Privacy Policy for the Encrypted Messaging Application "MCraft"
Effective Date: May 1, 2025
Last Updated: May 1, 2025
Preamble: Our Commitment to Your Privacy in MCraft
Welcome to MCraft. At Quantica Logistic SL, we are deeply committed to protecting your privacy and personal data. MCraft has been designed from its inception with privacy as a central axis, implementing end-to-end encryption for your communications and adopting a philosophy of minimal data collection. This Privacy Policy aims to inform you clearly and transparently about how we process (and, in many cases, how we do not process) your information when you use our MCraft messaging application (hereinafter, "the Services").
Our commitment aligns with the requirements of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights (LOPDGDD). We want you to feel secure using MCraft, knowing that your privacy is our priority. Inspired by the highest standards, MCraft is designed to never collect or store unnecessary sensitive information.
This preamble sets the tone for our approach: privacy is not an afterthought but a fundamental pillar of MCraft. We want you to understand from the outset that your trust is essential to us and that we work actively to protect it.
1. Who is the Controller of Your Data?
The controller of the personal data you provide or that is collected through the use of MCraft Services is:
- Legal Name: Quantica Logistic SL
- NIF (Tax ID): B42/803.346
- Registered Address: Calle del requet de felix, 2 - piso 3, 43480 vila-seca, tarragona, Spain
- Contact email for privacy matters: admin@quanticalogistic.com.
If we have appointed a Data Protection Officer (DPO), you can also contact them through the channels that will be enabled and informed in this policy.
2. Key Privacy Principles in MCraft
MCraft's philosophy is based on the following key principles, which guide our development and the provision of our Services:
- End-to-End Encryption (E2EE): Your messages (text, voice, images, videos, files) and your calls made through MCraft are protected with end-to-end encryption. This means that the information is encrypted on your device and only decrypted on the recipient's device(s). Neither Quantica Logistic SL nor any third party can access the content of your private communications, as we do not possess the decryption keys.
- Minimal Data Collection: MCraft is designed to function by collecting the minimum amount of information strictly necessary to operate and maintain the Services. We will not request or store data that is not essential for the application's operation or for the features you choose to use.
- No Sale or Monetization of Personal Data: Quantica Logistic SL explicitly commits not to sell, rent, or monetize your personal data or the content of your communications in any way for advertising or any other commercial purposes. Your privacy is not a product for us.
- Transparency: We are committed to being completely transparent about our data processing practices. This Privacy Policy details what information we collect (and what we do not), why we do it, and how we protect it. Any significant changes to this policy will be communicated to you.
3. What Information Do We Collect and Why?
In MCraft, data collection is limited to what is strictly necessary to offer you a secure and efficient messaging service. Below, we detail the information we may process:
Information You Provide Directly:
- Phone Number: To create and verify your MCraft account, we use your phone number. This is essential for the Service's operation, acting as your unique identifier and allowing other MCraft users who have you in their contact list to find you (if you configure it this way). We also use it to send you verification codes via SMS during the registration process.
- Profile Name and Profile Picture (Optional): You have the option to add a profile name and profile picture to your MCraft account. If you choose to provide them, this information will be visible to your contacts in MCraft and to other users with whom you interact, according to your privacy settings. You have full control over this information and can modify or delete it at any time. This profile information, if provided, may also be protected by end-to-end encryption in its transmission.
Contact Information (Optional and with Explicit Permission):
- To help you connect with friends and acquaintances who also use MCraft, we offer the option to allow the application to access your device's contact list. This access will only occur if you grant us your explicit permission.
- If you grant this permission, MCraft may securely process the phone numbers from your contact list to identify which of them are registered MCraft users. To protect the privacy of your contacts, this process is performed using cryptographic techniques (such as "contact discovery" via cryptographic hashing). This means that your contacts' phone numbers are sent to our servers in an encrypted (hashed) form for comparison with our database of registered users, without us storing your device's contact list in a readable or permanent manner.
Information We Collect Automatically (Minimal Technical Metadata):
For the proper functioning, maintenance, and security of the Services, MCraft may automatically collect certain limited technical information. This may include:
- Connection and Registration Information: Such as randomly generated authentication tokens, public keys for encryption, date and time of registration, and the last time you used the Services (for features like "last seen online," if you choose to activate and share it).
- Device Information: Device type (mobile, tablet), operating system, and MCraft application version. This information helps us troubleshoot technical issues and improve compatibility.
- Network Information: Limited information, such as the IP address from which you connect, for message delivery and service optimization. This information is treated with strict confidentiality and may be anonymized or deleted after a short period.
It is crucial to note that this information is technical metadata and DOES NOT include the content of your communications (messages or calls), which are protected by end-to-end encryption.
