Privacy Policy

Version 2026-10-11 · Last updated: 11 October 2026

mr.enzo is a messenger for iPhone with end-to-end encrypted chats and calls and an offline network that works without the internet. This policy explains, in plain words, what data the app and our server handle, why, for how long, and what you can do about it. It describes the current version of the app; what changed in this document, and when, is in the History at the end.

1. Who is responsible

mr.enzo is developed and operated by Garnik Papian, an independent developer (an individual) based in Russia (“we”, “us”), who is the controller of the personal data described here. Contact for anything about privacy, including requests to exercise your rights: ajkzantokaev@gmail.com.

2. What we process and why

2.1 Your account

• Email address. You sign in with your email address and a one-time code we send to it. We use it to sign you in, to protect your account and to answer you. A code is valid for 10 minutes; the record of it — the code and the address it was sent to — is removed from the server as soon as the code is used, or about a minute after it expires. Other users who already know your email address can find your account by it — by typing it in search or with “Find friends” (see 2.4); we do not show your email address to other users.
• Phone number — only for older accounts that were created with a phone number; people who know it can find such an account by it in the same way. Sign-in by phone number is switched off: we send no SMS, and no SMS provider receives anything.
• A phone number in your profile (optional). You can add a phone number to your profile so that the people you talk to can save it or call it: we store it as you entered it and do not verify it, we show it only to your contacts — people you added or wrote to who also added you or wrote to you, and never to someone you blocked or who blocked you — or to no one if you choose “Nobody”, we never use it to find your account or to match anyone’s address book, and you can remove it at any time.
• Date of birth in your profile (optional). You can add your birthday — the day and month, with or without the year — so that your contacts are reminded of it: we store it as you entered it and show it only to your contacts (the same people as for the phone number above, and never to someone you blocked or who blocked you) or to no one if you choose “Nobody”. The reminders are made on your contacts’ own iPhones from their contact list: our server sends no birthday notifications and keeps no schedule of them. A reminder is planned on your contact’s phone in advance (up to 30 days ahead), is shown the day before your birthday and on the day itself, and disappears after the app on that phone has refreshed its contact list. If you hide or remove the date, a reminder already planned on someone else’s phone may still appear until that phone refreshes its list. A contact who sees the date can keep it on their own device, for example in their iPhone’s Contacts. We do not use it to find your account, to check your age or for anything else, and you can change or remove it at any time.
• Username, display name, profile photo and bio. These form your public profile. Any mr.enzo user can find you by username or display name and see this profile. A new account gets a random username — “user” and eight digits — that says nothing about your email address; you can change it in your profile. An account created earlier may still have a username made from the beginning of its email address (the part before “@”) or, if it was created with a phone number, from the letter “p” and the digits of that number, until its owner changes it. Your profile photo is stored unencrypted and anyone who has its link can open it.
• Optional security settings: a cloud password (stored only as a hash) and its hint, a recovery email address, and a two-step verification secret with recovery codes. They are stored so we can check them when you sign in.
• Sessions. Sign-in tokens (stored as hashes), when they expire and a device label, the time you were last online, and the build number of the app your account last connected with (so the server knows which message formats your app understands).
• The record of your consent. When you accept the Consent to the processing of personal data, we record that your account accepted it: the version of the document, the time, the language it was shown in and a fingerprint (SHA-256) of its text. We also keep the text of each version as it was shown, starting with the version that followed 2026-10-08.2; for an acceptance of version 2026-10-08.2 or an earlier one, only the version and the time are recorded. The record is kept until you delete your account.

