AbabilX Legal Policies

All legal documents are available on this single page for easy review and policy acceptance.

Your chats stay private

World-class secured messaging, built so you can trust it.

  • End-to-end encrypted

    Messages, photos, voice notes and files are locked on your device. No government, no military, no hacker — not even us — can open them.

  • Delivered, then deleted

    Our servers keep a message only until your phones have it. No chat history on our side to leak, seize, or hand over.

  • No email, no phone needed

    Start New Chat with nothing but your phone. Email and phone number are always optional.

  • Privacy mode

    One switch. Nobody sees you online, typing, or reading, nobody can find you by search, and nobody can add you to a group.

  • Ghost Chat & Local Share

    Phone to phone, never through our servers, never stored. One tap on the flame wipes a Ghost Chat from both phones.

  • No ads, no trackers

    No selling your data. Ever. Delete a chat or your account anytime.

What we can and cannot see, and where these protections stop, is spelled out in Sections 2 and 3 of the Privacy Policy below.

AbabilX Privacy Policy

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

Private by design, not by promise. Your messages are end-to-end encrypted on your device — no government, no military, no hacker, not even AbabilX can read them. Once your phones have a message, it is deleted from our servers. You can start without an email or a phone number. Turn on Privacy Mode and nobody sees when you are online, typing, or reading, and nobody can find you by search. We cannot hand over what we cannot read and do not keep.

1. Introduction

AbabilX ("AbabilX," "we," "us," or "our") is a private messenger: one-to-one and group chats, voice and video calls, file sharing, Ghost Chat, and Local Share, on Android, iPhone, web, and desktop. Teams can also use the AbabilX Workspace (Section 4). Together these are the "Service."

This Policy explains what we collect, why, how long we keep it, and the choices you have. It is written to be read. The short version:

  • We cannot read your messages. They are locked on your device with keys we never hold.
  • We do not keep your messages. Our servers deliver a message and delete it once your devices have it.
  • We need almost nothing to run your account. Email and phone number are optional.
  • No AI. AbabilX runs no AI models on your messages, files, calls, or workspace content, and never uses them to train one.
  • No ads, no trackers, no selling your data. Ever. We do not embed advertising, analytics, or profiling SDKs in any website or app, and we do not track you across other sites.

2. How We Protect Your Chats

2.1 End-to-End Encryption

Direct messages, group messages, and your Note to Self are end-to-end encrypted. Each message is locked on the sender's device with a key that exists only on the devices of the people in that conversation. Our servers only ever carry the locked form. Because we do not hold the keys, there is nothing we could give a government, a military, a court, or an attacker who breaks into our systems.

  • Photos, videos, voice notes, and files are encrypted on your device before they are uploaded — on the phone, the web, and desktop alike — each with its own key that only the people in the chat can open. Our storage holds locked data with a hidden name and type.
  • Your keys never leave your devices in a form we can open. They are created on your device. Moving them to a new device happens directly from your phone by QR code.
  • Notifications stay locked. On Android, a message notification arrives locked and is opened by your phone, not by us.
  • You can check for eavesdroppers. Every conversation has a safety number. If yours matches the other person's, nobody is sitting between you. The app warns you if a contact's key ever changes.

2.2 Delivered, Then Deleted

AbabilX does not keep your chat history on its servers. A message waits on our servers only until every device of every person in the conversation has received it — then it is permanently deleted, along with its files. If a device never comes back, the message is deleted after 30 days regardless. Your history lives on your own devices.

2.3 Ghost Chat

Ghost Chat goes directly from phone to phone. Its text and files never touch our servers and are never stored anywhere. One tap on the flame wipes it from both phones. For each photo or file you choose whether it disappears after a set time and whether the other person may save it.

2.4 Calls

One-to-one voice and video calls connect directly between the two devices and are encrypted by the call itself. When a network blocks a direct path, the call passes through our relay, which carries it but cannot decrypt it. Group calls are encrypted in transit. No call is recorded, and call content is never stored.

2.5 Local Share

Local Share sends text, files, and folders between your devices on the same Wi-Fi network. It never passes through our servers, and we never see what you share. Each device must be accepted by you once before it can send anything.

2.6 What We Cannot See, and What We Need

  • The text of your messages: The account details you choose to give (Section 7.1)
  • Your photos, videos, voice notes, and files: Who is in a conversation and when a message is sent, so it can be delivered
  • Your message keys: A device token, so your phone can be woken for a new message
  • Anything in Ghost Chat or Local Share: Your IP address at the moment of a connection, as every internet service does
  • What is said in your calls:

Exceptions. Messages posted into a conversation by an outside integration (a webhook feed) arrive from outside AbabilX and are not end-to-end encrypted. A group carried over from an older workspace channel becomes encrypted when a member's app sets up its key. Files sent before encrypted files were introduced stay in their original form until they are deleted.

3. Privacy Controls You Hold

3.1 Start Without Email or Phone

You can create an account with Start New Chat: no email address, no phone number, no name required. Your account is tied to a key on your phone. You may instead sign in with Google or with an email and password. Adding an email or phone number is always optional.

Phone numbers are never used to sign in or to recover an account. Searching for people by phone number is currently paused.

3.2 Privacy Mode

One switch in Settings, free for everyone. When it is on, for your direct messages and one-to-one calls:

  • Nobody sees your activity. People stop seeing when you are online, typing, or have read their messages. Their call screen never shows "Ringing."
  • Nobody can find you. You disappear from username, email, and phone search, and your QR code cannot be scanned to reach you.
  • Nobody can add you to a group.
  • Connected calls leave no trace in the other person's chat history.
  • Screenshots are blocked on the other person's Android phone while your chat or call is open.
  • You control every photo you send — view once, or disappear after 5, 10, or 30 seconds, and whether it may be saved. When the timer ends, the photo is deleted from our storage and from both phones.

You can also choose, person by person, to be always private or never private with someone, whatever the switch says.

3.3 Private Chat

Turn on private chat in any direct conversation and it binds both sides: no forwarding, no saving media, no call history, no threads, and screenshots blocked on Android. Notifications show only "New private message."

3.4 Group Privacy

A group's admins can switch on group privacy: nobody can forward or save anything, members see only the admins rather than the full member list, and screenshots are blocked for every member on Android.

3.5 Discovery

You decide whether people can find you by username or email. New accounts are not findable by username until you turn it on.

3.6 Your Own Backup

On Android, AbabilX keeps an automatic backup in a folder on your phone. The backup file is never uploaded to us. It is locked with a key tied to your account, so only you, signed in, can restore it.

3.7 Linked Devices

You can link up to five computers or browsers to your phone. Each keeps its own copy of your chats. A linked device that is unused for 14 days is signed out automatically, and you can sign any device out at any time.

Good to know. Screenshot blocking works on Android. Nothing can stop someone photographing a screen with another camera.

4. Workspace

AbabilX Workspace gives a team a shared Board and Wall. Workspace content is visible only to members of that workspace, according to the roles its owner sets, and the owner manages who is in it. Workspace data is encrypted in transit and at rest, protected by the same access controls and session security as the rest of the Service (Section 15), and never used for advertising or to train AI. Chats are entirely separate: a workspace grants no access to anyone's messages.

Workspaces may be on the Free or Plus plan. Plus is paid through bKash; we keep the payment record and never receive your bKash PIN.

5. Definitions

  • "Account" means your AbabilX account.
  • "Content" means what you create in the Service: messages, files, workspace posts and cards, and settings.
  • "Personal Data" means information relating to an identified or identifiable person.
  • "Subprocessor" means a provider that processes Personal Data for us, listed in our Subprocessor List.

6. Eligibility and Children

The Service is for people aged 18 or older. We do not knowingly collect Personal Data from anyone younger. If we learn that we have, we delete it and close the Account. Contact info@ababilx.com if you believe a minor is using AbabilX.

7. Information We Collect

7.1 Information You Give Us

  • Account details: a display name and username if you choose them, a profile picture if you add one, and an email address only if you sign in with email or Google. A phone number only if you add one.
  • Password: if you set one, we store only a one-way hash (argon2id). We cannot see your password.
  • Settings: language, theme, discovery, Privacy Mode, and notification choices.
  • Messages and files: carried in locked form only, and deleted once delivered (Section 2.2). Scheduled messages (Send later) are held locked until their send time.
  • Workspace content: board cards and wall posts you create in a workspace.
  • Payments: workspace Plus payment records (amount, transaction ID, seats, period).
  • Support: messages you send us.

7.2 Information Collected Automatically

  • Signed-in devices: device type, app version, and the IP address and time of sign-in, so you can see and sign out your own devices.
  • Delivery data: which conversation a message belongs to, its time and size, and which of your devices have received it.
  • Push tokens: a Firebase Cloud Messaging token per device, removed when you sign out or turn off notifications.
  • Security logs: sign-in attempts, rate-limit events, and errors, kept briefly to stop abuse.

We use no third-party analytics, advertising cookies, tracking pixels, or device fingerprinting. Our website and web app use only the browser storage needed to keep you signed in and remember your preferences (Cookie Policy).

7.3 Information from Others

  • Google: confirmation of your identity, only if you sign in with Google.
  • bKash: confirmation of a workspace payment.

We never buy data about you.

8. How We Use Information

  1. Run the Service — sign you in, deliver messages and calls, wake your phone for new messages.
  2. Keep it safe — stop spam, brute-force attempts, and abuse of our Acceptable Use Policy.
  3. Manage workspace plans.
  4. Tell you what matters — security alerts, policy changes, and reminders before an unused account is deleted (Section 12).
  5. Meet legal obligations (Section 10.3).

We never use your information for advertising, profiling, or training AI models.

9. Legal Bases for Processing

Where the GDPR or similar laws apply:

  • Running your Account and delivering messages and calls: Contract (Art. 6(1)(b))
  • Security logs, rate limiting, abuse prevention: Legitimate interest (Art. 6(1)(f))
  • Optional email and phone number: Consent (Art. 6(1)(a)) — withdraw it any time
  • Payment records and lawful requests: Legal obligation (Art. 6(1)(c))

More detail: GDPR Compliance Statement.

10. How We Share Information

Our policy is simple: we never share your data with anyone. Not with advertisers, not with data brokers, not with partners, not with governments on request. We do not sell or rent Personal Data, and we never have. The only parties that touch your data are the ones below, and none of them can read your messages.

10.1 Providers Who Help Run the Service

Hosting, file storage, push notifications, and email are run by providers that only carry data on our behalf — this is not sharing. They are bound by contract to use it for nothing else (Subprocessor List). File storage holds only the locked form of chat files.

10.2 People You Talk To

The people in a conversation see what you send them, your name, picture, and username. In a workspace, members see the content of that workspace.

10.3 Legal Requests

We never hand over data voluntarily or informally. Only a binding legal order can compel us, and even then we can give only the little we hold (Section 7.1). We cannot provide the content of your messages, files, calls, Ghost Chats, or Local Share transfers to anyone, because we cannot read them and we do not keep them. Where we are allowed to, we tell you before disclosing anything, and we challenge requests we believe are overbroad.

10.4 Business Transfers

If AbabilX is merged or sold, any successor must keep commitments at least as protective as this Policy, and we will tell you first.

