Tupyo Privacy Policy

Effective: 5 October 2026
Developer: Saifullah Ahad
Android package: ai.saifullah.tupyo

What Tupyo does

Tupyo lets a group in one room hold a secret vote on their own phones, over the same Wi-Fi network or a phone hotspot. Each choice is sealed on the voter's phone, a few chosen counting members open only the total, and every phone checks the count. Tupyo is for decisions inside private groups. It is not for government elections and it is not a legal record on its own.

What stays on your phone

The votes you take part in, the name you use in each room, your keys, your sealed ballot and your receipt are kept in the app's private storage on your phone, and its secret keys are stored encrypted. There is no account. The developer runs no server and receives none of this information. Tupyo has no advertising, analytics or crash-reporting service.

What goes to the other phones in the room

When you join a room, your phone sends your name, your public key and the room's signed records (the question and choices, the list of names, sealed ballots, acknowledgments, counting steps and the result) directly to the other phones in the same local room, and keeps a copy of theirs. Names, the question and the list are public to everyone in that room.

These room messages are signed so any change is detected, but they are not encrypted on the local network, so another device on that same network could read names and the question. Your choice itself is sealed before it leaves your phone: no phone, including the organizer's or a counting member's, can open a single ballot; only the total is opened. Your receipt does not show your choice. If the required number of counting members worked together, they could break ballot privacy; the About and limits screen in the app says so.

Tupyo connects only to private local network addresses. It refuses any internet address in its code.

Camera and permissions

Camera access is optional and used only to read a room QR code. Pictures are processed on the phone and never stored or sent; you can type the room code or paste the invitation instead. Internet, network-state, Wi-Fi-state and multicast access are used only to find and connect to phones in the same local room. While a vote is open, a foreground service with a visible notification keeps the room running on the organizer's phone; notification permission is used for that notification. Read aloud uses the phone's offline voice and sends nothing.

Optional app lock

An App PIN is separate from your device PIN; only a salted hash of it is stored on the phone. Biometric unlock uses Android's own prompt. Tupyo never receives biometric data.

Backups, deletion and audit files

Android cloud backup and device-to-device transfer are disabled for Tupyo. "Delete this vote from this phone" in the app removes this phone's copy of a vote and its keys. It cannot remove the copies kept by other people's phones, or audit files you saved. An audit file contains the room's names and signed public record; it is saved only where you choose, and sharing it is your decision. Uninstalling the app removes everything it stored on your phone.

Feedback, children and changes

Send feedback and Report a concern, in the app's Settings, open your own email app addressed to the support email below. Tupyo does not send the email itself or attach any vote. Information you choose to email is used only to answer you; ask by email to delete that correspondence.

Tupyo is intended for adults. It has no public posts, social profiles, chat or direct messages. See its child-safety standards. If you believe a child has sent personal information to the developer, contact us. Changes to this policy will appear on this page with a new effective date.