data: which code is looking for which other code, contact requests and replies (which contain codes and public keys, but not the nickname) and the technical data for setting up the direct connection, which are encrypted. The server passes them on without keeping them; it only remembers that two codes are in contact, until 10 minutes after their last exchange or until one of them disconnects.
  • Messages going through the server when a direct connection is not possible: chat messages, including group ones, short voice messages (up to 30 seconds) and group service messages (member list, version of the group keys, recovery of missed messages and voice messages). They are encrypted so that only the two people connected (in groups, two members of the group) can read them. The server passes them on and forgets them; it sees who is talking to whom, when and how much you write (the rounded size of the messages), but not what; from the size and rhythm of the data it can guess that a voice message went through and roughly how long it was, never its content. No file ever goes through the server.
  • Groups: a code derived from the invitation link, which lets members find each other but does not reveal the group or its name to the server. It stays in memory as long as at least one member is connected.
  • Usage counters (number of requests and volume of messages per code, per pair of codes and per network): used only to enforce limits and deleted within 24 hours at the latest.

The server keeps no access logs. A server restart erases all data in memory. The anonymous, aggregate statistics are described in section 4.

4. Anonymous usage statistics

To assess how the Service is used, we collect anonymous, aggregate statistics: the number of connected users, an estimate of active users per day, week and month, the number of new personal codes created, the number of contact requests and the amount of data that went through our server. To estimate active users, the server temporarily transforms your personal code with a random key that is destroyed at the end of each day, week or month, and it never keeps the code, the IP address or any other data that could identify a person. We do not measure files, nor the messages and direct connections between devices, which do not go through our servers; for messages that do go through the server, always encrypted, we count only the total amount. Aggregate data is kept for at most two years on our server, can be viewed only by authorised iDev staff and is not shared with third parties.

5. Data visible to the other person

When you connect, your device and the other person's exchange the IP addresses needed for the direct connection: the other person can therefore see your IP address. They also receive your code, your public keys, your nickname and, of course, the messages and files you send them. Walkie Link does not make you anonymous.

In groups the same applies to every member your device connects to: the members online see your code, your public keys and your IP address even when you open the app without writing anything, because the groups you are in reconnect by themselves. The messages, voice messages and files you share in the group reach all its members; a member who already received one of your voice messages can deliver it, over their own connection, to the other members of the group who don't have it yet: the content stays the one you recorded (every device checks it). If two members can't connect to each other, messages can arrive through another member, who sees them like every member of the group but cannot change them, or, if nobody connects them, through our server, which cannot read them (section 3).

6. Purposes and legal bases

  • Providing the Service you requested (connecting you, letting devices find each other, passing on contact requests and encrypted messages): performance of the contract formed by the Terms of service (Art. 6(1)(b) GDPR).
  • Protecting the Service and its users from abuse, attacks and overload (usage limits and counters): legitimate interest of iDev and of the users in the security and operation of the Service (Art. 6(1)(f) and Recital 49 GDPR).
  • Assessing how the Service is used, with anonymous, aggregate statistics (section 4): legitimate interest of iDev in knowing how the Service is used in order to run and develop it (Art. 6(1)(f) GDPR).
  • Answering your requests and reports: performance of the contract or legitimate interest, as the case may be.
  • Complying with legal obligations and lawful requests from authorities (Art. 6(1)(c) GDPR).

7. Browser storage and cookies

Walkie Link uses no cookies and no analytics, advertising or tracking tools, either its own or third-party ones, and loads no resources from other sites. The statistics described in section 4 are computed by the server alone, without using anything in your browser. It uses the browser's local storage only to keep the data described in section 2 and the application files, because they are strictly necessary to provide the Service you requested (Art. 122 of the Italian Personal Data Protection Code): no consent is therefore needed.

8. Retention

  • Data on the server: in memory only, for the times stated in section 3 (at most 24 hours for usage counters); it is never written to disk.
  • Anonymous, aggregate statistics (section 4): at most two years; the random keys used to estimate active users are destroyed at the end of each day, week or month.
  • Data on your device: until you delete it.
  • Emails you send us (requests, reports): for as long as needed to handle them and, where necessary, to protect iDev's rights or comply with legal obligations.

9. Recipients and place of processing

The server is located in a data centre in the European Union provided by IONOS SE, which acts as a processor on behalf of iDev (Art. 28 GDPR). iDev does not transfer data outside the European Union, does not sell it and does not disclose it to third parties, except where required by law (for example an order from a judicial authority, to which we could only provide the little data that might be in memory at that moment). The messages and files you send reach the person you are talking to, wherever they are: that is the Service you requested. We do not use data for profiling or automated decision-making.

10. Your rights

You have the right to request access to your data, rectification, erasure, restriction of processing and portability, and to object to processing based on legitimate interest (Arts. 15–22 GDPR), by writing to privacy@walkielink.app. Please note that the server keeps no data that could identify you and deletes it quickly: in many cases we will have no data about you to show or delete (Art. 11 GDPR). You manage the data on your device yourself.

If you believe the processing infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the supervisory authority of the European Union country where you live, work or where the alleged infringement took place.

11. Minors

Walkie Link is reserved for people aged 14 or over, as stated in the Terms of service.

12. Changes

We may update this notice. The version in force is always on this page, with the date of the last update.