11. International Data Transfers

AbabilX is operated from Bangladesh and uses infrastructure in several countries. Where data leaves a region that restricts transfers (such as the EEA, UK, or Switzerland), we use Standard Contractual Clauses (Data Processing Addendum). Your messages travel locked wherever they go.

12. Data Retention

  • Messages and their files: Until every recipient device has them, then deleted. At most 30 days
  • Ghost Chat and Local Share: Never stored
  • Timed and view-once photos: Deleted when the timer ends
  • Scheduled messages: Until sent or cancelled
  • Account details: While your Account exists
  • An unused Account: Deleted after 30 days without use, after several reminders
  • Signed-in device records: Until the device signs out; unused linked devices after 14 days
  • Workspace content: Until you or the workspace owner delete it
  • Security logs: A short rolling window, typically up to 90 days
  • Payment records: As long as tax law requires

13. Your Rights and Choices

You may access, correct, delete, or export your data, object to processing, withdraw consent, and complain to your data-protection authority. Most of this is in the app: edit your profile, remove your phone number, change discovery, turn on Privacy Mode, sign out devices, delete chats, and delete your Account. For anything else, email info@ababilx.com — we reply within 30 days and never treat you differently for asking.

14. Account Deletion

Delete your Account at any time in the app: Settings → Account → Delete account on your phone, or, for an account with no phone signed in, Settings → Security → Delete account on desktop. You can also email info@ababilx.com — see our Account Deletion guide. An Account unused for 30 days is deleted automatically. Deletion removes your profile, settings, devices, and any messages and files still waiting for delivery. It cannot be undone. Messages already on other people's phones stay on their phones. If you own a workspace, deleting your Account deletes that workspace too.

15. Security

  • End-to-end encryption for messages and every chat file (Section 2.1).
  • Delivery-only storage: a breach finds no chat history, because there is none to find.
  • Encryption in transit and at rest for everything else (TLS, encrypted storage).
  • Short-lived sign-in tokens, rotating refresh tokens, and instant sign-out of any device.
  • Passwords hashed with argon2id; sign-in attempts rate-limited and locked after repeated failures.
  • Least-privilege access for the few people who operate the Service.

Full detail: Security Policy. Found a vulnerability? See our Vulnerability Disclosure Policy.

16. Incident Response

If a security incident affects your Personal Data, we notify you without undue delay (within 72 hours to regulators where the GDPR applies), explain what happened and what we did, and cooperate with authorities.

17. Regional Disclosures

  • EEA, UK, Switzerland: GDPR rights and legal bases in Sections 9 and 13 (GDPR Compliance Statement).
  • California: we do not sell or share personal information as the CCPA/CPRA defines it (CCPA/CPRA Compliance Statement).
  • Brazil (LGPD), Singapore (PDPA), India (DPDP Act): the rights in Section 13 apply; exercise them at info@ababilx.com.
  • Bangladesh: AbabilX is operated from Bangladesh and follows applicable Bangladeshi law. We apply the protections in this Policy to every user, wherever they are.

18. Changes to This Policy

Every change is versioned below. For changes that affect your rights, we tell you in the app before they take effect.

19. Contact

All privacy, security, and legal questions: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

20. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Rewritten for AbabilX as a private messenger. Added delivery-only storage (messages deleted once delivered, 30-day maximum), encrypted files on every app, accounts without email or phone, private chat, group privacy, per-person Privacy Mode, local backup, linked devices, Local Share, and unused-account deletion. Workspace limited to Board and Wall. Removed developer-tool, AI, GitHub, and Slack sections.
  • Version: 1.2.0 | Date: September 23, 2026 | Summary: Added Privacy Mode.
  • Version: 1.1.0 | Date: September 19, 2026 | Summary: Added end-to-end encryption sections.
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Terms of Service

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Acceptance of These Terms

These Terms of Service (the "Terms") are a binding agreement between you and AbabilX ("AbabilX," "we," "us," "our") governing your access to and use of AbabilX: the AbabilX Chat messenger, the AbabilX Workspace (Board and Wall), our websites, and our mobile, web, and desktop apps (collectively, the "Service").

By creating an Account, clicking to accept, or using the Service, you agree to these Terms, our Privacy Policy, our Acceptable Use Policy, and the other policies referenced in these Terms, each of which is incorporated by reference. If you do not agree, do not use the Service.

If you use the Service on behalf of an organization, you represent that you have authority to bind that organization, and "you" includes both you and the organization.

2. Definitions

Capitalized terms have the meanings given here or where first defined:

  • "Account" — your registered AbabilX account.
  • "Customer Content" — everything you create or send in the Service: messages, files, calls, workspace cards and posts, and settings.
  • "Documentation" — the usage guides and help pages we publish for the Service.
  • "Order" — a purchase of workspace Plus.
  • "Plan" — a workspace's tier, Free or Plus, with the features and limits published at the time. AbabilX Chat has no plans and is free.
  • "Workspace" — a team space in the Service with a shared Board and Wall.

3. Eligibility

To use the Service you must:

  1. be at least 18 years old;
  2. have the legal capacity to enter a binding contract;
  3. not be barred from using the Service under the laws of any applicable jurisdiction, including export-control and sanctions laws (Section 18);
  4. not have been previously suspended or removed from the Service for cause.

4. Accounts

4.1 Registration

You can create an Account with Start New Chat, which needs no email address or phone number and ties the Account to a key kept on your phone, or by signing in with Google or with an email and password. Adding an email or phone number is optional. One person may not use multiple Accounts to evade enforcement actions.

4.2 Account Security

You are responsible for all activity under your Account. You must:

  • safeguard your phone, which holds your account key and your message keys;
  • keep sign-in QR codes and device-link codes confidential, and approve only devices you recognise;
  • notify info@ababilx.com promptly of any unauthorized use or suspected compromise.

We are not liable for loss caused by unauthorized use of your Account arising from your failure to protect your devices or credentials.

Important: Because your messages are end-to-end encrypted and are not kept on our servers once delivered, we cannot recover your messages for you. Your chat history lives on your devices and in your local backup. An Account created with Start New Chat exists only through the key on your phone: signing out of it, or losing that phone without a backup, ends it for good.

4.3 Workspaces

A Workspace owner controls its membership, roles, settings, Board, and Wall, and may remove members or delete the Workspace. Content you add to a Workspace is visible to its members according to its roles and may remain with the Workspace after you leave. A Workspace grants no access to anyone's chats.

5. Plans, Subscriptions, and Billing

5.1 Plans

AbabilX Chat is free, with no plans and no paid tiers. A Workspace is on the Free or Plus plan; limits such as boards and storage are published in the Service. We may change Plan features prospectively; material reductions to Plus take effect no earlier than the end of the paid period.

5.2 Payment

Workspace Plus is bought per seat for a chosen number of months and paid through bKash. It does not renew automatically. Payment, verification, and refund rules are in our Billing & Refund Policy, which forms part of these Terms.

5.3 Taxes

Prices include applicable taxes unless stated otherwise.

5.4 Expiry

When Plus ends, the Workspace returns to Free. Nothing is deleted; while the Workspace is above the Free limits, you cannot add more boards or files until you renew or make room.

6. License and Access

Subject to these Terms and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable license to access and use the Service and Documentation for your internal business or personal purposes during the term of your Account.

You may not, except as expressly permitted by these Terms or by law that cannot be excluded:

  1. copy, modify, translate, or create derivative works of the Service;
  2. reverse engineer, decompile, or disassemble the Service, or attempt to derive its source code, except to the extent such restriction is prohibited by applicable law;
  3. rent, lease, sell, sublicense, or otherwise commercially exploit access to the Service;
  4. remove or obscure proprietary notices;
  5. use the Service to build a competing product by systematically extracting its features or content;
  6. circumvent Plan limits, rate limits, or security controls.

7. Customer Content

7.1 Your Ownership

You retain all rights in your Customer Content. These Terms do not transfer ownership of your messages, files, posts, or settings to us.

7.2 License to Us

You grant AbabilX a worldwide, non-exclusive, royalty-free license to host, store, reproduce, process, transmit, display, and modify Customer Content solely as necessary to (a) provide and secure the Service, and (b) deliver what you send to the people you send it to. For end-to-end encrypted content this license covers only carrying the locked form, which we cannot read. This license ends when the Customer Content is deleted from the Service, subject to the retention periods in the Privacy Policy, Section 12.

7.3 Your Responsibilities

You represent and warrant that you have all rights necessary to submit your Customer Content and to grant the license above, and that your Customer Content and your use of the Service do not violate law or third-party rights. You — not AbabilX — are responsible for what you send and post.

8. End-to-End Encryption and Your Content

8.1 We Cannot See Your Messages

Your chats are end-to-end encrypted and deleted from our servers once delivered (see the Privacy Policy, Section 2). We do not and cannot scan, read, or moderate their content. You agree that we are not responsible for content sent between users that we have no technical ability to see.

8.2 Reports and Blocks

You can block anyone and report a conversation from inside the app. A report tells us who reported whom and when; it never includes message content. We may act on reports, on repeated reports, and on account-level signals such as spam patterns, including by suspending Accounts under Section 19.

8.3 No AI on Your Content

AbabilX does not run AI models on your messages, files, calls, or workspace content, and does not use them to train any model.

9. Third-Party Services

If you sign in with Google, Google's own terms apply to that sign-in. Links and files that other people send you may lead to third-party websites, which we do not control. Link previews are fetched by your own device.

10. API and Developer Terms

If you access the Service programmatically through our REST API or future developer tools, the Developer & API Policy applies in addition to these Terms. In summary: keep credentials confidential, respect rate limits, do not misrepresent your application, and do not use the API to reconstruct or resell the Service.

11. Acceptable Use

You must comply with our Acceptable Use Policy ("AUP"), which is incorporated into these Terms and prohibits, among other things: unlawful content and activity, malware, phishing, spam, harassment, unauthorized access attempts, rate-limit and quota evasion, cryptocurrency abuse, and and abusing privacy features to harass others. Violations may result in suspension or termination under Section 19.

12. Intellectual Property

12.1 Our Property

The Service, including its software, design, text, graphics, logos, and Documentation, is owned by AbabilX or its licensors and is protected by intellectual-property laws. Except for the license in Section 6, no rights are granted to you by implication or otherwise.

12.2 Trademarks

"AbabilX" and our logos are trademarks of AbabilX. You may not use them without prior written permission, except for truthful, nominative references to the Service.

12.3 Open Source

The Service incorporates open-source components licensed under their own terms. The source code of the AbabilX Chat Android app is published at https://github.com/AbabilX/ababilx-mobile under the GNU Affero General Public License v3.0. Nothing in these Terms, including Section 6, limits your rights under, or grants you rights that supersede, the applicable open-source licenses. Attribution notices are available in the Service or Documentation where required.

13. Feedback

If you send us suggestions, ideas, or other feedback about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free license to use it for any purpose without obligation or compensation to you. Do not send feedback you consider confidential.

14. Beta and Experimental Features

We may offer features identified as beta, preview, experimental, or "coming soon." Such features: (a) may change or be withdrawn at any time without notice; (b) may be subject to additional terms or usage caps; (c) are provided as-is without the service commitments applicable to generally available features; and (d) should not be relied upon for production-critical workflows. Feedback on beta features is governed by Section 13.