2.2 Messages, attachments and calls

• One-to-one chats are end-to-end encrypted on your device (Double Ratchet with X3DH key agreement). Our server passes the encrypted messages on and cannot decrypt them. Until 12 October 2026: if the recipient is offline, the encrypted message waits on our server until the recipient’s device downloads it and is then deleted. From 12 October 2026: the encrypted message is kept on our server until the recipient’s app confirms it has received it — usually a fraction of a second, also when the recipient is online — and is then deleted; this way a message is not lost when the recipient’s connection has just dropped. In both cases a message nobody confirmed is kept for at most 30 days and is then removed by a clean-up that runs every hour. Delivery and read marks waiting for the sender are kept until the sender’s device has received them, at most 8 days.
• Post-quantum protection. When both people use version 1.1 or later, a new conversation is set up with a hybrid key agreement: the X25519 exchange described above combined with the post-quantum algorithm ML-KEM-768. It is meant to keep messages recorded today unreadable even to someone who later has a quantum computer. For this our server stores a few more of your public keys. A conversation with someone on an older version is set up the earlier way.
• Edits and “Delete for everyone”. The new text of an edited message is end-to-end encrypted. So that an edit or a deletion also reaches someone who is offline, our server keeps it — who changed which message for whom, identified by message number only — until the recipient’s device has received it, at most 30 days.
• Reactions. A reaction in a one-to-one chat is end-to-end encrypted like a message; if the other person is offline it waits on our server for up to 30 days, and the server sees who sent it to whom but not what it is. When the other person still uses app version 1.0, the reaction is sent the older way: our server sees the emoji while passing it on and does not store it. In groups and channels reactions are encrypted with a key the server does not have: the server stores which member reacted to which post and when, not the emoji, and deletes this when the post is deleted, when you leave the group or channel, or when you delete your account.
• Send later. When you choose “Send later”, the app encrypts the message at once and hands it to our server together with the time to send it; the server keeps it until that time — for at most 366 days (a sealed-sender message: at most a day) — and then delivers it like any other message. While it waits, the server knows that your account has a message scheduled, its time and its size; whom it is for and the encrypted message itself are stored sealed under a key kept apart from the database, and the server cannot read the text, as with every message. You can cancel a scheduled message, change it or send it at once; it is deleted from the server when it is sent or cancelled. A note that it was sent or could not be delivered (without content; for a one-to-one message it does not name the recipient, and the message’s identifier is kept in it under the same seal) is kept for 30 days so that your devices learn of it.
• Groups and channels. Posts are end-to-end encrypted with keys shared only among members and are stored on our server in encrypted form so members can load the history. They are removed when their author deletes them, when the group’s auto-delete timer expires, when the group or channel is deleted, or when the author deletes their account. The group’s name, description, photo, list of members and their roles, and short service notices (for example “auto-delete turned on”) are stored unencrypted so the service can manage membership.
• Photos, videos, voice messages and files are encrypted on your device (XSalsa20-Poly1305) before upload. The key travels only inside the end-to-end encrypted message. Our server stores the encrypted file together with its size, upload time, uploader and recipient or group, so the recipients can download it. The server cannot decrypt it. There is currently no automatic expiry for these files: the encrypted file stays on the server until its uploader deletes their account — also after the message is deleted in the chat.
• Voice and video calls are end-to-end encrypted (DTLS-SRTP; each side signs its key fingerprint with its identity key). Our server only forwards the call set-up messages. Audio and video go directly between the devices or, when a direct connection is not possible, through our relay (TURN) server, which forwards the encrypted media without being able to decrypt it. We do not record calls. During a direct connection the other participant’s device can see your IP address. If the app has not received the list of our servers by the time a call is set up, it asks a public Google server (STUN) for its own network address: Google then sees the IP address of your device, and the request says nothing about your account or the person you are calling. Your call history is kept only on your device.
• What the server necessarily sees. To deliver messages and calls, our server processes who is contacting whom, when, and how large a message is, and whether you are online. We do not keep a separate record of this beyond the delivery queues described above and the server logs described in 2.9. If you turn on “Hide sender in notifications”, one-to-one text messages are sent, where possible, with “sealed sender”: the sender is named only inside the encrypted envelope, so it is not stored with a message waiting for delivery and does not appear in the notification.
• Encryption keys. Your public keys are stored on our server so others can start encrypted conversations with you, together with a short statement, signed by your device, of which features your app version supports. Your private keys stay on your device.

