Privacy Policy

Version 2026-11-12 · Last updated: 12 November 2026

mr.enzo is a messenger for iPhone with end-to-end encrypted chats and calls and an offline network that works without the internet. This policy explains, in plain words, what data the app and our server handle, why, for how long, and what you can do about it. It describes the current version of the app; what changed in this document, and when, is in the History at the end.

1. Who is responsible

mr.enzo is developed and operated by Garnik Papian, an independent developer (an individual) based in Russia (“we”, “us”), who is the controller of the personal data described here. Contact for anything about privacy, including requests to exercise your rights: ajkzantokaev@gmail.com.

2. What we process and why

2.1 Your account

• Email address. You sign in with your email address and a one-time code we send to it. We use it to sign you in, to protect your account and to answer you. A code is valid for 10 minutes; the record of it — the code and the address it was sent to — is removed from the server as soon as the code is used, or about a minute after it expires. Other users who already know your email address can find your account by it — by typing it in search or with “Find friends” (see 2.4); where the app offers it, you can stop this with “Find Me by Email” in the Privacy section of the app’s settings, and you can still sign in with your address then. You choose who sees the address itself in “Who can see my email” — where the app offers it: “Everybody”, “My Contacts”, “Selected Contacts” or “Nobody” (the choices of “Who can see my number”, below); the default is “Nobody”: only you can see it. It is never shown to someone you blocked or who blocked you, and with “Everybody” the server shows one person at most 100 other people’s addresses a day.
• Phone number — for accounts that sign in with one, and for older accounts that were created with a phone number; people who know it can find such an account by it in the same way — and where the app offers a number search, only by a number confirmed by SMS and as “Who can find me by my number” allows (below). Where the app offers sign-in by phone number, you can sign in with a phone number instead of an email address: we send a one-time code to it by SMS, and its record on our server is removed like that of an email code. To send and check the code, your number, your IP address, the type of your device and the version and language of the app go to our SMS provider Prelude (Ding Negoce SAS, France), only for that purpose; Prelude stores data in the EU and may transfer it outside the EU, and to deliver the SMS, the number and the message pass through the mobile operators of the number’s country. We record when a number was confirmed with such a code, and only a confirmed number signs in: a number an older account was created with but never confirmed by SMS does not. Sign-in by email stays. A number can also be added to an account that signs in by email — then it signs in either way. If an account with a number has not been used for more than 45 days and a new holder confirms that number with an SMS code, they choose: sign in to that account (with a code sent to the account’s email, if it has one) or create a new account; in the second case the number is taken off the old account, and its email, if any, gets a notice. A number written before version 1.2.5 and never confirmed by SMS is taken off its account when somebody else confirms that number. When a number is added, changed, removed or taken off, the account’s email, if any, gets a notice that shows the number only as its country code and last two digits. A number can be removed when the account has an email address: it then signs in by email only. To limit abuse, our server counts the codes sent to each number, and those asked for from each network address, during a day (UTC) under a keyed fingerprint, not the number or the address itself, and deletes the count when that day is over.
• A phone number in your profile (optional). You can add a phone number to your profile so that the people you talk to can save it or call it: we store it as you entered it and do not verify it. Where the app offers it, the profile number is the number confirmed by SMS that you sign in with, and a number typed in by hand is deleted. You choose who sees it in “Who can see my number”: “Everybody” (where the app offers it) — any mr.enzo user, though the server shows one person at most 100 other people’s numbers a day; “My Contacts” — your contacts, that is, people you added or wrote to who also added you or wrote to you; “Selected Contacts” — only those of them you ticked (for this the server stores the list of the contacts you ticked); “Nobody” — no one. It is never shown to someone you blocked or who blocked you. Someone who already has your number in their address book sees it on their own phone whatever these settings say. We never use a number typed in by hand to find your account or to match anyone’s address book, and you can remove it at any time. Who can find you by your confirmed number (with friend finding, a number search or a mrenzo.com/+number link, 2.4) you choose in “Who can find me by my number” — where the app offers it: “Everybody” — anyone who has your number, or “My Contacts” — only the people in your mr.enzo contacts; there, someone you blocked also finds you neither by your number nor by your email address.
• Date of birth in your profile (optional). You can add your birthday — the day and month, with or without the year — so that your contacts are reminded of it: we store it as you entered it and show it only to your contacts (the same people as for the phone number with “My Contacts”, and never to someone you blocked or who blocked you) or to no one if you choose “Nobody”. The reminders are made on your contacts’ own iPhones from their contact list: our server sends no birthday notifications and keeps no schedule of them. A reminder is planned on your contact’s phone in advance (up to 30 days ahead), is shown the day before your birthday and on the day itself, and disappears after the app on that phone has refreshed its contact list. If you hide or remove the date, a reminder already planned on someone else’s phone may still appear until that phone refreshes its list. A contact who sees the date can keep it on their own device, for example in their iPhone’s Contacts. We do not use it to find your account, to check your age or for anything else, and you can change or remove it at any time.
• Username, display name, profile photo and bio. These form your public profile. Any mr.enzo user can find you by username or display name and see this profile; search by username, display name or email address does not show you to someone you blocked. A new account gets a random username — “user” and eight digits — that says nothing about your email address; you can change it in your profile. An account created earlier may still have a username made from the beginning of its email address (the part before “@”) or, if it was created with a phone number, from the letter “p” and the digits of that number, until its owner changes it; where the app offers a number search, search does not find an account by a username of the letter “p” and a number’s digits. A username can be changed once every 14 days; for this the server keeps the time of the last change. Your profile photo is stored unencrypted and anyone who has its link can open it.
• Optional security settings: a cloud password (stored only as a hash) and its hint, a recovery email address, and a two-step verification secret with recovery codes. They are stored so we can check them when you sign in.
• Sessions. Sign-in tokens (stored as hashes), when they expire and a device label, the time you were last online, the build number of the app your account last connected with (so the server knows which message formats your app understands), which sign-in registered each push token and push-to-talk token, and a label of the iPhone that holds your account’s keys now. Where the app offers “Sign Out Other Devices”, the other sign-ins of your account end, and their push tokens and push-to-talk tokens are deleted, when you choose it, set, change or remove the cloud password, turn two-step verification on or off, change the sign-in address, or sign in after recovering the cloud password. Those devices have to sign in again; their messages stay on them.
• The record of your consent. When you accept the Consent to the processing of personal data, we record that your account accepted it: the version of the document, the time, the language it was shown in and a fingerprint (SHA-256) of its text. We also keep the text of each version as it was shown, starting with the version that followed 2026-10-08.2; for an acceptance of version 2026-10-08.2 or an earlier one, only the version and the time are recorded. The record is kept until you delete your account.

