Privacy Policy

Submit Android app (gay.pupsage.submitapp)

Effective: September 10, 2026 · Last updated: September 23, 2026

This policy describes how the Submit app and its companion, the Submit Server, handle information. It matches the software as shipped: an app built for consenting adult partners, with end-to-end encrypted data and an optional wake-phone notification through Google.

Who we are

Submit is operated by Pup Sage. Questions about privacy, this policy, or deletion should go to: me@pupsage.gay.

The app talks to the Submit Server at https://submit.pupsage.gay. This page is published at https://submit.pupsage.gay/privacy.

What Submit does

Submit is for a Dom and one or more Subs who already know their own dynamics. You create a local identity, pair with an invite or QR code, and optionally turn on shared tools: chat, check-ins (including photos), tasks, punishments, rewards, chastity, protocol, and notes. A feature is enabled only when the Sub allows it and the Dom then turns it on.

There are no public profiles, no social graph, no ads, and no in-app analytics. You do not create an email-and-password account.

Age requirement

Submit is for people 18 or older. On first launch the app asks for your date of birth and checks it on the device. That data is not stored, not sent to the Submit Server, and not sent to Google. If the check fails, the app does not continue.

We do not knowingly collect information from anyone under 18. If you believe a minor used Submit, email me@pupsage.gay and we will delete any Submit Server records we can identify.

Information on your phone

Your identity lives on the device. The vault is stored with Android encrypted preferences (not in cloud backup; Android backup for this app is turned off).

The vault and related local data can include:

• Cryptographic keys created on the device (X25519 for pairing, Ed25519 for data traffic)
• An app-generated device id — not anything identifying from your device
• The display name, title, and pronouns you choose
• Your starting role (Dom or Sub) and any paired roles
• Pair records: chat, feature data, tasks, check-ins, photos you attach, punishments, rewards, chastity data, protocol information, notes, and other app data
• A Firebase Cloud Messaging token, if Google Play services can issue one
• A short queue of outbound encrypted data, and your store of encrypted data

Private notes you mark as not shared stay on that phone. They are not sent to the Submit Server or to your partner.

Information the Submit Server stores

The Submit Server is a ciphertext relay. It stores what it needs to pair devices and to hold sealed mail until the other phone pulls it. It does not have the pair key, so it cannot read chat text, feature data, or photos.

In plaintext it stores:

• Your app-generated device id, role, and public keys
• Your display name when you create or accept an invite (so the other person can see who they are pairing with). This is not a public directory. Later name, title, and pronoun edits travel inside the encrypted pair state.
• Invite codes and which two device ids belong to a pair
• An optional FCM token, so the server can wake your phone for notifications

As unreadable ciphertext it stores:

• Mail envelopes: For chat and feature data
• Temporary device-transfer blobs when a vault is too large for QR transferring.

The Submit Server does not store:

• Your date of birth
• Email, phone number, or legal name, unless you type those into a display name or into encrypted content
• Passphrases, private keys, or pair secrets
• Precise location, contacts, or an advertising id
• Payment information (the app does not take payments)

Hosting in front of the Submit Server may process IP addresses and ordinary request metadata to keep the service up and to deal with abuse. The app itself does not ask for or store location data.

End-to-end encryption

Pairing derives a shared pair key (HKDF-SHA256 over X25519). Chat, feature data, check-in photos, and other app data is sealed with XChaCha20-Poly1305 before it leaves the phone. The Submit Server sees nonce + ciphertext only.

Encryption protects the relay operator and Google from reading that content. Your paired partner can decrypt it. Anyone who has both an exported backup file and its passphrase, or a transfer QR, can take over the identity. Treat those like a password.

Photos, camera, and sensitive content

The camera permission is used to scan an invite QR and send photos in chat. Check-in photos use the system picker, not the camera permission. Before a photo is sent, the app compresses it to JPEG and strips EXIF, IPTC, and comment metadata (including location if the original file had it). The JPEG then goes through the app's encryption.

Check-ins, notes, chastity data, and chat can include intimate or sexual content. That is expected in this app. The Submit Server cannot read it. Only your partner can. If you save a received photo to the gallery, it then lives on your device under Android’s usual rules.

