Privacy Policy

Last updated: 9 October 2026

Your circle. One place. This policy explains how Halo handles information when you use its chats, groups, calls, games and related features at call.listsite.online. Halo is operated by Dev, an independent developer based in India. For privacy questions or requests, email halo@listsite.online.

1. Account and profile information

Halo processes the email address, phone number where supplied or required, country, display name, username, profile image, bio, language and preferences you provide. Account records include verification status, linked sign-in providers, contacts, invitations, group membership and roles. Passwords are stored as password hashes, rather than readable passwords. Account email and phone fields are encrypted on the server and have separate keyed lookup values. This server-side encryption is different from end-to-end message encryption.

This information enables registration, sign-in, account recovery, profiles, discovery, contacts and groups. Profile information you choose to share can be visible to other users through those features. Your account email and phone number are not displayed as contact-profile details.

2. Google and Telegram sign-in

If you choose Google sign-in, Halo requests basic identity scopes (openid, email and profile). It processes your Google account identifier, name, email address and email-verification information to authenticate you, suggest signup details and link the correct Halo account. A keyed hash of the provider identifier is stored with your Halo account. Temporary authentication and signup records are also stored. Halo's Google sign-in does not request Gmail messages, Google contacts, Drive files or calendars.

If you choose Telegram sign-in, Halo requests identity, profile and phone scopes. It processes the identifier, name and phone information supplied by Telegram for sign-in, signup and account linking. You can review provider permissions and revoke Halo's access in the provider's settings. Revoking provider access does not automatically delete your Halo account or information already stored by Halo.

Google and Telegram process your use of their sign-in services under their own privacy policies. Halo uses Google identity information for its account features and related security and support, rather than advertising or data resale.

3. Conversations, attachments and statuses

Direct and group messaging features use device-based encryption keys and encrypted message envelopes. The server stores encrypted delivery data and routing metadata, including sender and recipient identifiers, group identifiers, timestamps, message identifiers, public device keys, delivery and read receipts, and deletion events. Encrypted attachments may be temporarily stored for delivery. The server does not receive the device private keys through these messaging routes.

Encryption does not hide all metadata or every feature. Profiles, group names and images, membership, notification events and server-hosted statuses are separate from encrypted conversation content. Server-hosted status media, captions and viewer records are processed on the server and should not be treated as end-to-end encrypted messages. Information you share is available to its recipients; they can save or copy it.

4. Calls, translation and games

Calls use browser media permissions and WebRTC. Halo processes call invitations, signaling, connection information and call state to connect participants. WebRTC peers and connection services may process IP addresses and network information. The app uses Google and Cloudflare STUN services and can use relay services when configured. Browser microphone, camera and screen-sharing permissions control the media you share.

When you use translation, the text or recognized speech segments to be translated are sent to Halo's translation backend and may be sent to the MyMemory translation service. Translated results can be temporarily cached. Browser speech recognition and speech synthesis may use your browser or operating-system provider's services. These optional processing paths are separate from encrypted messaging; avoid translating information you do not want those services to process.

Games process invitations, participants, moves and game state so you can play together. Local call history, game state and preferences may be retained on your device.

5. Device storage, permissions and notifications

Halo uses session and authentication cookies to keep sign-in secure. Browser local storage and IndexedDB hold preferences, device keys, cached conversations and other local app data. Clearing site data can remove local history or encryption keys and may make old content unavailable. Signing out is not the same as clearing all browser data.

If you enable notifications, Halo stores device registrations, push subscriptions or tokens, notification preferences and event metadata. Browser push services and, where Android push is enabled, Firebase Cloud Messaging deliver notifications. Notifications can reveal that a message, call or invitation exists, and call notifications can include a contact's display name. You can disable notifications in your browser or device settings.

Passkey features store public credential information needed for authentication. Your authenticator manages the private passkey; Halo does not receive your device unlock PIN or biometric template.

6. Hosting, other services and support

HostArmada hosts Halo. Hosting and email-delivery infrastructure processes information needed to run the app and deliver account-security emails. Email templates include a remotely hosted Halo logo; if your email client loads it, Halo hosting receives an image request and associated connection information. Depending on the feature, other recipients of information include your chosen contacts and group members, Google or Telegram for sign-in, browser and network services for calls, notification providers, and translation services.

The website loads fonts from Google Fonts. GIF search and media may use KLIPY and Wikimedia Commons. These services can receive requests, searches or connection information when used. Third-party services have their own privacy policies.

Halo also processes IP addresses, request and error information, security events and registration-support records to operate, diagnose and protect the service. If you contact support, we process the information you send to respond. Information may be disclosed where required by applicable law or necessary to investigate misuse and protect the service.

7. Retention and deletion

Account, profile, contact and group records are retained to provide the account features. Temporary authentication records have expiry times. Current direct and group encrypted delivery queues and attachment delivery records use seven-day expiry windows; direct attachment copies can be removed sooner after delivery acknowledgement. Status records use a 24-hour expiry window. Expiry limits availability, while physical deletion occurs through cleanup processes and can follow later.

Device copies, recipients' saved content, operational logs and hosting backups have separate lifetimes. Deleting a message or allowing it to expire does not guarantee immediate removal from backups or from a recipient's device. Halo does not promise that all data disappears immediately after a deletion request.

8. Your choices and privacy requests

You can change available profile and privacy settings, manage contacts and groups, revoke provider permissions, turn off browser permissions, and clear local site data. To request access, correction, account deletion, withdrawal of consent, or raise a privacy complaint, email halo@listsite.online. Include enough information to identify your account, but never send your password, verification codes or private encryption keys. We may ask you to verify account ownership before acting on a request. Applicable legal requirements can affect what information must be retained.

9. Security and international processing

Halo uses safeguards including HTTPS, password hashing, account-field encryption, authentication checks and encrypted messaging. No system guarantees complete security. Services and infrastructure may process data outside your country; the operator is based in India. A recipient's device, optional translation and other integrations have their own security and processing behavior.

10. Children and updates

If you are a parent or guardian concerned that a child has provided personal information to Halo, contact halo@listsite.online so we can investigate and address the request. This policy may be updated as Halo's features and data practices change. The current version will be available on this page with its update date.