1. Introduction
1.1 English, Not Legalese
Most Terms of Use and Privacy Policy documents are unreadable. They are written by lawyers and for lawyers, and in our opinion are not very effective.
Privacy is important, and we want you to understand the issues involved. For that reason we decided to use plain English as much as possible, to make our position as clear as possible. Some sections still have room for improvement — we plan to tackle these over time and remain open to feedback.
Where you read Soratnik, it refers to the Soratnik Matrix chat client and related services made available by Yarus.
Where you read homeserver, it refers to a Matrix homeserver that stores the user account and personal conversation history, provides additional functionality such as bots and bridges, and (where enabled) communicates via the open Matrix decentralised communication protocol with the public Matrix Network.
Where you read the Service in this document, it refers to the Soratnik chat app and related services operated by Yarus.
Where you read Yarus or we or us below, it refers to Yarus and its agents.
Yarus is the Data Controller for personal data processed as described in this policy in connection with the Soratnik app (except where another party, such as a third-party homeserver operator, is the controller). We can be contacted as follows:
Email: clients@yarus.pro
Phone: +7 (343) 389-39-10
Should you have other questions or concerns about this document, please email clients@yarus.pro.
1.2 Scope of This Document
This document explains how we process personal data, as it relates to:
- Soratnik chat app users: users who use Soratnik to connect to any server that implements the Matrix Protocol.
- Homeserver operator role: where Yarus operates a homeserver used with Soratnik, additional processing may occur on that server. Where a third party operates the homeserver, that operator is typically responsible for messaging and file data on that server.
This document does not cover:
- Your relationship with a Matrix server if it isn't provided by Yarus: your account details and preferences, messages, files and any other data you share via the Matrix protocol are the responsibility of that Matrix server, and it is the provider of that server's job to make sure your data is handled appropriately and that you are well informed.
- Your relationship with identity servers: you might choose to use an identity server, to allow other Matrix users to discover you via Soratnik. This is optional and typically requires your explicit consent to discover users from your personal contacts.
Note: Element Classic sections about EMS hosting billing, Stripe payment cards, HubSpot, Salesforce, Salesloft and similar marketing automation do not apply to Soratnik as a Matrix chat client. This policy focuses on the Soratnik app experience.
1.3 The Homeserver Operator and the User
This document is designed to explain data protection issues relating to Soratnik users and, where relevant, Yarus as a homeserver operator. Put simply, you are a User if you have an account registered on a homeserver that you use to send and receive messages, or use the Soratnik chat app to connect to any server within the Matrix Protocol. You should consider these roles separately when thinking about data protection concerns if your organisation also operates a homeserver.
1.4 Changes to This Document
Over time we may make changes to this document. If we make a material change we will provide reasonable notice prior to the change where practicable. We will set forth the date upon which the changes will become effective; any continued use of Soratnik after the effective date will constitute acceptance of these changes, except where mandatory law requires a different process.
Your access and use of Soratnik is always subject to the most current version of this document.
2. Access to Your Data
2.1 What is the legal basis for processing my data and how does this affect my rights?
2.1.1 Legal Basis for Processing
Depending on the processing activity, we may rely on:
- Performance of a contract / provision of the Service you requested;
- Legitimate interests, for example to protect infrastructure against abuse, debug operational issues, and maintain security;
- Consent, where required (for example optional analytics or certain discovery features);
- Legal obligation, where we must process data to comply with law.
Processing is carried out in accordance with applicable laws of the Russian Federation (including personal data legislation) and, where they apply to you, other mandatory data protection rules.
2.1.2 Data Ownership — Messaging and File Data
Where a customer or organisation operates a homeserver, that operator typically owns and controls messages and files submitted to their homeserver by user accounts registered natively on that homeserver (subject to Matrix federation and bridging realities). This ownership does not extend to messages and files submitted over federation or bridging from other servers.