Information We DO NOT Collect (Fundamental Emphasis):
In line with our commitment to minimal data collection and maximum privacy, we want to be explicit about the information we DO NOT have access to and DO NOT collect:
- Content of Your Messages and Calls: Thanks to the end-to-end encryption implemented in MCraft, Quantica Logistic SL CANNOT access, read, listen to, or view the content of your messages (whether text, voice, images, videos, documents, or other files) or the content of your voice or video calls. This content is only accessible to you and your chosen recipients. The keys needed to decrypt this content are stored exclusively on users' devices and never on our servers.
- Message History on Servers: Your conversation history is stored locally on your own devices. Quantica Logistic SL DOES NOT store a copy of your message history on its servers once messages have been delivered to recipients.
- Precise Location Data: MCraft DOES NOT collect or track your precise geographic location continuously or in the background. Only if you explicitly choose to share your location as part of a message's content (e.g., by sending a map point) will that location information, like the rest of the message content, be end-to-end encrypted and inaccessible to us.
- Additional Sensitive Information: We will not request or collect sensitive information such as your sexual orientation, religious beliefs, political opinions, health data, etc.
- Data for Advertising Purposes: We DO NOT collect your data to create profiles for advertising purposes, nor do we transfer your data to third-party analytics services or advertising networks.
For maximum transparency, the following table summarizes the data MCraft may process, its purposes, and the legal basis legitimizing it:
Table: Data Processed by MCraft, Purposes, and Legal Basis
| Type of Data |
Specific Description |
Purpose of Processing |
Legal Basis (GDPR) |
Is it Mandatory or Optional? |
Who Can See It? |
| Phone Number |
Your mobile phone number. |
Account creation and verification; user identification; allowing others to find you. |
Art. 6.1.b (Contractual necessity); Art. 6.1.a (Consent for registration). |
Mandatory. |
You, Quantica Logistic SL (for account management), your MCraft contacts (if they have you in their address book and you allow it). |
| Profile Name |
The name or alias you choose. |
Identification in the app. |
Art. 6.1.a (Consent). |
Optional. |
You, your MCraft contacts, other users you interact with. |
| Profile Picture |
The image you choose to upload. |
Visual identification in the app. |
Art. 6.1.a (Consent). |
Optional. |
You, your MCraft contacts, other users you interact with. |
| Device Contacts (Hashed) |
Phone numbers from your address book, cryptographically processed. |
Identify which of your contacts also use MCraft (if you grant permission). |
Art. 6.1.a (Explicit consent). |
Optional (requires your permission). |
You (you see which of your contacts use MCraft). Quantica Logistic SL only processes hashes for comparison. |
| Technical Metadata |
Connection, device, network information (limited). |
Operation, maintenance, security, and improvement of the Service; message delivery. |
Art. 6.1.b (Contractual necessity); Art. 6.1.f (Legitimate interest for security and operation). |
Mandatory (minimum necessary). |
Quantica Logistic SL (for technical purposes). |
| Content of Messages and Calls (Text, Voice, Files, etc.) |
The content of your communications. |
NOT COLLECTED / INACCESSIBLE by Quantica Logistic SL due to end-to-end encryption. |
N/A (No processing on our part). |
N/A |
Only you and your chosen recipients. |
4. Legal Basis for Processing Your Data
The processing of your personal data by Quantica Logistic SL for MCraft Services is based on the following legal bases, according to Article 6 of the GDPR:
- User Consent (Art. 6.1.a GDPR):
- For the act of registering and creating an account in MCraft.
- For providing optional data, such as your profile name or profile picture.
- For accessing specific features that require your explicit permission, such as accessing your contact list to find other MCraft users.
- Your consent will always be free, specific, informed, and unambiguous. You may withdraw your consent at any time for processing based on it.
- Performance of a Contract (Art. 6.1.b GDPR):
- We process personal data that is strictly necessary to fulfill our contractual obligations to you, i.e., to provide you with the MCraft messaging Services you requested when creating your account. This includes, for example, using your phone number for account management and message delivery.
- Legitimate Interests (Art. 6.1.f GDPR):
- In some cases, we may process certain personal data based on our legitimate interests, provided these interests are not overridden by your fundamental rights, freedoms, and interests. These legitimate interests may include:
- Ensuring the security and integrity of our platform and Services.
- Performing basic technical analyses for the maintenance, optimization, and improvement of the Services.
- Managing the delivery of encrypted messages, including their temporary queuing.
- When we rely on legitimate interest, we conduct a balancing test to ensure the processing is necessary and proportionate.
- Compliance with Legal Obligations (Art. 6.1.c GDPR):
- Exceptionally, we might need to process your personal data to comply with legal obligations to which Quantica Logistic SL is subject.
5. How and With Whom Do We Share Your Information?
Our general principle is minimal sharing of your personal information. Quantica Logistic SL does not sell, rent, or share your personal data with third parties for their own commercial or marketing purposes.
- Service Providers (Data Processors):
We may use third-party service providers who help us operate and maintain MCraft Services (e.g., SMS verification service providers, cloud infrastructure providers). These providers act under our strict instructions and are contractually obliged (according to Article 28 of the GDPR) to protect your data and use it only for the contracted purposes.
