Bailiwick Privacy Policy

Effective date: October 1, 2026 Contact: support@perfectlunacy.com

Bailiwick is a social app for sharing posts, photos and videos with people you know. It works differently from most social apps, so this policy explains in plain language what happens to your information and who can see it. It covers the Bailiwick Android app published by Perfect Lunacy ("we").

This is alpha software. If anything here turns out not to match what the app does, we will fix the app or update this policy.

The short version

• There is no Bailiwick server for your content. We never receive your posts, photos, contacts or profile. The only thing the app can send us is a crash report, and only if you agree (see Crash reports). It also asks bailiwick.space whether a newer version exists (see Update check).
• Your content is stored on your phone. The people you connect with fetch it from your phone.
• Posts you share with a circle are encrypted so only the people in that circle can read them. Public posts are not encrypted: anyone can read them.
• The app uses public network services run by the makers of Iroh (the networking library Bailiwick is built on) to help phones find and reach each other. Those services see your phone's network address. When two phones cannot connect directly, their traffic passes through one of those services, still encrypted end to end, so it cannot read it.
• Anyone who has your Bailiwick ID can connect to your phone and learn its IP address.
• No ads, no analytics, no tracking. Crash reports are off unless you turn them on.

What Bailiwick stores, and where

Everything you create in Bailiwick (your profile, posts, comments, reactions, tags, photos, videos, circles and contacts) is stored in the app's private storage on your phone. Content your contacts share with you is downloaded to your phone and stored there too. Settings → Storage lets you limit how much space your contacts' content uses, clear it, and choose how long to keep it.

Your account is a cryptographic key pair created on your phone. The public half is your Bailiwick ID (it is also your phone's address on the network). The private half never leaves your phone except inside an account file you choose to make to move to a new phone (see Moving to a new phone). There is no username, password, email address or phone number.

Android's automatic cloud backup is turned off for Bailiwick, so the app's data is not copied to your Google account.

How your content reaches other people

Bailiwick is peer to peer. When you post, your phone announces the update to your contacts, and their phones download it directly from yours. While you are signed in, the app keeps a sync service running in the background (shown as a notification) so your contacts can reach your phone and you receive their posts.

Circles. Each circle has its own secret key. Posts, comments, reactions, tags, photos and videos you share with a circle are encrypted with that key on your phone before anyone can fetch them, and signed so others can check they came from you. Only people you have added to that circle get its key, and keys are sent directly from your phone to theirs, encrypted. Nobody else, including the network services described below, can read circle content. The list of who is in your circles is never published.

Your profile. Your name and picture are not encrypted. They are signed by you and shared with your contacts, and with anyone who reads your public posts.

Public posts. If you turn on your public channel (Settings → Posts) and post publicly, those posts, their photos and videos, and the reactions and tags you make in public are not encrypted. They are signed so readers can check they came from you. Anyone who knows your Bailiwick ID can follow your public channel and read them, and other people's phones that follow you may pass your public posts on to further followers.

Introductions. You connect with someone by showing them a QR code, or by sending them the code through another app. The code contains your name, your Bailiwick ID and the address of the relay your phone uses. It contains no keys or content. Anyone who sees or receives the code learns those things.

Network services and your IP address

Your phone needs to be reachable by your contacts. To make that work, Bailiwick uses services run by number 0 (n0), the developers of Iroh, which are Iroh's defaults:

• Relays. When two phones cannot connect directly, traffic passes through an n0 relay server. The relay sees both phones' Bailiwick IDs and IP addresses and how much data passes between them. The traffic itself is end-to-end encrypted, so the relay cannot read it.
• Directory. Your phone publishes a small public record to n0's directory (pkarr/DNS) so others can find it by Bailiwick ID. The record holds your Bailiwick ID and your relay's address, and while your phone has no relay, its own IP addresses. n0 sees the IP address your phone publishes from.

Things you should know about your IP address:

• Anyone who has your Bailiwick ID can learn your IP address. Your Bailiwick ID is in every QR code you share and is how people follow your public channel. Anyone holding it can connect to your phone; once connected, the networking library hands over your phone's direct addresses, which include your IP address. Bailiwick cannot currently prevent this. An IP address can reveal your approximate location and your internet provider.
• Your contacts can learn each other's IP addresses. Phones that follow the same person exchange network addresses so updates spread between them. So two of your contacts who are not connected to each other may learn each other's IP addresses through you, and you may learn the IP addresses of your contacts' other contacts. The same applies to followers of a public channel.
• Someone who connects to your phone can check whether you follow a given public channel. Your phone helps others catch up on the public channels you follow (your contacts count as followed), and answers for those channels only.

If your IP address is sensitive for you, consider using a VPN.