In addition to the usual data access controls defined by the Matrix protocol, unencrypted messages and files can be accessed by the homeserver operator, and that access may be retained even if no user account within the system retains access to the data. End-to-end encrypted (E2EE) room contents are not readable by Yarus or by homeserver operators in ordinary operation.
2.1.3 Your Rights as Data Subject
You have rights in relation to the personal data we hold about you. Some of these only apply in certain circumstances. Your rights under applicable data protection law may include:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
If you have any questions or are unsure how to exercise your rights, please contact us at clients@yarus.pro.
2.2 What Information Do You Collect About Me and Why?
The information we collect is for the purpose of supporting operation and improvement of the Soratnik app and related services, and — where we operate a homeserver — operating that server. We do not profile homeserver users' message contents for advertising.
2.2.1 Information you provide to us
We collect information about you when you input it into Soratnik or otherwise provide it directly to us. Depending on how you use the Service, this may include:
- Account identifiers such as Matrix user ID, display name, and avatar;
- Email address or phone number, if you choose to associate them with your account or contact us;
- Content you send in unencrypted rooms (messages, files, reactions), stored on the relevant homeserver;
- Support requests and bug reports you voluntarily submit;
- Reports you submit about other users or content (report / block).
Element Classic EMS customer billing fields, Stripe card storage, HubSpot/Salesforce lead pipelines and similar marketing CRM processing are not part of the Soratnik chat client offering described here.
2.2.2 Information we collect automatically as you use the service
Connection information. We may log IP addresses and related connection metadata of clients that access Soratnik-related services we operate. This data is used to mitigate abuse, debug operational issues, and monitor traffic patterns. Retention periods are kept only as long as needed for these purposes and in line with our operational policies.
Usage and diagnostics. If you opt in to analytics or crash reporting, we may collect anonymised or pseudonymised usage and diagnostic data (for example device type, app version, and crash traces) to improve the Service. Your use of Soratnik does not require opting in to optional analytics.
Error reports. When reporting errors we might collect information to help us find a solution. This may include your IP address, hostname, display name and e-mail address if included in the report. Submitted error reports are retained for a limited period.
Location information. We may process location data if you choose to use static or live location sharing features. This may include longitude, latitude and related data needed to display your location. Location data shared in a room follows that room's encryption settings: encrypted in E2EE rooms and not encrypted where encryption is off. Please apply caution when sharing location.
Calls. To provide audio and video calls where available, we or our processors may process network and usage information including IP addresses of participants, Matrix IDs / device IDs, timestamps and call type metadata. Call media in E2EE calls is not readable by us in ordinary operation.
Push notifications. Push tokens are generally used to authenticate a device against a push service (for example Apple or Google). These allow notifications on your device. The operating system provider may see limited metadata such as a room ID or event ID; encrypted message contents are not decrypted for push delivery in ordinary operation.
2.3 End-to-End Encryption (E2EE)
Soratnik supports Matrix end-to-end encryption for rooms where encryption is enabled. When E2EE is active, message contents and many attachments are encrypted on devices such that Yarus and homeserver operators cannot read them in ordinary operation. Encryption metadata, membership, room IDs and similar non-content data may still be processed by the homeserver as required by the Matrix protocol.
You are responsible for safeguarding your devices and recovery keys. If you lose access to all devices and recovery material for an E2EE account, we may be unable to recover your encrypted history.
2.4 Sharing Data in Compliance with Enforcement Requests and Applicable Laws; Enforcement of Our Rights
In exceptional circumstances, we may share information about you with a third party if we believe that sharing is reasonably necessary to:
- comply with any applicable law, regulation, legal process or governmental request,
- protect the security or integrity of our products and services (e.g. for a security audit),
- protect Yarus and our users from harm or illegal activities, or
- respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the serious bodily harm of any person.
Shared information is exclusively limited to what we are technically able to see, which means end-to-end encrypted information is never accessed by our teams or shared externally in ordinary operation.
2.5 How Do You Handle Passwords?
Where passwords are processed by a homeserver we operate, we never store password data in plain text; instead they are stored hashed using industry-appropriate algorithms. Passwords sent to the server are protected in transit using TLS/SSL.