15. Service Availability and Modifications

15.1 Availability

We work to keep the Service available and performant, but the Service is provided without an uptime guarantee. Access may be interrupted by maintenance, updates, infrastructure failures, third-party platform outages, or events beyond our control.

15.2 Maintenance

We may perform scheduled or emergency maintenance. Where practicable, we announce scheduled maintenance in advance through the Service.

15.3 Modifications

We may modify the Service, including adding, changing, or removing features. If a change materially reduces core functionality of a paid Plan, we will notify affected subscribers, who may cancel and receive a pro-rated refund of prepaid, unused fees for the affected period as their exclusive remedy.

16. Privacy and Security

Our collection and use of Personal Data is described in the Privacy Policy. Our security practices are described in the Security Policy. Business customers requiring contractual data-processing terms may execute our Data Processing Addendum.

17. Copyright Complaints

We respond to notices of alleged copyright infringement under our Copyright & DMCA Policy. Repeat infringers' Accounts will be terminated in appropriate circumstances.

18. Export Control and Sanctions

You may not use the Service in violation of export-control or sanctions laws applicable to you or to us, including regulations administered by the U.S. Office of Foreign Assets Control and equivalent authorities. You represent that you are not located in, organized under the laws of, or ordinarily resident in a comprehensively sanctioned jurisdiction, and that you are not a sanctioned or restricted party or acting on behalf of one.

19. Suspension and Termination

19.1 By You

You may stop using the Service and delete your Account at any time (see Privacy Policy, Section 14). Fees already paid are handled per the Billing & Refund Policy.

19.2 By Us

We may suspend or terminate your access, with or without notice, if:

  1. you materially breach these Terms or the AUP;
  2. your use creates security, legal, or operational risk to the Service or others;
  3. payment for a paid Plan fails and is not cured;
  4. we are required to do so by law;
  5. we discontinue the Service (in which case we will give reasonable advance notice and a refund of prepaid, unused fees).

Where the cause is curable and does not pose immediate risk, we will make reasonable efforts to notify you and give you an opportunity to cure before termination.

19.3 Effect of Termination

Upon termination: your license ends; scheduled messages are cancelled; and your data is handled per the retention and deletion terms of the Privacy Policy. Sections that by their nature should survive — including 7.2 (for stored data during wind-down), 12, 13, 20, 21, 22, 23, and 24 — survive termination.

20. Warranty Disclaimer

THE SERVICE AND DOCUMENTATION ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, ABABILX AND ITS SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, THAT DEFECTS WILL BE CORRECTED. BECAUSE MESSAGES ARE NOT KEPT ON OUR SERVERS, WE ARE NOT LIABLE FOR MESSAGES LOST WITH A DEVICE.

SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES; TO THAT EXTENT, THE ABOVE EXCLUSIONS APPLY TO THE MAXIMUM EXTENT PERMITTED AND YOUR STATUTORY RIGHTS ARE UNAFFECTED.

21. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

  1. NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, GOODWILL, OR DATA, EVEN IF ADVISED OF THE POSSIBILITY;
  2. ABABILX'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE OR THESE TERMS IS LIMITED TO THE GREATER OF (A) THE AMOUNTS YOU PAID US FOR THE SERVICE IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO LIABILITY, OR (B) FIFTY U.S. DOLLARS (USD $50).

THESE LIMITATIONS DO NOT APPLY TO: (i) LIABILITY THAT CANNOT BE LIMITED UNDER APPLICABLE LAW; (ii) A PARTY'S FRAUD OR WILLFUL MISCONDUCT; OR (iii) YOUR PAYMENT OBLIGATIONS. THE LIMITATIONS IN THIS SECTION APPLY REGARDLESS OF THE THEORY OF LIABILITY AND EVEN IF A REMEDY FAILS OF ITS ESSENTIAL PURPOSE.

22. Indemnification

You will defend, indemnify, and hold harmless AbabilX and its officers, directors, employees, and agents from and against claims, damages, liabilities, costs, and expenses (including reasonable legal fees) arising from: (a) your Customer Content; (b) your use of the Service in violation of these Terms, the AUP, or applicable law; or (c) your violation of third-party rights. We will promptly notify you of any such claim and may participate in its defense with counsel of our choosing at our expense. You may not settle a claim in a way that imposes obligations on us without our written consent.

23. Governing Law and Dispute Resolution

23.1 Governing Law

These Terms are governed by the laws of Bangladesh, without regard to conflict-of-laws rules. If you are a consumer in a jurisdiction whose mandatory consumer-protection laws grant you additional rights, those rights are unaffected.

23.2 Informal Resolution First

Before starting formal proceedings, you agree to contact info@ababilx.com describing the dispute; both parties will attempt in good faith to resolve it within 30 days.

23.3 Arbitration

Any dispute not resolved informally shall be finally settled by binding arbitration seated in Dhaka, Bangladesh, under the Arbitration Act, 2001 (Bangladesh), by a sole arbitrator, conducted in English. Judgment on the award may be entered in any court of competent jurisdiction. Either party may instead seek: (a) relief in small-claims court for qualifying disputes; or (b) injunctive relief in any competent court for infringement or misuse of intellectual property or confidential information.

23.4 No Class Actions

To the extent permitted by law, disputes must be brought on an individual basis; class, collective, and representative proceedings are waived. If this waiver is found unenforceable for a particular claim, that claim shall proceed in court, not arbitration.

24. General Provisions

  1. Entire Agreement. These Terms, together with the policies incorporated by reference and any Order, are the entire agreement between you and AbabilX regarding the Service and supersede all prior agreements on that subject.
  2. Severability. If any provision is held unenforceable, it will be modified to the minimum extent necessary, and the remainder stays in effect.
  3. No Waiver. Failure to enforce a provision is not a waiver of the right to enforce it later.
  4. Assignment. You may not assign these Terms without our prior written consent. We may assign them in connection with a merger, acquisition, or sale of assets, with notice to you.
  5. Force Majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disasters, war, terrorism, labor disputes, governmental action, and internet or utility failures. Payment obligations are excluded.
  6. Notices. We may notify you through the Service, or at your account email if you have one. Legal notices to us go to info@ababilx.com and by post to AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.
  7. Independent Contractors. The parties are independent contractors; these Terms create no partnership, joint venture, or agency.
  8. Headings and Interpretation. Headings are for convenience. "Including" means "including without limitation."
  9. Changes to These Terms. We may update these Terms. Material changes will be notified through the Service or by email at least 14 days before taking effect; continued use after the effective date constitutes acceptance. If you do not agree, stop using the Service before the effective date and, for paid Plans, request a pro-rated refund of prepaid, unused fees for the remaining period.
  10. Survival. Provisions identified in Section 19.3 survive termination or expiration.

25. Contact

  • Legal notices and disputes: info@ababilx.com
  • General support: info@ababilx.com
  • Billing: info@ababilx.com

Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

26. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Rewritten for AbabilX Chat and Workspace (Board and Wall). Added accounts without email or phone, encryption and content (Section 8), free chat, and workspace Plus by bKash with no auto-renewal. Removed AI output, GitHub, Slack, automation, and Premium terms.
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Acceptable Use Policy

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Purpose and Scope

This Acceptable Use Policy ("AUP") defines conduct that is prohibited on the AbabilX Service. It applies to every user, Account, Team, and client (web, desktop, mobile, API, and any future CLI or browser extension), and to all content transmitted through or stored on the Service. It forms part of our Terms of Service.

2. Definitions

Terms defined in the Terms of Service and Privacy Policy have the same meanings here. "Content" includes Customer Content and anything you send or post through the Service.

3. General Standard

Use the Service lawfully, honestly, and without harming the Service, other users, third-party platforms, or third parties. Where a specific behavior is not listed below but is of the same character as a listed prohibition, it is equally prohibited. If you are unsure whether a use is acceptable, ask info@ababilx.com before proceeding.

4. Prohibited Conduct

4.1 Illegal Activity

You may not use the Service to:

  1. violate any applicable law or regulation;
  2. store, transmit, or distribute content that is illegal in your jurisdiction or ours;
  3. facilitate, promote, or provide instructions for criminal activity;
  4. launder money or move proceeds of crime;
  5. evade sanctions or export-control restrictions (see Terms of Service, Section 18);
  6. infringe another party's copyright, trademark, patent, trade secret, or other rights;
  7. violate another person's privacy or data-protection rights, including collecting Personal Data without a lawful basis;
  8. distribute child sexual abuse material or any content sexualizing minors (reported to authorities without exception);
  9. traffic in stolen data, credentials, or financial instruments;
  10. sell or promote illegal goods or services.

4.2 Security Violations

You may not:

  1. access or attempt to access another user's Account, data, tokens, or sessions;
  2. probe, scan, or test the vulnerability of the Service outside the Vulnerability Disclosure Policy;
  3. breach or circumvent authentication, authorization, or policy-gate controls;
  4. forge, replay, tamper with, or fabricate tokens, exchange codes, connect tickets, cookies, or webhook signatures;
  5. brute-force pairing codes, exchange codes, webhook tokens, or any credential;
  6. intercept or monitor traffic between other users and the Service;
  7. introduce malware, ransomware, spyware, keyloggers, cryptominers, logic bombs, or any malicious code;
  8. use the Service to develop, host, distribute, or command-and-control malware;
  9. conduct denial-of-service or resource-exhaustion attacks against the Service or any third party;
  10. exploit a vulnerability for any purpose other than good-faith reporting under our disclosure policy;
  11. steal, harvest, or attempt to extract credentials, API keys, access tokens, or device keys of any party;
  12. exfiltrate data through crafted payloads or injection techniques;
  13. attempt to read other users' encrypted content, keys, or sealed metadata;
  14. disable, overload, or impair any part of the Service's infrastructure.

4.3 Abuse of Platform Mechanics

You may not:

  1. circumvent, or attempt to circumvent, rate limits, quotas, or plan limits;
  2. create multiple Accounts to evade limits, bans, billing, or enforcement;
  3. share one Account among multiple people to evade per-user limits;
  4. automate account creation;
  5. resell, sublicense, or provide third parties access to the Service without authorization;
  6. use the free plan programmatically at scale to substitute for a paid plan;
  7. abuse retry mechanisms to exceed sending budgets or other allowances;
  8. scrape the Service, or bulk-download content you do not own, outside documented API access;
  9. use the API in violation of the Developer & API Policy;
  10. cache or store other users' data beyond what a permitted integration requires;
  11. interfere with the Service's operation, updates, or security mechanisms;
  12. remove, obscure, or falsify attribution or provenance information the Service attaches to content;
  13. abuse webhook endpoints with junk, oversized, or malicious payloads;
  14. register misleading webhook integrations to capture data not intended for you.

4.4 Misuse of Privacy Features

Privacy features exist to protect people, not to hide abuse. You may not:

  1. use Ghost Chat, timed photos, private chat, or Privacy Mode to harass, threaten, extort, or exploit anyone;
  2. use Local Share to send content to a device whose owner has not accepted it, or to spread malware;
  3. use encryption to share content that is illegal to possess or distribute;
  4. create Accounts in bulk with Start New Chat, or use new Accounts to evade a block or a suspension;
  5. use another person's phone or linked device to read or send their messages without permission;
  6. use scheduled messages to flood a person or group;
  7. impersonate someone through a display name, picture, or username;
  8. misuse reports or blocks to target someone falsely.

