Privacy and On-Device Translation: What It Protects, What It Doesn’t

On-device translation changes one specific thing: the text of your messages isn’t sent to any cloud translation service, and translations never leave your phone. It doesn’t change the rest: your messages are stored on our servers in Paris, in their original language, and Piou is not end-to-end encrypted. Here’s exactly what happens, with nothing dressed up.

What happens when you send a message

1. You write in your own language. Your phone automatically detects the language of the message.
2. The message travels, encrypted in transit (TLS), to our servers hosted by Supabase in the Paris region (AWS eu-west-3). It’s stored there in its original language, encrypted at rest by the hosting provider, so it can be delivered and synced across your devices.
3. The other person’s phone receives it and, if they have Premium, translates it locally into their language. Without Premium, they see the original.
4. The translation stays on that phone. It’s never sent to our servers.

Every translation engine runs on the device. On iPhone, it’s Apple’s built-in translation (the Apple Translation framework, iOS 18 or later). On Android, it’s Google’s ML Kit, with models downloaded to the phone. In the browser, it’s the open-source Bergamot engine with Firefox Translations models, or Chrome’s built-in translation on desktop where it’s available. No cloud translation API is ever called.

What on-device translation really changes

• No third-party service translates your messages. Your text isn’t handed to an online translation service, which means fewer copies of your conversations out there.
• Translations stay with you. They’re neither sent to nor stored on our servers.
• Translation works offline. Once the language packs are downloaded, messages you’ve already received get translated even in airplane mode, which shows the work happens on the phone.
• Call subtitles aren’t processed by our servers. During a call, each phone transcribes its owner’s voice and sends the text to the other device over the call connection, and that device translates it. The call connection links the two devices directly whenever possible and only goes through a relay when the network requires it.
• Voice messages are transcribed on the device, then translated on the recipient’s phone. The voice message itself is a message like any other, stored on our servers.

What it doesn’t change

• No end-to-end encryption. Your messages are encrypted in transit and at rest with the hosting provider, but not with a key that only you hold. That’s not the same level of protection as an end-to-end encrypted messenger, and we’d rather say so plainly.
• Your messages are stored on our servers in their original language: texts, voice messages, photos, videos and documents. That’s what lets us deliver them, sync them across your devices and keep your history.
• Your phone number is required. It’s verified once at sign-up, for example through a text message you send yourself or a missed call whose last digits form the code. It’s used so your contacts can find you, never to log in: you sign in with Apple, with Google, or with an email address and password.
• Technical providers are involved, as with any online service. They’re listed below.

What we do, and don’t do, with your data

• No ads, no data sales. The paid part of Piou is the Premium subscription.
• Contacts hashed on your device. If you import your address book, with your permission, the numbers are hashed on your phone before they’re sent. The server keeps only the matches with people already signed up, never other people’s numbers.
• Internal analytics with no cookies and no third-party tools.
• Hosting in Europe. Data is hosted by Supabase in the Paris region (AWS eu-west-3).
• Named providers. The website and web app are served by Vercel; emails and text messages go through Brevo; payments go through Stripe on the web, Apple on iPhone and Google on Android, with subscriptions unified by RevenueCat.
• A named publisher. Piou is published by ALTRIX FZCO, based in Dubai, United Arab Emirates. For any question: support@piou.chat.

Deleting what should be deleted

• Disappearing messages: set per conversation (24 hours, 7 days or 90 days), they’re deleted when they expire.
• Status: status photos, videos and text, along with their files, are deleted automatically after 24 hours.
• Location sharing: one-off, or live for a length of time you choose.
• Report / Block: to keep unwanted people away.
• Delete my account: right from the app, at any time.

In short: what our servers keep, and what they don’t

Our servers keep:

• your messages in their original language: texts, voice messages, photos, videos and documents (disappearing messages until they expire);
• your status updates, for 24 hours;
• your verified phone number and your account;
• the matches between your hashed address book and existing Piou accounts.

Our servers don’t keep:

• translations of your messages, which stay on the phones;
• numbers from your address book that don’t match any Piou account;
• the text of call subtitles, which travels from one phone to the other during the call.

Good habits

• Turn on disappearing messages in conversations you don’t want a history of.
• Only import your address book if you want to; you can also invite people by link or QR code, or find someone by email.
• Check it yourself: switch to airplane mode and open a conversation with messages you’ve already received. If the languages are downloaded, the translation still shows up.
• For anything highly sensitive, pick another channel.

Messaging on Piou is free. Translation is part of Piou Premium: $5.99 a month or $47.99 a year in the US, after a 7-day free trial that requires a card (nothing is charged for 7 days, then the subscription starts at the displayed price unless you cancel before the trial ends). The exact price for your country is shown before you subscribe.