Security and privacy at Falafy

• Optional two-factor authentication (2FA) to protect your login.
• Passwords stored as argon2 hashes, never in plain text, and password changes right in settings.
• You can see and end the open sessions on your account.
• You choose who can send you direct messages and can block anyone.

• Transport encryption (HTTPS/TLS) on the website, in the app and in the API.
• Voice and video calls with media encrypted in transit, both peer to peer and through the media server.
• End-to-end encryption of messages: in development. Today messages are stored on Falafy's server without this type of encryption.

• Falafy does not sell data and does not show ads.
• In small calls, media can travel directly between participants; larger rooms use Falafy's own media server, not a third-party service.
• Noise suppression runs on your device; audio is not sent to an external filtering service.
• You can export a copy of your data and request account deletion, in line with the LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law).
• No analytics, ad pixels or trackers on the website or in the app. Data is stored on servers in Brazil (Oracle Cloud, São Paulo).
• Everything that is processed, the legal basis and for how long is in the Privacy policy; the rules of use are in the Terms of use.

• The Windows installer is not digitally signed yet, so Windows SmartScreen may show a warning on first install. Always download from the official website, falafy.com.br.
• In 2026 Falafy underwent a penetration test (pentest), and the fixes that came out of it went into the app (blocking, ended sessions, message privacy and protection against fake pages that try to embed Falafy). This is not a certification: Falafy is an independent project in active development, with no external security audit published to date.
• To report a security issue, contact "Suporte Falafy" inside the app.

See also: what is Falafy · about the project