2.3 Stories

A story (text, photo or video) is not end-to-end encrypted. Our server stores it and shows it for 24 hours to the mr.enzo users with whom you have chosen each other — you added them to your contacts or wrote to them, and they did the same for you — except people you blocked or who blocked you. After 24 hours it disappears from the feed. You can delete your story earlier. The photo or video of a story is kept on the server as an ordinary, unencrypted file and is deleted from it within about an hour after the story is gone; if you delete the story earlier, no later than about a day after the file was uploaded.

2.4 Contacts

• Your mr.enzo contacts (the people you add in the app or write to) are stored on our server as a list of accounts. We use it to restore your contacts on a new device and to decide who sees whose stories.
• Find friends from your address book is optional and runs only when you tap it and allow access to Contacts. Your address book is not uploaded. The app turns each phone number and email address into a blinded cryptographic value on your device and sends only those values; our server processes them without being able to see the numbers or addresses, and your device then works out the matches itself. The server learns how many entries were checked — not which ones, and not which of them matched — and does not store them. Names and other address-book details never leave your device.
• Invitation links. A link you share to invite someone (mrenzo.com/pair/…) contains your numeric account ID and your username, and nothing secret. Anyone who gets the link can read them, and when it is opened in a browser our server logs the request like any other (2.9).

2.5 Notifications

We store the push tokens of your devices (including the VoIP token that lets calls ring) together with a random installation ID created by the app, to send notifications through the Apple Push Notification service. The notification we send shows the sender’s display name (a neutral title if you turn on “Hide sender in notifications”) and a generic text such as “New message”. So that your iPhone can show who wrote and what, the notification may also carry the message itself — in encrypted form that only your device can open: Apple relays it and cannot read it, and neither can our server. Your iPhone decrypts it and shows the text in place of “New message”; when a message is too large for a notification, your iPhone fetches it, still encrypted, from our server. If you turn on “Protected mode” in Settings, the message is not put into notifications and they show only “New message”. With the notification Apple also receives the technical data the app needs to open the right chat: for a one-to-one message, the sender’s numeric account ID and the message number (not sent if “Hide sender in notifications” is on); for a group or channel, its ID and, unless the name is hidden, its name. The wake-up of an incoming call always carries the caller’s numeric account ID, username and display name, the call number and whether it is a video call: without them the iPhone cannot show the call screen.

• Muted chats. When you mute a chat, the app tells our server which chat is muted and until when, so the server stops sending notifications for it. This is stored until you unmute the chat, the mute ends, you leave the group or delete your account.
• Hidden chats and notifications. So that your iPhone can keep a notification of a hidden chat neutral, the server adds to a notification a short hint — the sender’s account number or the group, and the message number — encrypted to a key that only your device has. Apple relays it and cannot read it. The server does not know which of your chats are hidden.

2.6 The offline network (Bluetooth and local Wi‑Fi)

While the offline network is on (it is on by default, in “Auto” mode), your iPhone exchanges messages with nearby devices running mr.enzo over Bluetooth and Apple’s peer-to-peer Wi‑Fi.

