Werra privacy policy

Kornelsen Labs · Effective 3 November 2026

Werra lets you ask a contact you paired with in person whether they are really the person on a call with you. It is built to know as little about you as possible. There are no accounts, no ads, no analytics and no tracking by us.

What stays on your phone

• The name you enter, your contacts' names, and the history of your requests and answers.
• Your signing key. It is created in your phone's secure hardware and never leaves it. Face ID, Touch ID, your fingerprint or face unlock is checked by your phone; Werra never receives your biometric data.
• The camera is used only to scan a pairing code. No images are saved or sent.

Werra turns off cloud backup of this data.

What goes to the contacts you pair with

• Your name as you entered it, and your requests and answers. They are encrypted on your phone so that only your contact's phone can read them.
• Whether you are on a call. When you answer a request, Werra checks whether your phone is on a call at that moment and includes yes, no or unknown in the answer, so your contact can tell if something is off. On Android this needs the "Phone" permission, which you can refuse; Werra then sends "unknown". Werra never reads who you are calling, phone numbers, your call history or call audio.

What passes through our relay

Requests and answers travel through a relay server run by Kornelsen Labs on Cloudflare (relay.werra.kornelsenlabs.ca). Each message is encrypted on the sending phone for the receiving phone only. The relay cannot read it, and it cannot forge an approval: a fake or changed answer is rejected by the app. The relay can only delay or drop messages, which the app shows as not verified. The relay keeps:

• Random mailbox numbers and scrambled (hashed) access keys. They contain no names, phone numbers or email addresses.
• Encrypted messages, for at most 10 minutes or until the receiving phone collects them.
• Your phone's push notification token, if you allow notifications, so the relay can tell your phone that a message is waiting.

A mailbox that your phone has not used for 90 days is deleted from the relay automatically, with its push token. Like any internet service, Cloudflare processes your IP address to deliver traffic. We do not keep logs of it.

Notifications

Notifications are delivered by Apple (on iPhone) or Google Firebase Cloud Messaging (on Android). On Android, Firebase creates an installation ID and a push token for your phone. A notification only says that a new message is waiting. It contains no names and no message content. Apple's and Google's privacy policies apply to their delivery services.

What we never do

• Sell or share your data, or use it for advertising.
• Read your contacts, call history, phone numbers, call audio or messages.
• Track you across apps or websites.

Deleting your data

Removing a contact deletes the mailbox for that contact from the relay. "Erase everything" in Werra's settings deletes all of your mailboxes from the relay and everything stored on your phone. If you simply delete the app, your phone's data is gone and your mailboxes on the relay are deleted after 90 days without use. They contain no names, numbers or message content and cannot be linked back to you.

Age

Werra is meant for adults (18 and over). It is not directed at children.

Changes and contact

If this policy changes, the new version will appear on this page with a new date. Questions: werra@kornelsenlabs.ca.