4.5 Spam and Deceptive Practices

You may not:

  1. send spam, bulk unsolicited messages, or chain content through any Service feature (chat, groups, wall, webhooks);
  2. use scheduled messages to flood channels or recipients;
  3. engage in phishing, or create content that impersonates login pages, security notices, or other trusted communications;
  4. impersonate any person, organization, or AbabilX itself;
  5. misrepresent your affiliation or the origin of content;
  6. distribute deceptive synthetic or doctored media presented as genuine where that is materially misleading;
  7. manipulate reactions, polls, or task status to deceive a team or third party;
  8. operate pyramid schemes, advance-fee fraud, fake giveaways, or other fraudulent schemes;
  9. engage in payment fraud, including using stolen payment instruments or initiating illegitimate chargebacks;
  10. abuse trials, promotions, or referral mechanics through fabricated identities.

4.6 Cryptocurrency and Resource Abuse

You may not:

  1. mine cryptocurrency using Service infrastructure;
  2. use automation features to farm airdrops, testnet rewards, or activity-based token distributions deceptively;
  3. operate wallet-draining, rug-pull, or other crypto-fraud schemes through the Service;
  4. use the Service as infrastructure for unregistered securities offerings or scam token promotion.

4.7 Harassment and Harmful Content

You may not post, store, or transmit content that:

  1. harasses, bullies, threatens, or intimidates any person;
  2. incites or glorifies violence against people or groups;
  3. is hate speech — attacking people based on race, ethnicity, national origin, religion, caste, sexual orientation, gender identity, disability, or serious disease;
  4. sexualizes anyone without consent, or constitutes non-consensual intimate imagery;
  5. doxxes — publishing another's private information (home address, government ID, private contact details) without consent;
  6. stalks or enables stalking or surveillance of another person;
  7. encourages self-harm or suicide;
  8. constitutes terrorist or violent-extremist content or recruitment;
  9. defames another person with reckless or knowing falsehood;
  10. exploits or endangers minors in any way.

Team-space behavioral norms are further described in our Community Guidelines.

4.8 Misuse of Groups and Workspaces

You may not:

  1. add people to groups to spam or harass them;
  2. post deliberately false updates on a Board or Wall to deceive a team, employer, or client;
  3. use group admin powers to exploit or intimidate members;
  4. run a group or workspace for coordinated inauthentic behaviour;
  5. scrape a group's members to contact them for unsolicited marketing;
  6. mass-forward content to spread spam or misinformation;
  7. use webhooks or bots to post content prohibited elsewhere in this AUP;
  8. share another person's private content from a chat without their consent where the law protects it.

4.9 Reverse Engineering and Competitive Misuse

You may not:

  1. reverse engineer, decompile, or disassemble the Service except where law grants an unwaivable right;
  2. bypass technical protections on the desktop, mobile, or web clients;
  3. systematically extract Service features or data to build or train a competing product;
  4. benchmark and publish results in a misleading manner that misrepresents the Service;
  5. access the Service to monitor its availability or functions on behalf of a competitor without our consent.

4.10 Infrastructure and Network Abuse

You may not:

  1. use the Service as an open proxy, relay, or anonymization layer for attacks;
  2. spoof network identifiers or headers to disguise abusive traffic;
  3. distribute or coordinate botnets;
  4. conduct port scanning or network reconnaissance of our systems or third parties from the Service;
  5. abuse presigned upload URLs to host unrelated files, pirated content, or malware;
  6. use storage features as a general-purpose CDN or file-sharing service for content unrelated to the Service's purpose;
  7. embed the Service in a frame or wrapper that misleads users about what they are interacting with.

4.11 Data Misuse

You may not:

  1. collect or harvest other users' Personal Data from the Service;
  2. use team features to surveil members beyond the feature's disclosed purpose;
  3. re-identify or attempt to re-identify de-identified data;
  4. retain data from a Team after your authorized access ends, beyond copies you lawfully own;
  5. sell or broker data obtained through the Service;
  6. use workspace data to violate employment or privacy law.

4.12 Integrity of Legal and Billing Processes

You may not:

  1. submit false DMCA notices or counter-notices (see Copyright & DMCA Policy);
  2. submit fraudulent privacy or data-subject requests targeting another person's data;
  3. abuse support channels through threats, deception, or vexatious volume;
  4. misrepresent your identity or authority in any legal, billing, or verification process;
  5. evade payment through technical manipulation of plan enforcement;
  6. file chargebacks for services legitimately received, in lieu of the refund process in the Billing & Refund Policy.

5. Examples

Example — privacy feature misuse (prohibited, item 39): sending a view-once photo to pressure or blackmail someone.

Example — permitted use: sending a view-once photo of a document so it does not stay on a friend's phone.

Example — rate-limit evasion (prohibited, items 25–26): after receiving HTTP 429 responses, rotating through several accounts or IP addresses to continue hammering the sign-in endpoint.

Example — permitted retry: honoring Retry-After and backing off exponentially.

Example — workspace misuse (prohibited, item 72): moving Board cards to Done for work that was never done, to mislead a client.

Example — permitted use: moving a card back to In progress when a fix turns out incomplete.

Example — security research: testing whether our WebSocket handshake leaks tokens is in scope for good-faith research under the Vulnerability Disclosure Policy; testing it by hijacking another user's live session is not (item 11).

6. Reporting Violations

Report suspected violations to info@ababilx.com (or info@ababilx.com for security matters) with the relevant account, content, or URL and a description. We review reports promptly and keep reporter identities confidential except where disclosure is legally required.

7. Enforcement

We may, at our discretion and proportionate to the violation:

  1. remove or disable content;
  2. pause or delete offending automations (rules, jobs, webhooks);
  3. throttle, suspend, or restrict features of an Account or Team;
  4. suspend or terminate Accounts (see Terms of Service, Section 19);
  5. revoke API or integration access;
  6. notify affected third-party platforms;
  7. report to law enforcement where we believe conduct is criminal, and preserve related records.

For minor, curable violations we will ordinarily warn first. Violations involving illegality, security attacks, minors, or imminent harm result in immediate action without notice.

8. Appeals

If you believe an enforcement action was mistaken, reply to the enforcement notice or write to info@ababilx.com within 30 days with the facts you believe we got wrong. A person not involved in the original decision will review the appeal and respond.

9. Changes to This Policy

We may revise this AUP as new abuse patterns emerge, recording changes in Section 11. The version in force at the time of the conduct governs enforcement.

10. Contact

Abuse reports: info@ababilx.com · Security: info@ababilx.com · Legal: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

11. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Replaced integration, automation and AI rules with rules on misuse of privacy features (4.4) and of groups and workspaces (4.8).
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Security Policy

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Purpose and Scope

This Security Policy describes the technical and organizational measures AbabilX uses to protect the Service and the data entrusted to it. It covers our web, desktop, mobile, and API surfaces and the infrastructure behind them. It is a statement of practice, not a contract; contractual security commitments for business customers are made in the Data Processing Addendum.

Our commitment: We treat user security and privacy as foundational requirements, not optional features. Every layer of the Service — authentication, transport, storage, access control, and monitoring — is designed to keep your data confidential, intact, and available only to you and those you authorize.

2. Definitions

  • "Access token" — a short-lived JSON Web Token (JWT) authorizing API requests.
  • "Refresh token" — a longer-lived, rotating credential used to obtain new access tokens.
  • "Least privilege" — granting each system and person only the access required for their function.
  • "Subprocessor" — see the Subprocessor List.

3. Security Governance

  • Security requirements are owned by the engineering leadership and reviewed as the platform evolves.
  • Our practices are aligned with recognized frameworks — including the spirit of SOC 2's trust principles (security, availability, confidentiality) and OWASP application-security guidance. We do not currently hold a third-party certification and do not claim one.
  • Personnel access to production systems is limited to a small set of authorized individuals under least privilege (Section 7).
  • Subprocessors are assessed for their security posture before engagement and bound by data-protection terms.

4. Infrastructure Security

  • The Service runs on hardened server infrastructure with network-level access restrictions; administrative access requires authenticated, encrypted channels.
  • Production data stores (PostgreSQL for durable data, Redis for caching and ephemeral state) are not exposed to the public internet.
  • File and media storage uses dedicated object storage with scoped, time-limited upload credentials (presigned URLs), so clients never hold storage-account keys.
  • Environments are separated: development and testing do not use production credentials.

5. Encryption

5.1 End-to-End Encryption of Chats

  • Messages in direct chats, groups, and Note to Self are encrypted on the sender's device with a per-conversation AES-256 key. That key is sealed separately to each member's P-256 identity key, which is created on the member's own device. The server stores and relays only ciphertext and holds no key that can open it.
  • Files — photos, videos, voice notes, documents — are encrypted on the sender's device (phone, web, and desktop) before upload, using a fresh 256-bit key per file, chunked AES-256-GCM with authenticated chunk order and length, and size padding. The file key, real name, and type travel sealed under the conversation key; storage sees only ciphertext with a hidden name and type.
  • Key rotation: a group's key is rotated whenever a member is removed or leaves, so a former member cannot read what follows. A new member is never given keys from before they joined.
  • Safety numbers let two people confirm, out of band, that no one sits between them; the apps warn when a contact's key changes.
  • Notifications for encrypted messages carry ciphertext only and are opened on the device (Android).

5.2 Delivery-Only Storage

A chat message, and its files, stay on our servers only until every recipient device has received them, then are permanently deleted — after 30 days at most. A breach of our servers therefore exposes no chat history, because none is kept.

5.3 Never Through Our Servers

  • Ghost Chat travels directly between two phones over an encrypted peer-to-peer channel. Its setup signals are sealed under the conversation key, so the relay cannot interfere, and nothing is stored anywhere.
  • Local Share moves files between your own devices on the same Wi-Fi network and never reaches our servers.
  • One-to-one calls connect directly between devices with encrypted media; when a direct path is blocked, our relay carries the encrypted stream without being able to decrypt it.

5.4 Everything Else

  • In transit: all client–server traffic uses HTTPS/TLS (TLS 1.2+); WebSocket connections run over TLS. No unencrypted production endpoint exists.
  • At rest: databases and object storage use encrypted volumes (AES-256 class).
  • Passwords, where a user sets one, are stored only as argon2id hashes.

6. Authentication and Session Security

  1. Sign-in methods. A device key (Start New Chat — an Ed25519 key that never leaves the phone, proven by signing a one-time challenge), Google, or email and password. Email codes are rate-limited per address and per day; repeated wrong passwords lock the address temporarily.
  2. QR sign-in for web and desktop. A signed-in phone scans a short-lived, single-use code, sees which device is asking, and approves it. The same scan hands over the message key, sealed to a key that came off the camera, never from the server.
  3. Short-lived access tokens. API requests carry a JWT valid for one hour.
  4. Rotating refresh tokens, delivered on the web in HttpOnly; Secure; SameSite cookies unreadable by JavaScript.
  5. Sessions you control. Every signed-in device is listed and can be signed out; a revoked session stops working within 30 seconds. Linked devices unused for 14 days are signed out automatically.
  6. One-time codes keep credentials out of URLs, browser history, and logs.