Deleting posts and contacts

Deleting a post. Your phone removes the post and tells everyone who received it that it is deleted. Their Bailiwick apps then remove it, with its photos, videos, comments, reactions and tags, and will not download it again. Your phone removes the post's files from its own storage straight away; what it keeps is the deletion itself, listed for at least 30 days (or your conversation cleanup age if that is longer) so contacts who were offline hear about it. Auto-delete (Settings → Posts) deletes your old posts the same way.

What deleting cannot guarantee:

• Anyone who saw the post may have saved, copied or screenshotted it, and a modified app could ignore the deletion.
• People who no longer receive your updates (for example someone you removed before deleting the post, or someone who has been offline for longer than that window) do not hear about the deletion and may keep their copy.
• Older posts that have simply aged out of what your phone shares are not yet removed from other people's phones by Bailiwick.
• Public posts can be passed between followers' phones, so copies can exist beyond the people you know.

Removing a contact. Their content is removed from your phone and they are no longer followed. Bailiwick changes the keys of every circle they were in and of your own updates, re-encrypts your current posts with the new keys and sends the new keys to your remaining contacts, so the removed person cannot read anything you post afterwards. Whatever they had already downloaded stays on their phone. They still have your Bailiwick ID, so they can still read your public posts and reach your phone.

Removing everything. Uninstalling Bailiwick, or clearing its data in Android settings, deletes everything it stored on your phone, including your key. Since we hold no data about you, there is nothing for us to delete; your contacts keep what they already downloaded.

Moving to a new phone

"Move to a new phone" on your profile makes a file to move your account to another phone. It is not a backup, and the app never asks you to make one. It contains your private key, your keys, your identities, circles (with who is in them), contacts (with the keys they gave you), the accounts you follow, your settings and the faces you designed, encrypted with a password you choose. It does not contain your posts, photos, videos or anything your contacts shared. The app hands the file to Android's share menu and you decide where it goes (a file, a cloud drive, an email); we never receive it. A copy also stays in the app's private storage. Anyone who gets the file and its password can use your Bailiwick identity, so choose a strong password and store the file somewhere safe.

Analytics, ads and diagnostics

Bailiwick contains no advertising, no analytics and no tracking libraries, and it does not collect usage statistics.

Crash reports

When Bailiwick crashes, it can send a report to us at bailiwick.space so we can fix the problem. It does so only if you agree. The app asks you once, the first time you reach your feed, and you can change your answer at any time in Settings → Privacy → Send crash reports. Until you agree, nothing is sent.

A crash report contains:

• the app version, the version of the Bailiwick network standard, the Android version and your phone's make and model;
• where in the app the crash happened (the technical "stack trace");
• the last few hundred technical messages the app wrote to your phone's log before the crash.

Before a report is saved, and again before it is sent, the app removes from it anything that could identify you or your contacts or show what you wrote: Bailiwick IDs, IP addresses, relay and other web addresses, content and file identifiers, the names on your profiles, contacts and circles, and the text of posts, comments and tags. A report never contains your keys, your backup, or any post, photo, video or other content. Reports are sent over an encrypted (HTTPS) connection.

The app keeps at most one report on your phone, the one from the most recent crash: each new crash replaces it, and it is deleted once it is sent. If you have not agreed, it simply stays there (until the next crash replaces it or you uninstall the app) and is sent only if you turn crash reports on later. We use crash reports only to find and fix bugs, and we do not share them with anyone. We delete each report after 90 days, or sooner once the bug it shows is fixed.

Like most Android apps, Bailiwick also writes technical messages to your phone's system log; these do not include your posts, names or network addresses, and they stay on your phone unless they are part of a crash report you agreed to send.

Update check

If you installed Bailiwick from bailiwick.space rather than Google Play, the app asks bailiwick.space for the latest version when you open it and about once a day, at most once an hour, so it can tell you when a newer one is available. The request carries nothing about you, your account or your content; like any request on the internet, it shows our server your phone's IP address. Installs from Google Play do not check: Play updates them.

Permissions

• Camera: to scan a contact's QR code and to take a photo for a post. Images go only where you post them.
• Notifications: to tell you about new posts, introductions and videos being published, and to show that sync is running. Notifications are created on your phone.
• Foreground service (and keeping the phone awake while a video is processed): to keep sync running in the background, and to finish preparing a video you post.
• Run at startup: to restart sync after your phone reboots or the app updates, so your contacts can still reach you.
• Internet and network state: to connect to your contacts, and for the "Wi-Fi only sync" setting.

Bailiwick does not ask for access to your location, contacts, microphone or files. Photos and videos you attach are chosen through Android's picker. Photos are re-encoded before posting, which drops their metadata (such as location). A video already small enough is posted as the original file and keeps whatever metadata your camera stored in it, which can include location.

Children

Bailiwick is not directed at children. We don't collect information about the people who use it, but we recommend that people using Bailiwick be 16 or older.

Changes

We will post any change to this policy at https://bailiwick.space/privacy.html and update the effective date above.