Google Firebase Cloud Messaging (FCM)

If Google Play services are available, the app may register an FCM token and send it to the Submit Server. When encrypted mail is waiting, the Submit Server can send a ping whose payload is only kind=mail. That ping does not include names, message text, or ciphertext. The phone then pulls encrypted mail from the Submit Server and decrypts it locally. Notifications you see are composed on the device.

Google provides FCM. Google may process the token, approximate location inferred from IP, device and app identifiers, and diagnostic data as described in Google’s Privacy Policy and Firebase documentation. We do not send your chat, photos, or display names through FCM.

The app does not include Google Analytics, Crashlytics, or advertising. If FCM is not configured, phones keep polling the Submit Server instead.

Permissions

• Internet — to reach the Submit Server and, when configured, FCM
• Notifications — pairing, chat, assignments, chastity, notes, and protocol reminders. You can disable in system settings.
• Camera — scan an invite QR and take photos for chat. You can refuse and paste an invite code or not use photo functions in the app
• Vibrate — notifications
• Storage (Android 9 and older) — save or send photos

How we use this information

• Creating and restoring a local identity
• Pairing two devices and showing each other the invite display name
• Holding and forwarding encrypted mail
• Waking a sleeping phone so it can poll
• Moving an identity to a new phone
• Deleting any of your data upon request

We do not sell, advertise, or permit any AI training with your data.

Who can see what

• You — everything on the phone, plus any backup you export
• Your paired partner — shared chat and features you both have on, including photos you send. Either role may pair with more than one Dom or Sub, each as a separate encrypted pair
• The Submit Server operator — plaintext pairing metadata listed above, plus ciphertext we cannot read
• Google — FCM token and empty wake-ups, plus anything Google collects to run Play services and FCM

We may disclose records if required by law. Ciphertext we cannot decrypt remains ciphertext.

Retention

• On the phone — until you wipe the device, delete the account, or uninstall (uninstall removes the local vault)
• On the Submit Server — device, pair, and envelope records last until you delete the account, leave the pair, or the pair is dissolved. Encrypted mail is not auto-expired while a pair is active
• Invites — an unused invite is replaced when you create a new one; used invites go away when the pair ends
• Transfer blobs — held so the new phone can fetch them, then deleted after a successful move (or when deleted)

Your choices

• Refuse camera or notification permissions and still use the rest of the app
• Turn a feature off on the Sub side; it stops even if the Dom still has it selected
• Leave a pair
• Wipe this device in Settings — this clears the phone after a move. It does not delete the mailbox, if that identity now lives on the new phone
• Delete account in Settings — erases this phone, your Submit Server mailbox, and ends your pairs. This cannot be undone
• Export a passphrase-sealed .submit-backup file, or move with a transfer QR

You can also send a deletion request at https://submit.pupsage.gay/help or email me@pupsage.gay so we can match Submit Server records to you. We cannot read or reconstruct encrypted content after the keys are gone.

Security

Traffic to the Submit Server uses HTTPS. Local vault storage uses Android encrypted preferences. Backups use Argon2id plus the same sealing scheme as encrypted app mail. Optional app lock (PIN and biometrics) stays on your phone and is not included in backups or sent to the Submit Server. No method is perfect: a compromised phone, a leaked backup plus passphrase, or a partner you paired with can expose content. Remember to wipe an old phone after a successful move.

Minors

Submit is not intended for anyone under the age of 18 (19-21 depending on your local age of majority). We do not knowingly collect personal information from minors. Suspected users under the age of 18 should be reported immediately to me@pupsage.gay with the user's Submit name, role, etc so that we may locate and remove the account and it's data.

International processing

The Submit Server is hosted where the operator runs it. Using the app means pairing metadata and ciphertext may be processed there. FCM is processed by Google in the regions Google uses for that service.

Changes

If Submit’s data practices change, we will update this page and the “Last updated” date. The current policy is always at https://submit.pupsage.gay/privacy and in Settings → Privacy policy.

Contact

Pup Sage
me@pupsage.gay

This notice describes the current Submit app and the Submit Server. It is not legal advice.