7. Authorization and Access Control

  • Every API request is authenticated and then authorized against the requesting account: users can access only their own resources and the team resources their role permits.
  • Team features enforce role-based permissions (owner, manager, member) evaluated server-side on each request — never trusted from the client.
  • Administrative endpoints are gated behind a separate super-administrator check in middleware; administrative capability is limited to designated personnel.
  • Privacy-affecting platform gates (for example, policy acceptance) are enforced in server middleware, not only in the interface.

8. Secrets and Token Management

  • Application secrets (signing keys, provider credentials) come from environment configuration, never source code, with restricted access. An empty signing key refuses every token rather than accepting forgeries.
  • Message keys, device keys, and the recovery material that protects them are created and kept on users' devices. The server never receives them in a form it can open.
  • Inbound webhook endpoints authenticate callers with per-hook random tokens that can be regenerated or revoked.

9. Application Security

  • Input handling: database access uses parameterized queries throughout, preventing SQL injection; request bodies are schema-validated before use.
  • Cross-origin controls: the API enforces a strict CORS allow-list — production trusts only the configured frontend origin; permissive localhost origins are impossible in release mode.
  • Output encoding: the web client uses a framework rendering model (React) that escapes content by default.
  • Cross-site request protection: state-changing browser flows rely on SameSite cookie scoping plus bearer-token authorization, so cross-site form posts cannot authenticate.
  • Dependency hygiene: dependencies are version-pinned and updated on a regular cadence; builds fail on compilation and vet errors.

10. Rate Limiting and Abuse Resistance

Layered throttles protect the platform:

  • a global per-IP limit on all API traffic;
  • a tight shared limiter on credential endpoints (sign-in, token refresh, code exchange, device pairing) so brute-force attempts cannot be spread across routes;
  • per-user limits on high-frequency endpoints;
  • a byte budget per account on message sending, shared across server instances.

Rejected requests receive HTTP 429 with retry guidance. Deliberate evasion of these limits violates the Acceptable Use Policy.

11. Logging and Monitoring

  • API, authentication, and administrative events are logged with account identifiers, timestamps, and outcomes; security-relevant events (failed logins, token refresh anomalies, rate-limit rejections) are reviewable for investigation.
  • Logs exclude credential material: tokens are not written to logs, and the URL-free credential design in Section 6 keeps them out of standard access logs.
  • Log access is restricted to authorized personnel; retention follows the Privacy Policy, Section 12.
  • Crash and performance telemetry is monitored to detect service degradation.

12. Backups, Disaster Recovery, and Business Continuity

  • Production databases are backed up on a regular schedule to encrypted storage, with backups retained on a rolling window. Chat content is not in them beyond the moment of delivery (Section 5.2).
  • Restores are tested as part of operational practice; recovery procedures are documented so the platform can be rebuilt from configuration plus backups.
  • Scheduled sends are idempotent: a message is keyed by its client ID, so a retry after an outage never sends it twice.
  • Dependence on any single third party is documented in the Subprocessor List; provider outages degrade specific features rather than the whole platform where feasible.

13. Vulnerability Management and Testing

  • Code changes are reviewed before release; security-sensitive areas (encryption, authentication, authorization, payment, webhooks) receive heightened scrutiny.
  • We perform internal security reviews of the platform's attack surface and remediate findings by severity: critical issues are addressed immediately, high within days, others on a prioritized schedule.
  • Dependency vulnerabilities are tracked against advisories and patched.
  • We engage in penetration-testing exercises as the platform matures, and we treat external researcher reports (Section 15) as a first-class input to this process.

14. Incident Response

Our incident-response process covers:

  1. Detection and triage — anomaly identification from monitoring, logs, user reports, or researcher disclosure; severity classification.
  2. Containment — revoking affected credentials (all refresh tokens for an account or globally, provider tokens, webhook secrets), disabling affected features , and isolating affected systems.
  3. Eradication and recovery — root-cause remediation, patched deployment, restoration from backups where needed.
  4. Notification — informing affected users and customers without undue delay, consistent with the breach-notification commitments in the Privacy Policy, Section 16, and applicable law.
  5. Post-incident review — documented lessons and corrective actions.

15. Responsible Disclosure

We welcome good-faith security research. If you believe you have found a vulnerability, report it to info@ababilx.com following our Vulnerability Disclosure Policy, which defines scope, safe-harbor commitments, and reporting expectations. Do not access other users' data, disrupt the Service, or publicly disclose an issue before we have had a reasonable opportunity to remediate.

16. Shared Responsibility

Security is shared. You are responsible for:

  • protecting your phone, which holds your account key and message keys, and the Google or email account you sign in with, if any;
  • keeping desktop pairing codes and webhook URLs confidential, and regenerating them if exposed;
  • comparing safety numbers with the people you talk to about sensitive things;
  • controlling membership and roles in Teams you own;
  • keeping your devices and browsers patched.

17. Changes to This Policy

We update this Policy as our practices evolve, recording changes in Section 19. We will not weaken a stated commitment without prominent notice.

18. Contact

Security reports: info@ababilx.com · General: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

19. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Added end-to-end encryption of messages and files on every app, delivery-only storage, Ghost Chat, Local Share and call encryption (Section 5). Sign-in now by device key, Google, email and password, or QR. Removed GitHub, Slack, AI and automation controls.
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication. Documents the 2026 authentication hardening: one-time exchange codes, rotating HttpOnly refresh cookies, connect tickets, handshake-authenticated WebSockets, and layered rate limiting.

AbabilX Billing & Refund Policy

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Scope

This policy covers payments for AbabilX and forms part of our Terms of Service. Terms defined there apply here.

2. What Is Free

AbabilX Chat is free. Messages, groups, voice and video calls, Ghost Chat, Local Share, Privacy Mode, and every other chat feature cost nothing, with no paid tier and no limits sold back to you. We do not show ads and do not sell data to pay for it.

3. Workspace Plus

A Workspace runs on Free or Plus. Plus raises the Workspace's limits (boards and storage), as shown in the Workspace's billing page at the time of purchase. Plus is priced per member seat, per month, in Bangladeshi taka (BDT). The price shown before you pay is the price you pay.

4. How Payment Works

  1. The Workspace owner opens billing, chooses 1 to 12 months, and sees the total: seats × months × the monthly seat price.
  2. The owner pays that amount through bKash and submits the bKash transaction ID and sender number.
  3. We check the payment and approve it, usually within one business day. Plus starts on approval. If Plus is already active, the new months are added to the end.
  4. If something does not match, the request is put on hold or declined with a reason, and the owner can correct and resubmit it.

We receive only the transaction ID, sender number, and amount. Your bKash PIN never reaches us. Each transaction ID can be used once.

5. No Automatic Renewal

Plus never renews by itself and nothing is ever charged without you paying it. When the paid months end, you choose whether to pay again.

6. When Plus Ends

The Workspace returns to Free. Nothing is deleted. While the Workspace is above the Free limits, you cannot add more boards or files until you renew or make room. Members joining after payment are covered from the next payment.

7. Refunds

7.1 We Refund

  1. Payment errors: a duplicate payment, a wrong amount, or a payment we could not match — refunded or corrected in full.
  2. Declined requests: if we decline a payment request, the amount is returned.
  3. First purchase: within 7 days of your first Plus approval, on request, once per Workspace.
  4. Our fault: if an outage on our side makes the Workspace unusable for more than 72 hours in a row, or we discontinue Plus, we refund the unused months.
  5. Your legal rights: nothing here limits refund rights you have under consumer law.

7.2 We Do Not Refund

Unused time after the first 7 days, except under Section 7.1; or a Workspace suspended for breaking the Acceptable Use Policy or Terms of Service.

7.3 How to Ask

Email info@ababilx.com with the Workspace name and bKash transaction ID. We reply within 7 business days. Approved refunds are sent back to the bKash number that paid.

8. Price Changes

We may change the seat price for future payments. A change never affects months already paid, and we show the new price before you pay.

9. Records

Payment requests and their status are visible to the Workspace owner in billing. We keep payment records as long as tax law requires (Privacy Policy, Section 12).

10. Contact

Billing questions and refunds: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

11. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: AbabilX Chat is free. Payments are Workspace Plus only, per seat, by bKash, approved by us, with no automatic renewal. Removed Premium plan, card payments, auto-renewal, and AI terms.
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Developer & API Policy

Effective Date: July 9, 2026
Last Updated: July 9, 2026
Version: 1.0.0

1. Scope

This Policy governs programmatic access to the AbabilX Service — the REST API, WebSocket endpoints, webhooks, and any future developer surfaces (CLI, browser extension, SDKs). It supplements the Terms of Service and Acceptable Use Policy; where they conflict, the Terms of Service control.

2. Definitions

  • "API" — AbabilX's application programming interfaces, including REST endpoints and real-time (WebSocket) streams.
  • "Credentials" — access tokens, refresh tokens, pairing codes, exchange codes, connect tickets, and webhook tokens issued by the Service.
  • "Integration" — software you build or operate that calls the API or receives webhooks.

3. API Access and Authentication

  1. API access is authorized per Account. Requests are authenticated with a short-lived bearer access token obtained through the Service's supported authentication flows (device-key, Google, or email sign-in, token refresh, or QR pairing).
  2. Real-time streams authenticate through the connection handshake; do not place Credentials in URLs.
  3. An Integration acts as the user who authorized it and receives only the access that user has. Do not attempt to broaden access beyond the authenticated account's permissions.
  4. Access requires acceptance of our current policies; requests from accounts gated by policy acceptance or plan enforcement will receive corresponding error responses (for example, HTTP 403), which your Integration must handle rather than retry blindly.

4. Credential Handling

You must:

  1. store Credentials securely (platform keychains, encrypted storage, or server-side secrets management — never in client-side source, public repositories, or logs);
  2. treat refresh tokens, pairing codes, and webhook URLs as secrets;
  3. transmit Credentials only over TLS and only to AbabilX endpoints;
  4. use the token-refresh flow rather than persisting long-lived access tokens;
  5. revoke Credentials you no longer need (sign out, regenerate pairing codes, delete webhooks);
  6. report suspected Credential compromise to info@ababilx.com immediately.

You must not share Credentials between users, embed a user's Credentials in a multi-tenant service, or solicit users' Credentials outside AbabilX's authentication flows.

5. Rate Limits and Quotas

  1. The API enforces layered rate limits: global per-client limits, strict limits on authentication endpoints, and per-account limits on high-frequency routes (see Security Policy, Section 10).
  2. Exceeding a limit returns HTTP 429 with retry guidance. Integrations must honor Retry-After and implement exponential backoff with jitter.
  3. Deliberate evasion — rotating accounts, IP addresses, or request signatures to exceed limits — violates the Acceptable Use Policy (items 25–26) and this Policy.
  4. Sending budgets and plan limits apply equally to API-originated usage.
  5. If your legitimate use case requires higher limits, contact info@ababilx.com before engineering around them.