- Legal Requirements:
We might disclose your personal information if required by law or a valid legal process. We will assess the legality of the request and cooperate within legal limits. Given the nature of MCraft and E2EE, the amount of useful information we could provide is, by design, extremely limited (mainly account registration information or very basic metadata).
- NO Sharing for Commercial or Advertising Purposes:
We reiterate that your personal data and the content of your communications are NOT shared with advertisers, marketing companies, or other entities for their own commercial purposes.
6. Your Data Protection Rights
Under the GDPR and LOPDGDD, you have the following rights:
- Right of Access (Art. 15 GDPR): To obtain confirmation of whether we are processing your data and to access it.
- Right to Rectification (Art. 16 GDPR): To request the correction of inaccurate or incomplete data.
- Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR): To request the deletion of your data in certain circumstances.
- Right to Restriction of Processing (Art. 18 GDPR): To request that the processing of your data be restricted in certain cases.
- Right to Data Portability (Art. 20 GDPR): To receive your data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
- Right to Object (Art. 21 GDPR): To object to the processing of your data for reasons related to your particular situation, especially if it is based on legitimate interest.
- Right not to be subject to Automated Individual Decision-making (Art. 22 GDPR): Not to be subject to decisions based solely on automated processing that produce legal effects on you. MCraft does not envisage this type of processing.
How to Exercise Your Rights:
You can exercise your rights by sending a request to admin@quanticalogistic.com, accompanied by a copy of your ID or equivalent identification document. You can also exercise some rights directly through the application (e.g., modifying your profile, deleting your account). We will respond within a maximum period of one month, extendable by two more months in case of complexity.
Right to Withdraw Consent (Art. 7.3 GDPR):
You can withdraw your consent at any time for processing based on it, as easily as you gave it. This will not affect the lawfulness of prior processing.
Right to Lodge a Complaint with the AEPD (Art. 77 GDPR):
If you believe your rights have been violated, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
7. Security of Your Information
Quantica Logistic SL implements appropriate technical and organizational measures to protect your data:
- End-to-End Encryption (E2EE): This is the central measure for your communications.
- Encryption in Transit and at Rest: Account information and metadata are encrypted during transmission (HTTPS/TLS) and storage.
- Account Security: You are responsible for maintaining the confidentiality of verification codes and protecting your device. MCraft may offer an app lock PIN.
- Additional Measures: Strict access controls, security reviews, staff training, and robust engineering practices.
- Access Minimization: Quantica Logistic SL staff access to personal data is restricted to the minimum necessary.
- Security Breach Notification: We will notify you without undue delay in case of a security breach that poses a high risk to your rights, and also the AEPD as per GDPR.
8. Data Retention
We will retain your data only for the time necessary for the purposes for which it was collected and to comply with legal obligations:
- Account Information: As long as you maintain an active account. If you delete it, we will delete this information from our production systems (a short residual period may exist in backups).
- Queued Encrypted Messages: Deleted from our servers as soon as they are delivered or after a reasonable period (e.g., 30 days) if undeliverable.
- Technical Metadata: Retained for the strictly necessary time for security, diagnostics, or legal compliance, then anonymized or aggregated.
- Account Deletion: We will provide an easy way to delete your account from the app. This will initiate the deletion of your account information. Messages already sent to other users reside on their devices.
The content of your communications is not "retained" by us in an accessible format due to E2EE.
9. Children's Privacy
MCraft Services are NOT directed to individuals under the age of 14. To use MCraft, you must be at least 14 years old, in accordance with the LOPDGDD in Spain (which sets the age for valid consent for information society services). We do not knowingly collect personal information from children under 14. If you are a parent/guardian and believe a child under your care has provided us with data, please contact admin@quanticalogistic.com.
10. International Data Transfers
Quantica Logistic SL is based in Spain, and we strive to process and store data within the European Economic Area (EEA).
If we use providers outside the EEA, we will only carry out international transfers if GDPR guarantees are met (Adequacy Decision, Standard Contractual Clauses, Binding Corporate Rules, or other guarantees, applying supplementary measures if necessary).
We will inform you in this Policy if we conduct regular international transfers and about the applied guarantees. We strive to minimize such transfers.
11. Changes to this Privacy Policy
We may modify this Privacy Policy. We will notify you of significant changes before they take effect (e.g., in-app notification, website). Please review this policy periodically. The "Last Updated" date will indicate the latest changes. Continued use of the Services after changes take effect will imply your acceptance. If you do not agree, you must stop using the Services and may delete your account.
12. Contact
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:
- By email: admin@quanticalogistic.com.
- By post:
Quantica Logistic SL
Attention: MCraft Privacy Manager
Calle del requet de felix, 2 - piso 3
43480 vila-seca, tarragona
Spain
If we have appointed a Data Protection Officer (DPO), their contact details will also be provided here.
We appreciate your trust in using MCraft.