2.2 Messages, attachments and calls

• One-to-one chats are end-to-end encrypted on your device (Double Ratchet with X3DH key agreement). Our server passes the encrypted messages on and cannot decrypt them. Until 12 October 2026: if the recipient is offline, the encrypted message waits on our server until the recipient’s device downloads it and is then deleted. From 12 October 2026: the encrypted message is kept on our server until the recipient’s app confirms it has received it — usually a fraction of a second, also when the recipient is online — and is then deleted; this way a message is not lost when the recipient’s connection has just dropped. In both cases a message nobody confirmed is kept for at most 30 days and is then removed by a clean-up that runs every hour. A message with a hidden sender (see “What the server necessarily sees” below) also waits for delivery for up to 30 days, and the clean-up removes it no later than 31 days after it was sent. Your phone sends a read mark if you have not turned off “Read Receipts” in the Privacy section of the app’s settings; while they are off, you do not see whether your messages were read either. Delivery and read marks waiting for the sender are kept until the sender’s device has received them, at most 8 days.
• Post-quantum protection. When both people use version 1.1 or later, a new conversation is set up with a hybrid key agreement: the X25519 exchange described above combined with the post-quantum algorithm ML-KEM-768. It is meant to keep messages recorded today unreadable even to someone who later has a quantum computer. For this our server stores a few more of your public keys. A conversation with someone on an older version is set up the earlier way.
• Contact cards and a new number. A contact card (the name and the numbers and addresses you ticked) and the message that your number changed are ordinary end-to-end encrypted messages: the server cannot read them. Your phone tells only the people you chose about your new number, and only those the server shows your number to; such a message is not sent to groups or channels.
• Edits and “Delete for everyone”. The new text of an edited message is end-to-end encrypted. So that an edit or a deletion also reaches someone who is offline, our server keeps it — who changed which message for whom, identified by message number only — until the recipient’s device has received it, at most 30 days.
• Reactions. A reaction in a one-to-one chat is end-to-end encrypted like a message; if the other person is offline it waits on our server for up to 30 days, and the server sees who sent it to whom but not what it is. When the other person still uses app version 1.0, the reaction is sent the older way: our server sees the emoji while passing it on and does not store it. In groups and channels reactions are encrypted with a key the server does not have: the server stores which member reacted to which post and when, not the emoji, and deletes this when the post is deleted, when you leave the group or channel, or when you delete your account.
• Send later. When you choose “Send later”, the app encrypts the message at once and hands it to our server together with the time to send it; the server keeps it until that time — for at most 366 days (a sealed-sender message: at most a day) — and then delivers it like any other message. While it waits, the server knows that your account has a message scheduled, its time and its size; whom it is for and the encrypted message itself are stored sealed under a key kept apart from the database, and the server cannot read the text, as with every message. You can cancel a scheduled message, change it or send it at once; it is deleted from the server when it is sent or cancelled. A note that it was sent or could not be delivered (without content; for a one-to-one message it does not name the recipient, and the message’s identifier is kept in it under the same seal) is kept for 30 days so that your devices learn of it.
• Groups and channels. Posts are end-to-end encrypted with keys shared only among members and are stored on our server in encrypted form so members can load the history. They are removed when their author deletes them, when the group’s auto-delete timer expires, when the group or channel is deleted, or when the author deletes their account. After a post is deleted, the server keeps a record of it for a while: its number, the number the author’s app gave it, who posted it in which group and when it was deleted — no content and not when it was posted. This stops the post from appearing again if the author’s app repeats a send whose answer never reached it. The record is kept for 90 days when the author or an admin deleted the post and for one day when the auto-delete timer did; it goes at once when the group or the author’s account is deleted. The group’s name, description, photo, list of members, their roles and who added each member, and short service notices (for example “auto-delete turned on”) are stored unencrypted so the service can manage membership.