6. Data Use and Storage by Integrations

If your Integration receives data from the API:

  1. use it only to provide functionality to the user who authorized the access;
  2. store no more than the Integration requires, for no longer than it requires;
  3. protect stored data with measures appropriate to its sensitivity;
  4. delete a user's data promptly when they disconnect your Integration or ask you to;
  5. do not sell it, use it for advertising, or disclose it except as the user directs or law requires;
  6. comply with applicable data-protection law as an independent controller of what you store.

7. Webhooks

  1. Inbound board webhooks embed a per-hook secret token in the URL. Keep webhook URLs confidential; anyone holding the URL can post to the hook. Regenerate the token if exposed.
  2. Send well-formed payloads within documented size limits; junk, oversized, or malicious payloads may be dropped and the hook revoked.
  3. Outbound events you receive from AbabilX (where offered) must be verified using the provided signature or secret before processing.
  4. Webhook traffic counts against rate limits.

8. Developer Responsibilities

You are responsible for:

  1. accurately representing your Integration to its users — its identity, functionality, and data practices;
  2. providing your own privacy policy to your users where you process their data;
  3. keeping your Integration's dependencies patched and its infrastructure secure;
  4. handling API errors gracefully — including 401 (refresh then re-authenticate), 403 (do not retry without resolving the cause), and 429 (back off);
  5. not degrading the experience of the users who authorized your Integration;
  6. maintaining a way for us to contact you about your Integration's behavior.

9. Prohibited API Uses

In addition to the Acceptable Use Policy, you may not use the API to:

  1. reconstruct, mirror, or resell the Service or a substantial part of it;
  2. build a dataset of AbabilX users or their content;
  3. train machine-learning models on data obtained from the API without the explicit consent of the data's owner and our written permission;
  4. poll endpoints at frequencies with no functional justification;
  5. bypass the Service's user interface controls for gated features (policy acceptance, plan limits, role permissions);
  6. operate an Integration after we have revoked its access;
  7. misattribute your Integration's actions to AbabilX.

10. Versioning and Deprecation

  1. We may evolve the API. Backwards-incompatible changes to documented behavior will be announced with a reasonable migration period — ordinarily at least 90 days, shortened only where security requires.
  2. Undocumented endpoints and response fields may change without notice; do not depend on them.
  3. Deprecation notices are published in the Service's changelog. Continuing to call a removed endpoint yields standard error responses.

11. Future Clients: CLI and Browser Extension

When AbabilX ships a command-line interface or browser extension:

  1. they will authenticate through the same short-lived-token flows described in Section 3 — this Policy applies to them from release;
  2. third-party tools must not impersonate official AbabilX clients (user-agents, branding, or update channels);
  3. browser-extension builds by third parties that inject into or wrap the Service require our written permission.

12. Enforcement

We may throttle, suspend, or revoke API access — per token, per Integration, or per Account — for violations of this Policy, security risk, or harm to the Service, following the enforcement approach in the Acceptable Use Policy, Section 7. Where practical we will contact you first.

13. Changes to This Policy

Changes are versioned in Section 15; material changes are announced through the Service's changelog with reasonable notice.

14. Contact

Developer questions: info@ababilx.com · Security: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

15. Revision History

  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Community Guidelines

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Purpose and Scope

AbabilX brings people together in chats, groups, and workspaces (Board and Wall). These Guidelines set the behavioral standard inside them. They apply to everyone in a group or workspace and complement the Acceptable Use Policy ("AUP"), which lists platform-wide prohibitions. Where these Guidelines and the AUP overlap, the stricter rule applies.

2. Definitions

Terms defined in the Terms of Service apply. "Team Space" means a workspace's Board and Wall. "Group" means a group chat.

3. Core Expectations

  1. Be professional. Team Spaces are working environments. Disagree with ideas, not people.
  2. Be honest. Do not fabricate work records, misattribute contributions, or misrepresent activity (AUP items 53, 72).
  3. Respect boundaries. Colleagues' personal information, schedules, and off-hours are not yours to broadcast.
  4. Respect access. Use only the Team data your role grants; leaving a Team ends your right to its content (AUP item 94).
  5. Assume good faith first, report real problems fast. Most friction is misunderstanding; genuine misconduct should be reported, not endured (Section 9).

4. Team Spaces

  • Wall: for posts relevant to the team — announcements, discussion, appreciation. Keep categories on-topic; category requests are reviewed by team moderators.
  • Board (kanban): task titles, descriptions, and comments should describe work accurately. Do not delete or move others' tasks to obscure history or shift blame.
  • Workspace and chat are separate: a workspace gives no one access to your chats.

5. Content Standards

Do not post in any Team Space content that:

  1. harasses, demeans, threatens, or discriminates (AUP Section 4.7);
  2. is sexually explicit or gratuitously violent;
  3. discloses another person's private information without consent — including screenshots of private conversations shared to shame;
  4. is deliberately false and presented as fact about a person or their work;
  5. is spam, chain content, or off-platform promotion unrelated to the team's work;
  6. infringes intellectual-property rights (see Copyright & DMCA Policy);
  7. contains credentials, tokens, or secrets — including your own. Post secrets nowhere; rotate any secret posted by accident and tell your team owner.

6. Chats and Groups

  1. End-to-end encryption means we cannot see what is said — so the people in a chat are the first line of defence. Block anyone, and report a conversation from inside the app.
  2. Group admins set the rules of their group — who may post, add people, or change its details — and must not use those powers to bully members.
  3. Do not add people to groups they did not ask to join to promote, spam, or harass them.
  4. Respect a message request. If someone does not accept or replies by blocking, do not reach them through new accounts.

7. Roles and Moderation Within Teams

  1. Team owners and managers moderate their own Team Spaces first: they can manage categories, remove content, adjust roles, and remove members.
  2. Moderation power carries obligations — apply rules consistently, don't use role permissions to bully, silence good-faith dissent, or snoop beyond your legitimate function.
  3. AbabilX intervenes at the platform level when conduct violates the AUP or these Guidelines and the Team cannot or will not address it, or when the violator controls the Team.

8. Privacy Features

Privacy Mode, private chat, view-once and timed photos, Ghost Chat, and Local Share protect people. Using them to harass, pressure, threaten, or exploit someone violates these Guidelines and the AUP (Section 4.4), and is grounds for suspension.

9. Reporting

  • Inside your Team: raise it with your team owner or a manager, who has the tools to act.
  • To AbabilX: email info@ababilx.com with the team, content, and what happened — especially when the problem involves the team's leadership, or is severe (threats, hate speech, doxxing, CSAM — the last is reported to authorities without exception).
  • Reports are handled confidentially; retaliation against a good-faith reporter is itself a violation.

10. Enforcement

Violations are handled under the AUP's enforcement framework (AUP, Section 7): content removal, feature restrictions, suspension, or termination, proportionate to severity and history. Team-level moderation by owners is independent of, and does not limit, platform-level enforcement. Appeals follow AUP Section 8.

11. Changes to These Guidelines

Changes are versioned in Section 13 and announced in the Service when material.

12. Contact

Conduct reports: info@ababilx.com · Urgent safety issues: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

13. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Rewritten for chats, groups, and workspaces (Board and Wall). Replaced AI-assisted content and attendance sections with chats and groups (6) and privacy features (8).
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Data Processing Addendum (DPA)

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Introduction and Order of Precedence

This Data Processing Addendum ("DPA") forms part of the agreement between AbabilX and the customer accepting it ("Customer") under the Terms of Service (together, the "Agreement"), and applies where AbabilX processes Personal Data subject to Data Protection Law on Customer's behalf — in practice, the Board and Wall content of a Customer's Workspace. In case of conflict regarding the processing of Personal Data, this DPA prevails over the Agreement; executed Standard Contractual Clauses prevail over this DPA.

This DPA is accepted by using the Service as a business or organization, or by countersignature where a signed copy is requested (info@ababilx.com).

2. Definitions

  • "Data Protection Law" — all laws applicable to the processing of Personal Data under the Agreement, including the EU/UK GDPR, the CCPA/CPRA, and analogous laws.
  • "Customer Personal Data" — Personal Data contained in Customer Content that AbabilX processes on Customer's behalf.
  • "Controller," "Processor," "Data Subject," "Processing," "Personal Data Breach" — as defined in the GDPR; for the CCPA, "Controller" reads as "Business" and "Processor" as "Service Provider."
  • "SCCs" — the European Commission's Standard Contractual Clauses (Decision 2021/914), Module Two (controller→processor) or Module Three (processor→processor) as applicable, and the UK Addendum where UK GDPR applies.

3. Roles of the Parties

  1. For Customer Personal Data, Customer is the Controller (or a Processor acting for another Controller) and AbabilX is the Processor.
  2. AbabilX acts as an independent Controller for: account data of its users, billing records, and security logs — as described in the Privacy Policy. Those are outside this DPA.
  3. Chats are outside this DPA and outside AbabilX's reach. Messages, files, and calls between users are end-to-end encrypted and deleted from AbabilX's servers once delivered. AbabilX cannot read them and processes them only as locked data in transit.

4. Details of Processing

The subject matter, duration, nature, purposes, data categories, and Data Subject categories of Processing are set out in Annex I (Section 16).

5. Processor Obligations

AbabilX shall:

  1. process Customer Personal Data only on Customer's documented instructions — the Agreement, this DPA, and Customer's configuration and use of the Service constitute those instructions — unless required otherwise by law, in which case AbabilX informs Customer unless legally prohibited;
  2. immediately inform Customer if, in its opinion, an instruction infringes Data Protection Law;
  3. ensure persons authorized to process Customer Personal Data are bound by confidentiality obligations;
  4. implement the technical and organizational measures in Annex II;
  5. not sell, share (for cross-context behavioral advertising), or retain, use, or disclose Customer Personal Data other than to provide the Service (CCPA §7051 obligations), and certify that it understands these restrictions;
  6. not use Customer Personal Data to train machine-learning models;
  7. assist Customer as described in Sections 10–11.

6. Customer Obligations

Customer shall:

  1. have a lawful basis for the Personal Data it puts in its Workspace;
  2. provide required notices to, and obtain required consents from, its Data Subjects, including its Workspace members;
  3. configure the Workspace (members, roles, deletions) consistently with its obligations;
  4. not submit special-category data or data of minors except as strictly incidental and lawful.

7. Subprocessing

  1. Customer grants general written authorization for the Subprocessors listed in the Subprocessor List.
  2. AbabilX will update the list at least 14 days before adding or replacing a Subprocessor. Customer may subscribe to updates by emailing info@ababilx.com.
  3. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected services and receive a pro-rated refund of prepaid, unused fees.
  4. AbabilX imposes data-protection obligations on each Subprocessor materially equivalent to this DPA and remains liable for its Subprocessors' performance.

8. International Transfers

  1. Customer authorizes Processing in the locations identified in the Subprocessor List and in Bangladesh, where AbabilX operates.
  2. Where Processing involves a transfer of Personal Data from the EEA, UK, or Switzerland to a country without an adequacy decision, the parties enter into the SCCs, which are incorporated by reference: Module Two (or Three), with AbabilX as data importer and Customer as data exporter; Clause 7 (docking) included; Clause 9 Option 2 (general authorization, 14 days); Clause 17 governing law of Ireland; Clause 18 courts of Ireland; Annexes I–II completed by Sections 16–17 of this DPA. For UK transfers, the UK IDTA Addendum applies with equivalent selections; for Switzerland, references adapt to the FADP.
  3. AbabilX applies the supplementary measures in Annex II to all transfers.