• What nearby devices see. Your name is not announced. The radio shows a random code that the app replaces with a new one from time to time. A message sent over the offline network carries your numeric account ID and your public signing key, so that the devices passing it on can check it is genuine. A device nearby can therefore tell that two messages come from the same account; it cannot read them. The service frames of the offline network — for example those of push-to-talk and “Find nearby” — carry your account number and signing key in the same way. Messages are end-to-end encrypted.
• Carrying. To reach the recipient, a message may be carried by other people’s devices for up to 24 hours, and your device may carry theirs. The carrying devices cannot read them.
• Couriers: a message may pass through our server. A phone that carries your message and has internet access can hand it to our server, which then delivers it like any other message. For such a message the server sees what it sees for every message — sender, recipient, time, size — and never the content. The recipient’s address travels sealed, so that only our server can open it. Our server does not record which phone handed over which message; like any request, the hand-over appears in the server logs (2.9) with the courier’s IP address and the time. You can turn off sending through couriers, and carrying for others, in the offline network settings. Messages of an account that has “Hide sender in notifications” on are never couriered: they carry nothing a courier could hand to our server, and reach it only from the sender’s own device.
• Relay mode keeps the radios on while the app is open so that your iPhone passes on other people’s encrypted messages. A phone in relay mode is also a courier: when it has internet access it hands the encrypted messages it carries, other people’s included, to our server as described above, and while relay mode is on this cannot be switched off separately. It changes nothing about what nearby devices can see.
• Without couriers, offline-network traffic does not go through our server. You can turn the offline network off in Settings.

2.7 Link previews

If a message you write contains a link and link previews are on (you can turn them off in Settings), your iPhone itself opens the page to read its title, description and picture. The website therefore sees a request from your IP address. The preview then travels inside the end-to-end encrypted message: our server does not see the link, and the recipient’s device does not contact the website to show the preview.

2.8 Reports and blocks

• Reports. When you report a user, message, group, channel or story, we store the report: your account, the reported account and item, the reason, your optional comment and — because messages are end-to-end encrypted — the text of the messages you choose to include, which your device decrypts and sends only with the report. Reports are also emailed to our moderation mailbox. We keep reports as long as needed to handle them and to prevent repeated abuse, also after either account is deleted.
• Blocks. We store whom you blocked so the server can stop their messages, calls, stories and online status from reaching you. The record is deleted when you unblock the person or delete your account.

2.9 Diagnostics and server logs

• Diagnostics. The app sends technical events to our server — errors and warnings, connection and call set-up steps, and crash and hang reports that iOS provides (MetricKit), with the device model and iOS version. They are linked to your account ID so we can investigate problems; some events also carry the numeric account ID of the other person (for example whom you called, or whose message could not be decrypted) and the call number. The events are built not to contain message content or encryption keys, and are written to the server logs. Once a day the app also sends the performance totals iOS collects for it (MetricKit): how long it ran on screen and in the background, processor time, the amount of data sent and received over Wi‑Fi and cellular, average screen brightness of its content and peak memory, together with the offline-network mode that was set. They contain no content and no identifier of other people, and are linked to your account ID like the other diagnostics.
• Server logs. Our servers log technical data about requests: IP address, time, the requested address (search terms and sign-in tokens are removed from it before it is logged), app and system version, your account ID and username for signed-in actions, and errors, as well as delivery records: the numeric account IDs of the sender and the recipient of a message, call or push-to-talk transmission, and the time. The call relay logs the IP addresses of the devices that connect to it. We use logs only for security, abuse prevention and fixing problems. They are limited in size and overwritten as they fill up — normally within about a month.
• Usage statistics. Our server also keeps daily totals of how the service is used — for example how many accounts connected, how many messages were relayed, how many calls were started and notifications sent, and which app versions are in use. Only the counts are stored: no account ID, device identifier, IP address or message content. To count how many different accounts connected on a day, the server keeps account IDs in memory for that day only and then stores just the number. While the service is small, a breakdown can describe a single person — for example the number of accounts on one app version, or the length of the only call of a day — so those breakdowns (per app version, call durations, individual diagnostic event names) are deleted after 30 days, like server logs; the other daily totals are kept for up to 2 years. We use these statistics only to run and improve the service.

2.10 What stays on your device

Your message history, media, contacts and call history are stored on your iPhone. Deleting the app removes them from the device.

