Telbox
Download

How Telbox handles your data

Last updated: July 22, 2026

This page describes, in engineering detail, exactly what happens to your messages, voice notes, and calls inside Telbox — how they are encrypted, when (and only when) they are decrypted, and what our AI does and does not do with them. It is the plain-language companion to our Privacy Policy: the policy is the binding legal document; this page shows the mechanics behind it so you can check the two against each other.

We publish this because a privacy claim you can't inspect is just marketing. If anything here contradicts the Privacy Policy, or contradicts what the app actually does on your device, treat the app's behaviour as the truth and tell us at info@telbox.ai — we treat a contradiction as a bug to fix.

The two things that are always true

Everything below is an elaboration of these two statements. Read them first.

1. Transport is always end-to-end encrypted. Between your device and the person you're talking to — and while your content sits on our servers at rest — it is ciphertext we cannot read. This is true on every tier, whether or not you use AI, and it is not a setting you can turn off.

2. AI cannot run on ciphertext, so using AI means decrypting to process. When AI is on for a conversation, our AI worker decrypts the relevant message or voice note in memory to transcribe, summarise, or answer questions about it. That processing is done under a binding no-training contract, and we don't keep the plaintext afterward — but it is real decryption, and it is the one moment your content is readable inside our infrastructure. We say this plainly rather than claim a blanket "we never see your data," because that would be false the moment AI is on.

The rest of this page is how each of those works.

1. Transport encryption — the envelope

Every message and voice note is sealed on your device before it leaves it, using an authenticated-encryption envelope:

establishes a shared secret between sender and recipient devices.

key, giving both confidentiality and tamper-detection.

sent the message and that it wasn't altered in flight.

The server's role is deliberately small: it stores and routes ciphertext. It holds the sealed envelope so the recipient can pick it up, and it stores the same ciphertext at rest. It does not hold the keys needed to open a transport envelope. When you send to someone, the math happens on the two devices; the server is a mailbox, not a reader.

Calls work the same way in spirit: media is end-to-end encrypted with a forward-secret key exchange and per-frame authenticated encryption, and calls are never processed on the server at all.

Post-quantum, rolling out. We have built hybrid post-quantum encryption into the envelope: alongside X25519, a message can combine ML-KEM-768 — the NIST-standardised post-quantum key exchange (FIPS 203) — so an attacker would have to break both the classical and the post-quantum layer. It is capability-negotiated: a conversation upgrades to post-quantum automatically once every participating device supports it, and devices that don't yet keep the still-strong classical envelope. This is being rolled out, not universal today; it only ever adds protection to the transport layer, and it does not change the AI path described below.

2. What "AI on" means for your encryption

AI features — transcribing a voice note, summarising a thread, answering a question about your messages — are on from the start for new accounts, and always in your hands to switch off. Here is exactly what happens when they run.

AI off — pure end-to-end. If AI is off for a conversation, nothing is decrypted for processing and nothing leaves the encrypted envelope. Your content stays ciphertext to us, end to end.

AI on — decrypt-to-process, under a no-training contract. To run an AI feature, our AI worker process:

1. Fetches the sealed envelope and decrypts it in memory inside an isolated worker — the one point at which your content is readable in our infrastructure. 2. Sends the decrypted content to our AI processor for the specific task (transcription, summary, or answering your question). 3. Keeps the AI-derived output — for example a transcript or a summary — and does not persist the decrypted plaintext after processing. What we retain is described in the Privacy Policy (§2.4 and §6), and you can wipe it from Settings → AI.

You control this, per conversation or entirely. Turning AI off for a single thread, or off across the whole app in Settings → AI, stops the decrypt-for-AI step from happening at all. Using an AI feature is how you consent to the decryption described here; turning it off withdraws that consent.

3. The AI processor — described by mechanism

There is exactly one AI-processing path, and it is the same on every tier (Free, Plus, Pro, Business, Workforce). We describe it by what it is contractually bound to do, rather than by naming the vendor:

contractual term that prohibits training on your content** — your prompts and the responses are never used to train or improve a model.

tier, goes to this one no-training endpoint. A free account and a paid account get the identical privacy posture here; what differs between them is usage limits and cost, never whether the processor can train on you (see §4).

Data-protection law requires us to make our sub-processors identifiable, so the specific processing entity is named in our sub-processor list — that is the right place for the legal identity. On this page, and in all of our public materials, we describe the guarantee by its mechanism (a no-training contract) rather than by the party that fulfils it. Both statements are true at once: the entity is disclosed where the law requires it, and the promise stands on the contract, not on the brand.

4. The per-user AI factory — how workload is gated and metered

Every AI call is routed through a single per-user "factory" in our backend. Its job is to look up who you are, decide whether AI is allowed for you right now, meter your usage, and then hand the request to the one no-training endpoint above. Two things about it matter for understanding your data:

It defaults to the Free tier when it is unsure — and that affects usage, not privacy. If your account record is missing, or a tier field is unset (for example a legacy account created before we added the field), the factory resolves you to Free. This is a deliberate fail-safe: it never silently grants a paid tier. Crucially, because the no-training routing is uniform across every tier, defaulting to Free changes only your usage limits — it can never downgrade your privacy, because there is no lower-privacy path to fall to.

It runs three gates, in order, before any content is sent for processing:

1. Consent. If you have not accepted AI processing, the request is refused and no decryption happens. AI stays off until you opt in. 2. Per-feature monthly allowance (Free tier). Each AI feature — voice-note understanding, ad-hoc questions, thread assistance, and so on — has its own monthly allowance for Free accounts, metered with a token bucket. When an allowance is used up, that feature returns a "limit reached" response until the bucket refills, and the app offers an upgrade. You can see your remaining allowance any time in Settings → AI usage. 3. Monthly spending backstop (Free tier). Behind the per-feature allowances sits a total monthly cost ceiling per Free account. It rarely comes into play — the per-feature allowances almost always bind first — but it guarantees an upper bound on the AI workload a single Free account can generate in a month.

Paid tiers lift the limits, not the privacy. Plus, Pro, Business, and Workforce raise or remove the usage limits in gates 2 and 3. They do not change gate 1, the encryption, the decrypt-to-process mechanism, or the no-training contract. If a paid subscription lapses and you return to Free, your usage limits change back — your AI privacy posture does not, because it was never different.

5. What we never do with your content — on any tier

Regardless of tier, and regardless of whether AI is on:

datasets that would make that possible — and the third-party processor is contractually barred from training on it.

pseudonymised derivatives of it, to data brokers.

advertising or analytics SDK that exfiltrates the contents of your messages. (We use an error-tracking service for crash diagnostics, with personal data scrubbed; it is in the sub-processor list.)

two-person-reviewed operational tasks — debugging a specific broken message, responding to lawful legal process, or carrying out a deletion you asked for.

These are stated as binding commitments in the Privacy Policy (§3.7); this page just shows the same set alongside the mechanics.

6. When someone sends content to you

Telbox is a messaging app, so it is worth being explicit: when someone sends you content and your AI is on, your account's AI processes their content — transcribing and summarising their voice note for you, for instance. That processing goes through the same one no-training endpoint, so it is no-training on both sides of the conversation. It is still processing that the sender doesn't solely control, which is why a conversation's AI posture is visible in its Trust Center: you can see at a glance whether AI is on for a thread, and either party can turn it off per conversation.

7. How to check us

page or the Privacy Policy, the app is the truth and the document is the bug.

specific difference between what we describe here and what you observe, we want it — we will investigate and correct the document (or the code).

source of truth; this page exists to make it inspectable, not to replace it.

Related

calls, verified agents, and hardening work.

law requires.