9. Security

AbabilX maintains the measures described in Annex II and the Security Policy, and may update them provided the protection level is not materially reduced.

10. Personal Data Breach

AbabilX shall notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, providing (as information becomes available): the nature of the breach, categories and approximate volumes affected, likely consequences, and measures taken or proposed. AbabilX will cooperate with Customer's reasonable investigation and its regulatory and Data Subject notification obligations. Notification is not an admission of fault.

11. Assistance and Data Subject Requests

  1. Taking into account the nature of Processing, AbabilX shall assist Customer with appropriate technical and organizational measures to fulfil Data Subject requests (access, rectification, erasure, restriction, portability, objection). The Service's self-service controls (editing and deleting cards and posts, removing members, export on request) are the primary mechanism.
  2. If AbabilX receives a request directly from Customer's Data Subject, it will (where lawful) redirect the Data Subject to Customer and not respond substantively except on Customer's instruction.
  3. AbabilX shall provide reasonable assistance with Customer's data-protection impact assessments and prior consultations, to the extent the required information is available to AbabilX.

12. Audits

  1. On written request no more than once per 12 months (absent a Personal Data Breach or regulator requirement), AbabilX will make available the information reasonably necessary to demonstrate compliance with this DPA — including its current security documentation and Subprocessor list — and will respond to a reasonable written security questionnaire.
  2. Where that information is insufficient under Data Protection Law, Customer may conduct (directly or via an independent auditor bound to confidentiality) an audit limited in scope, duration, and access so as not to compromise the security of other customers, at Customer's expense, on at least 30 days' notice.

13. Return and Deletion

Upon termination of the Agreement, or upon Customer's deletion of specific data through the Service, AbabilX deletes Customer Personal Data as described in the Privacy Policy, Sections 12 and 14 except where retention is required by law. On written request made before account deletion, AbabilX will provide an export of Customer Personal Data in a machine-readable format.

14. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, Section 21, except where Data Protection Law does not permit such limitation (including a Data Subject's rights under the SCCs).

15. Term and Termination

This DPA takes effect upon acceptance and remains in force as long as AbabilX processes Customer Personal Data under the Agreement.

16. Annex I — Processing Description

  • Data exporter:** Customer — the organization or individual using the Service for its team or business.
  • Data importer:** AbabilX, Sector 4, Uttara, Dhaka, Bangladesh — provider of the Service.
  • Subject matter:** Provision of AbabilX Workspace (Board and Wall).
  • Duration:** The term of the Agreement plus the deletion periods in Section 13.
  • Nature and purpose:** Hosting, display, and notification of Workspace Board cards and Wall posts, as configured by Customer. No AI processing.
  • Categories of Data Subjects:** Customer's Workspace members and owners; individuals named in Workspace content.
  • Categories of Personal Data:** Names, usernames, email addresses, avatars; Board cards, comments, and attachments; Wall posts; Workspace settings; technical identifiers (IP address, device tokens).
  • Special categories:** None intended; incidental presence only if contained in Customer Content.
  • Frequency:** Continuous, as driven by Customer's use.
  • Retention:** Per the Privacy Policy, Section 12.

17. Annex II — Technical and Organizational Measures

As detailed in the Security Policy:

  1. End-to-end encryption for all chat messages, with delivery-only storage; TLS encryption in transit for all traffic; encrypted storage for databases and objects.
  2. Sign-in by device key, Google, or argon2id-hashed password; short-lived signed access tokens; rotating HttpOnly; Secure; SameSite refresh cookies; one-time exchange codes and tickets keeping credentials out of URLs and logs.
  3. Server-side, per-request authorization; role-based team permissions; segregated super-administrator access; least-privilege personnel access.
  4. Server-side secrets management; signature-verified webhooks.
  5. Layered rate limiting (global per-IP, strict credential-endpoint, per-user) against brute force and abuse.
  6. Security logging of authentication and administrative events, with credential material excluded from logs.
  7. Incident-response process with detection, containment (credential revocation, feature kill switches), remediation, notification, and post-incident review.
  8. Vendor assessment and contractual flow-down of data-protection obligations to Subprocessors.

18. Contact

DPA execution and questions: info@ababilx.com · Privacy: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

19. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Scoped to Workspace (Board and Wall). Chats placed outside the DPA as end-to-end encrypted and delivery-only. Removed repository, attendance, AI, and integration processing.
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX GDPR Compliance Statement

Effective Date: July 9, 2026
Last Updated: July 9, 2026
Version: 1.0.0

1. Purpose

This Statement explains how AbabilX meets its obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR for users and customers in the European Economic Area, the United Kingdom, and Switzerland (whose FADP is addressed by analogy). It supplements — and should be read with — our Privacy Policy and, for business customers, our Data Processing Addendum ("DPA").

2. Definitions

GDPR terms — "Controller," "Processor," "Personal Data," "Processing," "Data Subject" — carry their statutory meanings.

3. Our Roles Under the GDPR

  • Data: Your account registration data, billing records, security and service logs, telemetry | Our role: Controller | Governing document: Privacy Policy
  • Data: Personal Data inside Customer Content processed for a team or business (workspace Board and Wall content) | Our role: Processor on the customer's behalf | Governing document: DPA

Individual users acting purely for themselves interact with us as Controller throughout.

4. Lawful Bases

Our lawful bases per purpose are tabulated in the Privacy Policy, Section 9: contract for operating the Service; legitimate interests for security, abuse prevention, and service analytics (assessed against Data Subjects' rights, with minimization safeguards); consent for non-essential communications and any non-essential storage; legal obligation for tax, accounting, and lawful requests. Where we rely on legitimate interests, you may object (Section 5).

5. Data Subject Rights and How to Exercise Them

Under Articles 15–22 GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time (Article 7(3)).

Self-service (immediate):

  • edit profile data in Settings (rectification);
  • disable notifications, turn on Privacy Mode, remove a phone number, sign out of devices (restriction/objection in effect);
  • delete individual content items;
  • delete your account entirely (erasure — see Privacy Policy, Section 14).

By request to `info@ababilx.com`:

  • a copy of your Personal Data (access) and a machine-readable export (portability, Article 20);
  • objection to legitimate-interest processing (Article 21) — we will stop unless we demonstrate compelling legitimate grounds;
  • restriction while a dispute is assessed (Article 18).

We verify requests against your account email, respond within one month (extendable by two months for complex requests, with notice), and act free of charge except where requests are manifestly unfounded or excessive (Article 12(5)).

If we process your data as Processor for a team or business, we will redirect your request to that customer, who is the Controller responsible for responding (see DPA, Section 11).

6. International Transfers

AbabilX operates from Bangladesh — a country without an EU adequacy decision — and uses Subprocessors in several countries. Transfers of EEA/UK/Swiss Personal Data are protected by:

  1. Standard Contractual Clauses (Decision 2021/914) with our Subprocessors, and — for business customers — the SCCs incorporated into our DPA, Section 8 (with the UK Addendum for UK transfers);
  2. Supplementary measures: TLS for all transfers, encrypted storage, credential-free URLs and logs, least-privilege access, end-to-end encryption of chats so transferred messages and files are unreadable to us and every Subprocessor, and Subprocessor contractual restrictions;
  3. Transfer impact assessment: we evaluate destination-country law and Subprocessor safeguards before engagement and on material change, and we commit to challenging disproportionate government access requests where lawful (Privacy Policy, Section 10.3).

7. Data Protection by Design and by Default

Article 25 obligations are reflected in the platform's construction:

  • minimization: split me endpoints expose only the fields each screen needs;
  • default protection: third-party tokens are excluded from serialization by default; team content is scoped to team roles server-side;
  • security by design: short-lived tokens, rotating HttpOnly refresh cookies, one-time codes and tickets, handshake-authenticated WebSockets (Security Policy, Section 6);
  • transparency and control: versioned policies requiring re-acceptance on material change; granular notification and privacy toggles; self-service deletion.

8. Records, DPIAs, and Accountability

We maintain records of processing activities appropriate to our size and processing (Article 30), assess new features with privacy-affecting scope before launch, and conduct data-protection impact assessments where processing is likely to result in high risk (Article 35). Subprocessors are engaged under written contracts imposing GDPR-equivalent obligations (Article 28(4)); the current list is the Subprocessor List.

We have not appointed a mandatory Data Protection Officer under Article 37, as our core activities do not involve large-scale systematic monitoring or large-scale special-category processing; privacy responsibility rests with engineering leadership, reachable at info@ababilx.com. We will appoint a DPO and an EU/UK representative (Article 27) if and when our processing triggers those obligations, and will update this Statement accordingly.

9. Breach Notification

Where a Personal Data Breach is likely to result in a risk to individuals, we notify the competent supervisory authority within 72 hours of awareness (Article 33) and affected Data Subjects without undue delay where the risk is high (Article 34). For Customer Personal Data processed under the DPA, we notify the customer within 72 hours so it can meet its own obligations (DPA, Section 10).

10. Automated Decision-Making

The Service does not make decisions producing legal or similarly significant effects on you based solely on automated processing (Article 22). AbabilX uses no AI on your content; plan-limit and rate-limit enforcement are contractual usage controls, and enforcement decisions affecting your account involve human review (see Acceptable Use Policy, Sections 7–8).

11. Supervisory Authorities and Complaints

You may lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of an alleged infringement (Article 77) — for example, your national Data Protection Authority in the EEA, or the ICO in the UK. We would welcome the opportunity to resolve your concern first at info@ababilx.com.

12. Changes to This Statement

Changes are versioned in Section 14; material changes are announced through the Service.

13. Contact

Privacy and GDPR requests: info@ababilx.com · Legal: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

14. Revision History

  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX CCPA/CPRA Compliance Statement

Effective Date: July 9, 2026
Last Updated: July 9, 2026
Version: 1.0.0

1. Purpose and Scope

This Statement provides the disclosures required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA") for California residents who use AbabilX. It supplements our Privacy Policy, which describes our practices in full.

2. Definitions

"Personal information," "sell," "share," "sensitive personal information," "service provider," and "business purpose" carry their CCPA statutory meanings. "You" means a California resident.

3. Notice at Collection

We collect the categories of personal information listed in Section 4, for the purposes listed in Section 5, retained per Section 8. We do not sell or share personal information (Section 6).