Two things the app hands to iOS, on your iPhone only. Calls made in mr.enzo are listed in Recents of the Phone app; you can stop that with “Show Calls in Phone Recents” in the app’s App Lock settings. And so that the iOS share sheet can suggest your chats, the app tells iOS the names and pictures of the chats you write in — never the messages. The app removes a suggestion when you delete or hide the chat or block the person, and all of them when you sign out or delete your account; iOS also lets you turn such suggestions off in its Settings, in the Siri section.

2.11 Push-to-talk

With push-to-talk you hold a button and speak to one contact, who hears it almost at once, also on a locked iPhone. It is off until you switch it on in Settings. It works only between two people who have each added the other as a contact, and only while both have it switched on; you can stop a particular contact from reaching you this way.

• The audio is end-to-end encrypted. Our server passes the encrypted audio on and keeps it in memory only, for at most about three minutes, in case the listener’s phone connects a moment late; it is never written to disk.
• As with calls, the server sees who speaks to whom, when, and for how long.
• To wake the listener’s iPhone we use Apple’s Push to Talk service. For each transmission Apple receives the listener’s push-to-talk token, the time, a random transmission number and the speaker’s numeric account ID — no name and no audio. Unlike a message notification, this ID is included even if “Hide sender in notifications” is on.
• We store the push-to-talk token of your device and the list of contacts you stopped from reaching you this way. The token is deleted when you switch push-to-talk off, sign out or delete your account.
• Between nearby phones without internet, push-to-talk goes over the offline network (2.6) and does not touch our server.

2.12 Stickers and the public sticker catalogue

• Making a sticker happens on your iPhone (the subject is cut out of a photo by iOS on the device). Your own sticker sets are kept on your device.
• Sending a sticker in a chat works like sending a photo: it is encrypted on your device and our server cannot open it. From its size, and from the same file being sent again, the server may be able to tell that an attachment is probably a sticker.
• Publishing a set is your choice, and a published set is public. If you submit a set to the catalogue, its pictures and title are stored on our server without end-to-end encryption. We look at every set and every update before it appears (pre-moderation). After approval the set is shown to users of the app, who can add it. Your name and username are shown with it only if you turn that on; your account is recorded as the owner of the set in any case and is visible to the moderators.
• What we do not record: which account added, opened or searched for which set. A set only has a counter of how many times it was added. As for every request, the server logs (2.9) hold the IP address, time and address of such requests, which includes the number of a set, until the logs rotate.
• Removal. You can unpublish or delete your set at any time; people who already added it keep their copy. Anyone can report a set from the app, and rights holders can write to ajkzantokaev@gmail.com. A set that breaks the Terms of Use is removed from the catalogue and from the devices it was added to. The pictures of a set removed by moderation are kept for a limited time as evidence (normally 30 days; another period where the kind of violation or the law requires it), also if the author’s account is deleted meanwhile. Reports and the record of moderation decisions keep numeric account IDs.
• Pictures you uploaded for a set that was never submitted are deleted after 24 hours.