It is your sole responsibility to keep your user name, password and other sensitive information confidential. Actions taken using your credentials shall be deemed to be actions taken by you, with all consequences including service termination, civil and criminal penalties where applicable.
Users should practise good password hygiene (e.g. using a password manager) and change their password if they believe their account is compromised.
If you forget your password (and you have registered an email address with the homeserver), you may use the password reset facility if offered by that homeserver. If you have not associated a recovery method with your account and forget your password, your account may be deemed lost.
2.6 Our Commitment to Children's Privacy
We never knowingly collect or maintain information through the Service from those we know are under 16 (or under 18 where a higher age is required by applicable law), and no part of Soratnik is structured to attract anyone under that age. If you are under the applicable age, please do not use the Service. If you believe a child has provided us with personal data, contact clients@yarus.pro.
2.7 How Can I Access or Correct My Information?
If you are a user of the Soratnik chat app you can request a copy of personal data we hold about you by emailing clients@yarus.pro. You can often correct profile information within the settings area of the Soratnik app or via your homeserver account management tools.
Data held solely by a third-party homeserver must be requested from that homeserver's operator.
When messages are redacted or accounts deprovisioned, residual copies may be retained for a short technical period before permanent deletion, consistent with Matrix semantics and our operational practices.
2.8 Reporting, Blocking and Moderation
Soratnik provides in-app tools to report and/or block users or content where available. We aim to review moderation reports within 24 hours where practicable. Our ability to remove content or suspend users depends on whether we operate the relevant homeserver and whether the content is end-to-end encrypted.
Related policies: Acceptable use policy · Copyright policy.
2.9 What Are the Guidelines We Follow When Accessing Data?
- We restrict who at Yarus (employees and contractors) can access non-encrypted operational data to roles which require access in order to maintain the health of the Soratnik apps and services.
- We never share what we see with other users or the general public, except as described in this policy or required by law.
- We never make attempts to decrypt end-to-end encrypted data.
2.10 Who Else Has Access to My Data?
We may use infrastructure and service providers (for example cloud hosting, push notification providers, map tile providers for location features, and crash reporting tools) as processors or independent controllers under their own terms. Those providers process data only as needed to deliver their service.
Nobody at Yarus, or any of our processors acting for us, is able to access end-to-end encrypted message contents in ordinary operation.
2.11 What happens if Yarus is sold?
In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets, subject to appropriate confidentiality and legal safeguards.
If we or substantially all of our assets are acquired by a third party, personal data held by us about our users will be one of the transferred assets.
2.12 How Is My Data Protected from Another User's Data?
Where multiple users' data resides within the same systems, we use software best practices to segment access so that users only see data they are authorised to see under the Matrix protocol and room membership. Like every other service that hosts user data on shared infrastructure, we cannot guarantee immunity to a sophisticated attack, but we work to reduce that risk.
2.13 What Should I Do If I Find a Security Vulnerability in the Service?
If you have discovered a security concern, please email us at clients@yarus.pro. We'll work with you to make sure that we understand the scope of the issue, and that we fully address your concern. Please act in good faith towards our users' privacy and data during your disclosure.
3. Making a Complaint
We try to meet high standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention at clients@yarus.pro or +7 (343) 389-39-10 if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
If you want to make a complaint about the way we have processed your personal information to a supervisory authority, you may contact the competent authority in the Russian Federation (or, where mandatory rules of another jurisdiction apply to you, the authority in that jurisdiction).
4. Governing Law
This privacy policy is governed by the laws of the Russian Federation, except where mandatory consumer or data protection rules of another jurisdiction that apply to you provide otherwise.
5. Document History
- 2026: Adaptation from Element Classic privacy policy (element.io) for Yarus and the Soratnik Matrix chat client; EMS/Stripe/HubSpot/Salesforce-heavy marketing sections removed or noted as not applicable; E2EE, report/block and 24-hour moderation aim emphasised; governing law updated to the Russian Federation.