The short version: Plures has no accounts, no analytics, and no message servers. We operate a single thin relay that holds a few kinds of short-lived data for your group: encrypted member identities, your encrypted location while you share it, and a push token so a friend's message can wake your phone. The relay cannot read the identities or the location. Messages, group keys and your private keys stay on your device or move peer-to-peer over Bluetooth.
Plures ("the App") is published by Bro Exotic Group LLC, a Delaware limited liability company with operations in Arizona ("we," "us," or "our"). This Privacy Policy describes the data practices of the Plures mobile application. It does not cover the broader Bro Exotic Group website or any other product, which are governed by their own policies.
Almost nothing. We operate no user accounts, no analytics, no telemetry, and no message servers. There is no analytics SDK, no advertising network, no crash reporter that sends data off-device, and no remote configuration.
We do operate a single content-blind relay. It stores opaque encrypted identity blobs so groups are populated before members meet in person and, while you share your location, an encrypted copy of your latest location so group members out of Bluetooth range can still find you. It cannot read either; both are encrypted under a key only your group members hold. It also stores a device push token so the App can wake your phone when a message is waiting. Section 4b describes exactly what the relay sees and does not see.
Aside from the relay, there is no profile, account, login, or user record associated with you anywhere outside your own device.
The App stores the following locally on your phone, encrypted at rest using your device's secure enclave (iOS Keychain) or Keystore (Android):
You can erase all of this at any time using Settings → Advanced → Delete everything in the App (on older versions, Settings → Nuke Everything).
When the App is running, your phone advertises a randomized identifier and exchanges encrypted message envelopes with nearby devices that share a group with you. These envelopes contain:
We cannot read these messages and neither can your carrier, your Wi-Fi network, or the operating system vendor — the only parties who can decrypt them are the participants in the conversation.
Before you meet your group members in person at a festival or event, your phone uses a brief internet connection (typically while you and your friends accept group invites) to share an encrypted identity blob with other members. This blob contains your Ed25519 signing public key, nodeId, display name, and totem — just enough so other members' apps know who to expect when they arrive at the festival. Without this, every group would arrive to an empty member list and have to discover each other one BLE handshake at a time.
What the relay can see: only that some opaque encrypted blob exists under some rotating hash. The hash is HMAC-derived from your group key and the current day, and rotates every 24 hours, so the relay cannot link activity to a stable group identifier across days. The blob itself is encrypted under your group's symmetric key, which the relay does not possess.
What the relay cannot see: any content (encrypted), any group name (only hashes), any user identity (encrypted), any IP address (we have configured the relay to not log IPs), or any link between today's hash and yesterday's hash for the same group.
Your location, while you share it: when location sharing is on for a group and your phone has an internet connection, the App posts your latest coordinates (with time and accuracy) to the relay, encrypted under that group's key and signed by you, under a daily-rotating hash. Only members of that group can decrypt it. Each copy auto-deletes after 15 minutes, so when you stop sharing or go offline it disappears shortly after. If you turn on Keep my location updating when Plures is closed, this also happens in the background for the groups you share with.
Push tokens: so a friend's message can wake your phone, the App registers your device's push token (from Apple Push Notification service on iPhone, Firebase Cloud Messaging on Android) with the relay, under a daily-rotating hash derived from your group key. Push tokens are stored in readable form because Apple and Google require that to deliver a notification. The wake-up push carries no message content. Tokens auto-delete after 7 days.
Where it lives: serverless functions on Vercel, backed by Upstash Redis. Identity blobs and push tokens auto-delete after 7 days; location copies after 15 minutes.
What is never sent to the relay: messages, photos, voice notes, files, group keys or your private keys. Messages always travel peer-to-peer over Bluetooth.
The App does not integrate any analytics, advertising or tracking SDK. Specifically: no Facebook SDK, no Mixpanel, no PostHog, no Sentry, no Crashlytics, no advertising network. On Android, the App uses Firebase Cloud Messaging only to deliver content-free wake-up pushes, and Google Maps to draw the map; on iPhone, Apple Push Notification service and Apple Maps play the same roles. These services are governed by Apple's and Google's own privacy policies.
The roster relay infrastructure (Section 4b) uses two providers as content-blind transport and storage: Vercel for HTTPS hosting and serverless function execution, and Upstash Redis for short-lived storage (7 days for identity blobs and push tokens, 15 minutes for location). Neither provider can read your identity or location data — they store and route opaque bytes encrypted under your group key.
Crash reports are handled exclusively by Apple TestFlight (iOS) and Google Play Console (Android) at their default platform-controlled levels, governed by Apple's and Google's own privacy policies.
Plures is not directed to and is not intended for use by anyone under the age of 17. We do not knowingly process data from anyone under 17. If you are under 17, please do not install or use the App.
Because we do not operate any chat or identity server, we cannot produce message content, group membership lists, readable location data, or user identities in response to a subpoena, warrant, or other legal demand. The only data we hold is on the roster relay (Section 4b), and what we could produce from it is structurally minimal:
What we cannot produce even if compelled: who wrote a blob (no IP logging), which group a hash belongs to (hashes rotate daily and are HMAC-derived from group keys we do not have), or any blob older than 7 days (auto-deleted by Upstash Redis).
Should we ever begin operating a chat server or collecting message content, this Policy will be updated and you will be required to re-accept it.
Even though we do not collect personal data, we acknowledge the rights granted to you under the California Consumer Privacy Act (CCPA) and the European Union's General Data Protection Regulation (GDPR). Because we hold no data about you, requests to access, delete, or port your data have no records to act on. You can erase all on-device data using Settings → Advanced → Delete everything (on older versions, Settings → Nuke Everything); see deleting your data for exactly what it removes.
If we update this Policy, the new version will be posted here with a new effective date, and the App will require you to re-accept it on next launch. Material changes will be presented prominently rather than buried.
Questions about this Policy or our data practices? Email privacy@broexoticgroup.com. To report abuse, use the in-app Report action or email the same address. We review reports within 24 hours. For general inquiries unrelated to privacy, please use hello@broexoticgroup.com.