Consent to the processing of personal data

Version 2026-10-09 · Last updated: 9 October 2026

By ticking “I consent to the processing of my personal data” in the mr.enzo app, I freely, by my own will and in my own interest, give my consent to the operator — Garnik Papian, an individual based in Russia, ajkzantokaev@gmail.com (“the operator”) — to process my personal data on the terms below. This consent is a separate document: it is not part of the Terms of Use. Details of the processing are in the Privacy Policy.

1. Which data

• my email address (a phone number only for old accounts created with one);
• my username, display name, profile photo and bio, and — only if I add them to my profile — a phone number and my date of birth (the year is optional), which I may remove at any time;
• the security settings, if I turn them on: a cloud password (as a hash) and its hint, a recovery email address, a two-step verification secret and recovery codes; my sign-in sessions — tokens (as hashes), when they expire and a device label;
• my public encryption keys and the record of which features my app version supports;
• the list of my mr.enzo contacts, the list of users I blocked, the chats I muted and the contacts I stopped from reaching me by push-to-talk;
• the groups and channels I create or belong to: their names, descriptions and photos, my membership and role in them, and which posts I reacted to (not the emoji);
• technical identifiers of my devices for notifications, calls and push-to-talk (push tokens), a random installation ID, the app build number, the time I was last connected;
• my IP address, technical request logs and the app’s diagnostic events, including the device model and iOS version;
• who I exchange messages and calls with, when, and how large they are — without their content, which is end-to-end encrypted and not available to the operator; the encrypted messages, attachments and scheduled messages themselves, while they are kept on the server;
• the stories and public sticker sets I publish, and the reports I file together with the messages attached to them;
• the record that I gave this consent: the version of the document, the time, the language and a fingerprint of its text.

2. What for

• creating my account, signing me in and protecting the account;
• delivering messages, calls and notifications, and showing my profile and stories to those who may see them;
• security of the service, abuse prevention, handling reports and moderation;
• diagnostics and fixing problems, and usage statistics without identifiers;
• answering my requests.

3. What is done with the data

Collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access) to the parties named in section 4, blocking, deletion and destruction — by automated means.

4. Who receives the data, including abroad

• the hosting provider Timeweb Cloud: the servers of the service are in Germany (Frankfurt am Main), and my data is recorded and stored on them; encrypted backup copies of the databases are also kept on the operator’s second server with the same provider in the Netherlands (Amsterdam);
• Apple (the United States and other countries) — push tokens and notifications with their technical data, to deliver notifications and incoming calls; a message itself only in encrypted form that Apple cannot read;
• Resend (the EU and the United States) — my email address and the text of the emails the service sends me (a one-time code, the notice that the sign-in address was changed), and the notifications the service sends to the operator’s mailbox about reports and about sticker sets submitted for review;
• Google (the United States and other countries) — the emails I send to support and the same notifications about reports and sticker sets: the operator’s mailbox is at Gmail.

I understand that my data is thereby transferred to foreign states, including states that may not ensure adequate protection of the rights of data subjects, and I consent to that transfer.

5. For how long

The consent is valid from the moment it is given until my account is deleted or the consent is withdrawn. The retention periods of particular data are in section 5 of the Privacy Policy.

6. How to withdraw the consent

I can withdraw the consent at any time: by deleting my account in the app (Settings → Delete Account) or by writing to ajkzantokaev@gmail.com from the email address of the account. After the withdrawal the operator stops the processing and deletes the data, except where the law allows or requires processing to continue without consent. The app asks everyone for this consent and does not open an account without it; withdrawing it means deleting the account, because the service cannot work without processing the data in section 1.

7. Age

I confirm that I am at least 13 years old — or older, if the law of my country sets a higher minimum age for services like this. If I am under 18 — or under the age of majority where I live, if that is higher — I give this consent with the permission of a parent or guardian. The operator does not ask for my age, and the birthday I may add to my profile is not used to check it.

History

• 9 October 2026 (version 2026-10-09). Added a note on why this document exists and what it means for people to whom EU or UK law applies. Section 1 is completed with data the Privacy Policy already described: security settings, public keys, groups and channels, muted chats, scheduled messages, the record of the consent itself. Section 4: Apple relays a message only in encrypted form; every kind of email that goes through Resend and to the operator’s mailbox is named. Section 6 is worded more exactly. Section 7: the same age rule as in the Policy and the Terms.
• 8 October 2026 (version 2026-10-08.2). Previous version; before it came versions 2026-10-06, 2026-10-07 and 2026-10-08.