2.13 Features that work only on your iPhone

• Translating a message uses Apple’s Translation framework on your device, after detecting the language on the device. The text is not sent to us, and the app does not send it to anyone else. iOS may download language packs from Apple; Apple then learns that your device asked for a language, not what you translate.
• Turning a voice message into text uses Apple’s speech recognition in on-device mode only: the audio does not leave your iPhone. If iOS cannot recognise a language on the device, the feature is simply unavailable for it. iOS asks for your permission first.
• Translations and transcripts are kept in memory while the chat is open and are not stored.
• App lock, hidden chats and the second passcode. The passcodes and the list of hidden chats exist only on your iPhone. We do not have them and cannot reset or recover them; Face ID and Touch ID are handled by iOS.
• “Find nearby” (where the app offers it; finding by distance and direction needs ultra-wideband hardware, which Apple does not enable on every iPhone or in every country). It starts only after you invite a saved contact and they accept. The two iPhones exchange short-lived ranging tokens through end-to-end encrypted messages — through our server, which cannot read them, or over the offline network when there is no internet — and then measure distance and direction between themselves with Apple’s Nearby Interaction. It runs only while both of you keep its screen open and stops as soon as either of you closes it. Distance and direction are never sent to our server, and the tokens are not stored. While you and your contact are finding each other over Bluetooth (“Find nearby” where Ultra Wideband is unavailable), your phone sends an encrypted service frame over Bluetooth every 20 seconds. Like every frame of the mr.enzo offline network it carries your account number and signing key; any device within Bluetooth range can pick it up (the Bluetooth link itself is not encrypted), and phones with mr.enzo do not pass it on. Only your contact can tell that it is addressed to them and read it; the distance and the signal strength never leave the phone.
• In-person verification of a contact’s safety number is recorded on your device only.
• The Paste button on the code screens reads the clipboard only when you tap it and takes only the code; nothing from the clipboard is stored or sent.

3. What we do not do

• We do not show ads and do not use your data for advertising.
• We do not track you across other companies’ apps or websites and do not use the advertising identifier.
• We do not include third-party analytics, advertising or tracking SDKs.
• We do not sell your personal data or share it for money.

4. Service providers and disclosure

Daily database backups are kept on the main server and, encrypted, on a second server of the service owner: hosting provider Timeweb Cloud, Amsterdam, the Netherlands. The key that decrypts those copies is not kept on any server. The copies are kept for 7 days.

Three things reach others without passing through us: a website whose link you send receives the link-preview request described in 2.7 directly from your device; iOS may download language packs for translation from Apple (2.13); and when a call is set up the app may ask a public Google server for its own network address (2.2). The other on-device features in 2.13 do not send your content to Apple.

We share data with nobody else.

Requests from authorities

We disclose data only when the law requires it — on a valid order of a competent authority — or when it is needed to protect people from serious harm.

• What we hold is what sections 2 and 5 list: mainly the account and profile, contact lists, the encrypted messages still waiting for delivery together with who sent them to whom and when, the logs with IP addresses, and what is stored without end-to-end encryption — stories, profiles, the names and member lists of groups and channels, published sticker sets, and reports with the messages attached to them.
• What we do not hold and therefore cannot hand over: the readable content of one-to-one chats, group and channel posts, attachments and calls — where our server stores any of it, it stores it encrypted and has no key — and private keys, which stay on users’ devices.

5. How long we keep data

6. Deleting your account

Open Settings → Delete Account in the app and confirm by typing your username; the app may also ask for a code sent to your email address. If you cannot use the app, email ajkzantokaev@gmail.com from your account’s email address and we will delete the account for you.

Deleted from our servers straight away:

• your account and profile, profile photo, contact list, blocks, push tokens, public keys, sign-in sessions and the record of your consent;
• your stories, the files you uploaded, your group and channel posts and reactions, your scheduled messages, and your muted-chat and push-to-talk settings;
• the encrypted messages that were waiting for you, including their copies in the delivery queue;
• the sticker sets you published: they are taken out of the catalogue and their pictures are deleted (people who already added a set keep their copy).

A group you created passes to one of its admins or, if there is none, to its longest-standing member; a channel you created passes to one of its admins or is deleted.

What stays, and for how long:

• messages you already sent stay on the recipients’ devices, and the encrypted copies of your messages that a recipient has not collected yet stay in the delivery queue until collected or expired — at most 30 days;
• a message that someone sends to your former account after it is deleted, or a waiting copy that could not be removed at that moment, is removed by the same hourly clean-up — at most 30 days later;
• database backups, until they expire (section 5);
• server logs, until they are overwritten;
• reports and moderation decisions (2.8 and 2.12) and the pictures of a sticker set removed by moderation — until their retention period ends.