4. Categories of Personal Information

Mapped to the CCPA's statutory categories (Cal. Civ. Code §1798.140(v)):

  • CCPA Category: A. Identifiers | Collected?: Yes | Examples in Our Context: Name, username, email and phone number if you add them, avatar, IP address, Google account identifier if you sign in with Google
  • CCPA Category: B. Customer records (§1798.80(e)) | Collected?: Yes | Examples in Our Context: Account and subscription records
  • CCPA Category: C. Protected classifications | Collected?: No | Examples in Our Context: —
  • CCPA Category: D. Commercial information | Collected?: Yes | Examples in Our Context: Plan purchases, billing history
  • CCPA Category: E. Biometric information | Collected?: No | Examples in Our Context: —
  • CCPA Category: F. Internet/network activity | Collected?: Yes | Examples in Our Context: Feature usage, API logs, device/browser data
  • CCPA Category: G. Geolocation data | Collected?: Limited | Examples in Our Context: Coarse location inferable from IP address only; no precise geolocation
  • CCPA Category: H. Sensory data | Collected?: No | Examples in Our Context: —
  • CCPA Category: I. Professional/employment information | Collected?: Limited | Examples in Our Context: Workspace roles, created by your workspace
  • CCPA Category: J. Education information | Collected?: No | Examples in Our Context: —
  • CCPA Category: K. Inferences | Collected?: No | Examples in Our Context: We do not build behavioral profiles
  • CCPA Category: L. Sensitive personal information | Collected?: Limited | Examples in Our Context: Account log-in credentials in the form of authentication tokens (see Section 7)

Content you submit (workspace posts and cards; messages, which reach us only in encrypted form) may incidentally contain identifiers of you or others; it is handled as Customer Content under the Privacy Policy.

5. Sources, Purposes, and Disclosures

  • Sources: you directly; your devices and browsers automatically; Google if you sign in with it; bKash for workspace payments (Privacy Policy, Section 7).
  • Business purposes: providing and securing the Service; billing; debugging; auditing interactions; complying with law (Privacy Policy, Section 8).
  • Disclosures for business purposes: to the service providers in our Subprocessor List (hosting, storage, notifications, email, payments); to authorities where legally required (Privacy Policy, Section 10). Each category in Section 4 marked "Yes" may be disclosed to the service providers whose function requires it.

6. No Sale or Sharing

We do not sell personal information, and we do not share it for cross-context behavioral advertising, and we have not done either in the preceding 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16. Because we do not sell or share, we do not offer an opt-out mechanism, and browser opt-out signals (such as Global Privacy Control) require no change to our processing — your data is already treated as opted out.

7. Sensitive Personal Information

The only sensitive personal information we process is account authentication material (tokens and codes), used solely to authenticate you and secure the Service — a use permitted under §7027(m) without a right-to-limit obligation. We do not use sensitive personal information to infer characteristics.

8. Retention

Retention periods per category follow the schedule in our Privacy Policy, Section 12: account data for the life of the account; messages deleted once delivered (30 days at most); logs on a short rolling window; billing records as required by tax law; all subject to deletion on account closure.

9. Your Rights

California residents have the right to:

  1. Know/Access — the categories and specific pieces of personal information we have collected, the sources, purposes, and disclosure recipients;
  2. Delete — subject to statutory exceptions (security, legal compliance, completing a transaction you requested);
  3. Correct — inaccurate personal information;
  4. Opt out of sale/sharing — not applicable, as we do neither (Section 6);
  5. Limit sensitive personal information — not applicable to our permitted-purpose use (Section 7);
  6. Non-discrimination — see Section 11.

10. How to Exercise Your Rights

  • Self-service: edit profile data in Settings (correct); delete content items or your entire account in the Service (delete).
  • By request: email info@ababilx.com with "California Privacy Request" in the subject. We verify your identity via your account email (and reasonable follow-up where needed), confirm receipt within 10 business days, and respond within 45 days (extendable once by 45 days with notice).
  • Authorized agents may submit requests with proof of written authorization; we may still require you to verify identity directly.
  • We do not charge for requests unless they are manifestly unfounded or excessive.

11. Non-Discrimination

We will not deny you the Service, charge different prices, or degrade quality because you exercised CCPA rights. Plan-based feature differences apply equally to everyone and are unrelated to privacy requests.

12. Service-Provider Relationships

Entities in our Subprocessor List act as service providers under written contracts that prohibit retaining, using, or disclosing personal information for any purpose other than performing their services, and prohibit selling or sharing it — consistent with §1798.140(ag) and our Data Processing Addendum, Section 5.

13. Changes to This Statement

Changes are versioned in Section 15. This Statement is reviewed at least annually.

14. Contact

California privacy requests: info@ababilx.com (subject: "California Privacy Request")
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

15. Revision History

  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Subprocessor List

Effective Date: October 23, 2026
Last Updated: October 23, 2026
Version: 2.0.0

1. Purpose

This document is the single authoritative list of third parties that process Personal Data on AbabilX's behalf ("Subprocessors"). It supports the commitments in our Privacy Policy (Section 10.1) and Data Processing Addendum (Section 7). Other policies link here rather than duplicating the list.

2. Definitions

"Subprocessor" — a third party engaged by AbabilX to process Personal Data in the course of providing the Service. Terms defined in the Privacy Policy apply.

3. How We Engage Subprocessors

Before engaging a Subprocessor we assess its security posture and data-protection practices, and we bind it by written contract to: process Personal Data only on our instructions; apply appropriate security measures; not use the data for its own purposes (including model training); and support deletion and breach-notification obligations. International transfers to Subprocessors rely on Standard Contractual Clauses where required (GDPR Compliance Statement, Section 6).

4. Current Subprocessors

  • Subprocessor: Cloud hosting provider (compute for API and application servers) | Function: Runs the Service's backend and databases (PostgreSQL, Redis) | Data Processed: All Service data at rest and in processing | Location of Processing: Data-center region(s) selected for the Service
  • Subprocessor: Cloudflare, Inc. — R2 object storage & network services | Function: Stores uploaded files and provides network delivery | Data Processed: Profile pictures; chat files in locked (encrypted) form, deleted once delivered; request metadata | Location of Processing: Global (distributed)
  • Subprocessor: Google LLC — Firebase Cloud Messaging | Function: Wakes your phone for a new message or call | Data Processed: Device tokens; locked (encrypted) message notifications that only your phone can open | Location of Processing: Global (Google infrastructure)
  • Subprocessor: Transactional email provider | Function: Sends account, security, and notification emails | Data Processed: Recipient email address; message content | Location of Processing: Provider's infrastructure
  • Subprocessor: bKash | Function: Workspace Plus payments | Data Processed: Transaction ID and amount (your PIN never reaches us) | Location of Processing: Bangladesh

Note: Where a row names a function rather than a single vendor, the engaged vendor for your account is available on request to info@ababilx.com; the contractual protections in Section 3 apply identically.

5. Connected Platforms (Not Subprocessors)

  • Google LLC (Sign-In):** Confirms your identity, only if you choose to sign in with Google

6. Change Notification

We update this list at least 14 days before adding or replacing a Subprocessor. Business customers under the DPA may subscribe to change notices and object as described in DPA Section 7 by emailing info@ababilx.com with the subject "Subprocessor notifications." Every change is recorded in Section 8.

7. Contact

Questions and notification subscriptions: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

8. Revision History

  • Version: 2.0.0 | Date: October 23, 2026 | Summary: Removed DeepSeek, GitHub and Slack. Payments are bKash only. Storage and push now carry chat content only in locked form.
  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.

AbabilX Vulnerability Disclosure Policy

Effective Date: July 9, 2026
Last Updated: July 9, 2026
Version: 1.0.0

1. Our Commitment

Security research conducted in good faith makes AbabilX safer for everyone. We welcome reports of vulnerabilities in our Service, will work with you to understand and remediate them, and will not pursue action against research that follows this Policy.

2. Definitions

  • "Vulnerability" — a weakness in the Service that could compromise the confidentiality, integrity, or availability of the Service or its users' data.
  • "Good-faith research" — accessing systems only to the extent needed to demonstrate a Vulnerability, without harming users, data, or availability, and reporting promptly under this Policy.

3. Scope

In scope:

  • the AbabilX web application and websites;
  • the AbabilX API and WebSocket endpoints;
  • AbabilX desktop and mobile applications;
  • authentication and session mechanics (device-key sign-in, QR sign-in, token exchange and refresh, cookies);
  • webhook endpoints;

Out of scope:

  • Google and other third-party platforms (report to them directly);
  • our Subprocessors' infrastructure (report to the vendor; tell us too if AbabilX data is affected);
  • social engineering of AbabilX personnel or users;
  • physical attacks;
  • denial-of-service testing of any kind.

4. Rules of Engagement

You must:

  1. test only against accounts you own or created for testing — never access, modify, or delete another user's data;
  2. stop and report immediately if you encounter someone else's Personal Data; do not copy, store, or further examine it;
  3. avoid degrading the Service — no volumetric attacks, no automated scanning at disruptive rates (respect HTTP 429 responses);
  4. not exfiltrate data beyond the minimum proof of concept;
  5. not use a Vulnerability for any purpose other than verification and reporting — no extortion, no leverage, no "proof" pivoting into further systems;
  6. comply with applicable law and, except as authorized by this Policy, the Acceptable Use Policy;
  7. keep findings confidential until coordinated disclosure (Section 8).

5. How to Report

Email `info@ababilx.com` with:

  1. a descriptive title and the affected component/endpoint;
  2. reproduction steps or proof of concept (requests, payloads, screenshots);
  3. observed impact and your assessment of severity;
  4. the account identifiers you used for testing;
  5. your contact details and, if you wish, a name/handle for recognition (Section 10).

Report in English or Bangla. Encrypted reports: request our key at the same address.

6. What to Expect From Us

  • Acknowledgment: Within 3 business days
  • Triage and severity assessment: Within 7 business days
  • Status updates: At least every 14 days while open
  • Remediation: Critical: immediate priority; High: days; Medium/Low: prioritized schedule (Security Policy, Section 13)
  • Resolution notice: We tell you when the fix ships and credit you if desired

7. Safe Harbor

For good-faith research conducted in accordance with this Policy:

  1. we will not initiate legal action against you or refer you for prosecution, and will state that your research was authorized if a third party raises it;
  2. we waive claims under anti-circumvention and computer-misuse theories to the extent they arise solely from Policy-compliant research;
  3. we will not suspend or terminate your account for the research itself.

This safe harbor does not extend to research that materially violates Section 4, harms users, or breaks laws we cannot waive. If you are unsure whether planned testing is covered, ask info@ababilx.com before testing.

8. Public Disclosure

We support coordinated disclosure. Please give us 90 days from acknowledgment (or a mutually agreed timeline) before publishing details. We may request a short extension for complex fixes; we will not use the process to indefinitely suppress publication. Where a fix ships sooner and users are protected, earlier coordinated publication is fine — talk to us.

9. Out-of-Scope Findings

The following are ordinarily not accepted as Vulnerabilities (unless you demonstrate concrete exploitability):

  • missing security headers without a demonstrated attack;
  • rate-limit responses on endpoints that are, in fact, rate-limited;
  • clickjacking on pages with no sensitive state-changing action;
  • self-XSS requiring the victim to attack themselves;
  • reports from automated scanners without validation;
  • version disclosure of server software;
  • password-policy opinions without an exploit path;
  • best-practice suggestions (send those to info@ababilx.com — still appreciated).

10. Recognition

We do not currently operate a paid bug bounty. With your consent, we credit meaningful findings in our changelog or an acknowledgments page. If a bounty program launches, this Policy will be updated with its terms.

11. Changes to This Policy

Changes are versioned in Section 13. The Policy version in effect when you begin testing governs that research.

12. Contact

Security reports: info@ababilx.com
Postal: AbabilX, Sector 4, Uttara, Dhaka, Bangladesh.

13. Revision History

  • Version: 1.0.0 | Date: July 9, 2026 | Summary: Initial publication.