Logo of the Privacy by design label
Charter

Privacy by design in action: the architecture of true confidentiality

In a digital world where our data has become currency, a fundamental question arises: how can we communicate with confidence? The answer lies not in longer privacy policies or marketing promises, but in the very architecture of the applications we use.

Preamble

A pact of trust for the digital age

It is time to adopt a new paradigm, a Privacy by design model where privacy protection is not an added feature but the foundation on which everything is built. Here are the pillars of this architecture of trust.

At a time when personal data has become a commodity and surveillance the norm, trust in our digital tools has eroded. Marketing promises and opaque privacy policies are no longer enough. Real trust can only be restored by architectural proof, written into the very code of the applications we use.

The Privacy by design label is not a mere statement of intent. It is a technical and philosophical commitment. It certifies that the application displaying it was designed, from its very first line of code, around a fundamental principle: the unconditional protection of its users' privacy.

This charter defines the non-negotiable principles that an application must comply with to be eligible for this label. It constitutes a pact of transparency between developers and users, guaranteeing that privacy is not an option but the very foundation of the service.

The architecture of trust

Five principles of confidentiality

1. The absence of a centre: decentralised architecture (peer-to-peer)

Most online services operate like a central post office. Every message, every piece of data passes through a company's servers. This model, although simple, creates a single point of vulnerability: whoever controls the centre controls the data.

The new model removes this centre. It is inspired by the oldest form of communication: direct conversation. Applications built on this principle create peer-to-peer networks, where users' devices connect directly to each other.

The benefit for the user: there is no longer an intermediary that stores, analyses or can be compelled to hand over your exchanges. By removing the central server, we remove the possibility of mass surveillance at the source. It is the structural guarantee that nobody comes between you and your correspondent.

2. The shared secret: unconditional end-to-end encryption

In a secure architecture, encryption is not an option, it is a rule. Every piece of information, before it even leaves your device, is sealed in a cryptographic envelope. Only the final recipient holds the unique key that can open it.

This principle, known as end-to-end encryption, guarantees that even if some data were intercepted, it would remain a string of characters that nobody else could decipher.

The benefit for the user: this is a mathematical certainty. Your conversations, files and secrets stay private, out of reach of hackers, internet service providers and even the app's creators.

3. Sovereign identity: you are the key

Why should we tie our ability to communicate to a phone number, an email address or a social media profile? These identifiers anchor us in an ecosystem of surveillance and marketing.

A privacy-respecting architecture separates identity from personal information. Your account is no longer an entry in a database but a unique cryptographic key that only you control, generated and stored on your device. This is the principle of sovereign identity: you own and manage your own digital identity.

The benefit for the user: real anonymity and protection against profiling. You can interact freely without every action being tied to your real identity. There is no longer a centralised user database to hack or exploit.

4. Where the data lives: your device, your fortress

The cloud is convenient, but it is just somebody else's computer. Storing our most intimate conversations there is like handing the keys to our private diary to a third party.

The local-first model reverses this logic. By default the data stays on your device, encrypted and under your control. If a backup is needed, it must be encrypted with a key that only you hold, which makes the data unreadable to the storage provider.

The benefit for the user: total sovereignty over your data. You no longer depend on the security, the policies or the longevity of a third-party company. Your personal archives truly belong to you.

5. Network dynamics: resilience and concealment of metadata

Rather than a rigid, centralised structure, the network is formed by the participants themselves, in an organic and dynamic way. Messages do not follow a monitored motorway but intelligent paths optimised across this decentralised mesh.

This approach not only makes the network extremely resilient (there is no head to cut off), but also protects metadata, in other words the information about who is talking to whom. By carrying messages in encrypted form through other participants, it becomes extremely difficult to map social relationships.

The benefit for the user: double protection. Not only is the content of your messages secret, but the context of your conversations, your social circles, is protected too, which prevents profiling and the analysis of your relationships.

Conclusion

Build trust through code, not through words

The future of private communication will not be won with promises but with proof. That proof lies in the software architecture itself.

By choosing and promoting applications built on these pillars (decentralisation, end-to-end encryption, sovereign identity, local data and dynamic networks), we move from a model of trust granted to a model of trust verifiable. We create a digital environment where confidentiality is the norm, not the exception.

The charter

The charter, principle by principle

Every application bearing the Privacy by design label must implement all of the following architectural principles.

Principle I: decentralised architecture with no central trusted third party

The application must not rely on a central server to relay or store user communications. Connections must be established directly (peer-to-peer) as far as possible. The architecture must eliminate any central bottleneck that could become a point of surveillance or censorship.

Principle II: robust cryptography and systematic end-to-end encryption

All communications between users (messages, calls, file transfers) must be end-to-end encrypted by default and without exception. This means that only the people communicating can access the content of their exchanges. Encryption keys must be generated and stored on users' devices, making them inaccessible to any other party, including the application's developers.

Principle III: sovereign identity and anonymity by default

Using the application must not require any personally identifiable information (such as a phone number, an email address or a real name). The user's identity must be based on cryptographic keys that they generate and control themselves (sovereign identity). Anonymity must be the norm, and sharing personal information an explicit choice made by the user.

Principle IV: user control and local data (local-first)

User data, in particular conversation history and files, must be stored primarily and by default on users' own devices. Any form of cloud synchronisation or backup must be optional and necessarily end-to-end encrypted with keys controlled exclusively by the user. The user must be able to delete their data permanently.

Principle V: protection of metadata

The architecture must actively seek to minimise the collection and exposure of metadata (who communicates with whom, when, and how often). The use of mesh networks and routing techniques that obscure the origin and destination of messages is encouraged, to prevent social graph analysis and the mapping of relationships between users.

Commitment

The conditions for joining a labelled application

Developers of an application wishing to display the Privacy by design label undertake to comply with the following conditions.

Full membership

The application must demonstrably implement all five fundamental principles set out in this charter.

Architectural transparency

Developers must be able to explain publicly and transparently how their application's architecture complies with each principle. The use of open protocols and open source code is strongly encouraged as proof of this commitment.

Displaying the logo

The official Privacy by design label logo must be displayed prominently within the application (for example in an About screen, a settings menu, or on the welcome screen).

Link to the charter

The displayed logo must contain a hyperlink leading directly to this charter page, allowing users to verify the meaning and requirements of the label.

The label

What the label means for users

When you see the Privacy by design logo on an application, it acts as a seal of trust. It guarantees you that:

  • Your conversations are unreadable by anyone other than your correspondents.
  • Your identity is not tied to your personal information.
  • You have complete control over your data.
  • The application was designed from the outset to protect you, not to exploit you.
The label

Applications labelled Privacy by design

The list below covers the applications that have demonstrated their adherence to the principles of this charter and that comply with the conditions of engagement. It is updated as new applications join the label.

iCanText

Decentralised messaging. No central server, sovereign identity, local data.

Privacy by design

Discover

iCanSend

File transfer. Peer-to-peer tunnel, no third-party storage.

Privacy by design

Discover

iCanPhone

Voice calls. Volatile stream, never written to disk or local storage.

Privacy by design

Discover

Developers whose application complies with this charter may display the logo, provided they explain publicly how each principle is met and include a link to this page.

Privacy is not a luxury, it is a fundamental right

This charter is a commitment to a digital future where privacy is not a luxury but a fundamental human right built into the core of our technology. We invite developers worldwide to adopt these principles and join this movement for a safer, more respectful internet.