7. Your choices and rights

You can change your profile at any time, turn off link previews, the offline network, couriers and push-to-talk, unpublish a sticker set, hide the sender in notifications, keep notifications generic with “Protected mode”, and withdraw access to Contacts, the camera, the microphone, speech recognition or Bluetooth in iOS Settings. Depending on where you live (for example under the EU/UK GDPR), you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw consent at any time. Write to ajkzantokaev@gmail.com; we answer within one month, and requests under Russian personal data law within 10 working days. You may also complain to your data protection authority (in Russia, Roskomnadzor). An email address is required to create an account; everything else in your profile is optional. We make no automated decisions with legal effect about you and do not profile you.

When an account is created, the app asks everyone for a consent to the processing of personal data. It is a separate document — Consent to the processing of personal data — which Russian personal data law requires; the consent limits no right you have under other laws. The legal bases under the GDPR are these:

Under Russian personal data law (Federal Law 152-FZ) we process data to enter into and perform our agreement with you (the Terms of Use), to protect rights and legitimate interests — ours and other users’ (security, reports, diagnostics) — and on the basis of your consent where it is required.

8. Children

mr.enzo is not intended for children under 13 — or under a higher age if the law of your country sets one for services like this (up to 16 in some EU countries). If you are under 18 — or under the age of majority where you live, if that is higher — you may use mr.enzo only with the permission of a parent or guardian. We do not ask for your age, and the birthday you may add to your profile is not used to check it. We do not knowingly collect data from children under 13; if you believe a child under 13 uses mr.enzo, contact us and we will delete the account.

9. Security and international transfers

All connections to our server use TLS, and content is end-to-end encrypted as described above. No system is perfectly secure, but we work to protect your data and limit what we store. Our servers are in the European Union: in Germany and, for the encrypted backup copies (section 4), in the Netherlands. The developer is based in Russia and runs the service from there: server administration, the handling of reports and support correspondence are done from Russia. There is no European Commission adequacy decision for Russia. Apple, Google and Resend may process the data they handle for us (section 4) in other countries, including the United States, under their own safeguards.

10. Changes

If we change this policy, we publish the new version on this page with a new date and version number and add a line to the History below. A change that significantly affects how we use your data is published on this page before it takes effect, with the date from which it applies. When the consent to the processing of personal data changes in substance, the app asks you to accept its new version the next time you open it.

11. Contact

Questions or requests: ajkzantokaev@gmail.com.

History

• 11 October 2026 (version 2026-10-11). From 12 October 2026 our server keeps every encrypted one-to-one message until the recipient’s app confirms it — usually a fraction of a second — and not only when the recipient is offline: this way a message is not lost when the recipient’s connection has just dropped. The longest storage time is unchanged, 30 days, and the server still cannot read a message. Added how long delivery and read marks are kept (at most 8 days). Section 2.2 and the retention table changed.
• 9 October 2026 (version 2026-10-09). Brought in line with the server released together with app version 1.1.1: a one-time code and the address it was sent to are removed about a minute after the code expires; undelivered messages are removed by an hourly clean-up after 30 days; deleting an account also removes the copies waiting for it; the username of a new account is no longer made from the email address; sign-in by phone number is off; the record of consent is described. Corrected 2.5: a notification may carry the message in encrypted form. Added: the fallback request to a Google server when a call is set up (2.2 and section 4), invitation links (2.4), what the app hands to iOS (2.10), requests from authorities (section 4), the parent’s permission for people under 18 (section 8). Sections 4 to 7 are laid out as tables and lists. The notes “from version 1.1” were removed from the text.
• 30 September – 8 October 2026. Several editions; the last of them described app version 1.1: push-to-talk, the public sticker catalogue, “Send later”, post-quantum key agreement, encrypted reactions, couriers and relay mode in the offline network, the optional phone number and birthday in the profile, muted and hidden chats, the features that work only on the iPhone and “Find nearby”. These editions also named the operator and said where backup copies are kept.
• 28 September 2026. First version.