• Photos, videos (video messages included), voice messages and files are encrypted on your device (XSalsa20-Poly1305) before upload. A video message is an ordinary end-to-end encrypted video; the camera and the microphone work only while it is being recorded. The key travels only inside the end-to-end encrypted message. Our server stores the encrypted file together with its size, upload time, uploader and recipient or group, so the recipients can download it. The server cannot decrypt it. When a message is sent from app version 1.2.5 or newer, the file of a disappearing message is deleted from the server no later than 31 days after the message has disappeared, and the file of a message its sender deleted for everyone soon after the deletion has reached the server. In a group or channel a file’s term follows the group’s auto-delete timer: if the timer is turned off, the files still on the server stay. A sticker’s file stays: the app sends it again. All other files stay on the server until their uploader deletes their account — also after a message is deleted only for oneself.
• Voice and video calls are end-to-end encrypted (DTLS-SRTP; each side signs its key fingerprint with its identity key). Our server only forwards the call set-up messages. Audio and video go directly between the devices or, when a direct connection is not possible, through our relay (TURN) server, which forwards the encrypted media without being able to decrypt it. We do not record calls. During a direct connection the other participant’s device can see your IP address. If the app has not received the list of our servers by the time a call is set up, it asks a public Google server (STUN) for its own network address: Google then sees the IP address of your device, and the request says nothing about your account or the person you are calling. Your call history is kept only on your device.
• The second tick from a notification. So that the sender sees the second tick once a message has been shown on your phone in a notification, the server keeps the message number and the time the notification reached your phone for 8 days. The message text and the sender’s name are not kept.
• What the server necessarily sees. To deliver messages and calls, our server processes who is contacting whom, when, and how large a message is, and whether you are online. We do not keep a separate record of this beyond the delivery queues described above and the server logs described in 2.9. If you turn on “Hide sender in notifications”, one-to-one text messages are sent, where possible, with “sealed sender”: the sender is named only inside the encrypted envelope, so it is not stored with a message waiting for delivery and does not appear in the notification.
• Encryption keys. Your public keys are stored on our server so others can start encrypted conversations with you, together with a short statement, signed by your device, of which features your app version supports. Your private keys stay on your device.

2.3 Stories

A story (text, photo or video) posted from app version 1.2.1 or newer is end-to-end encrypted: it is encrypted on your phone, and the key goes to each person who may see the story through your encrypted chat with them. Our server stores the encrypted story and shows it for 24 hours to the mr.enzo users with whom you have chosen each other — you added them to your contacts or wrote to them, and they did the same for you — except people you blocked or who blocked you. The server cannot read it, but it sees that you posted a story and when, who may see it, to whom your phone sent the key, how many files the story has and how large they are, and who downloaded them. A story posted from an older version of the app is not end-to-end encrypted. After 24 hours a story disappears from the feed. You can delete your story earlier. The photo or video of a story is kept on the server as a file — encrypted for a story from version 1.2.1 or newer, an ordinary unencrypted one for an older story — and is deleted from it within about an hour after the story is gone; if you delete the story earlier, no later than about a day after the file was uploaded.

2.4 Contacts

• Your mr.enzo contacts (the people you add in the app or write to) are stored on our server as a list of accounts. We use it to restore your contacts on a new device and to decide who sees whose stories.
• Calls and “online”. If you call someone yourself or answer their call, the server remembers only that fact — so that this person can see whether you are online, just as if you had written to them. The record is deleted when you remove the contact or delete your account.
• Finding friends from your address book is optional: it works only if you allowed access to Contacts. The app then checks by itself which of your contacts are on mr.enzo — after you allow the access, when your address book changes, and at most once a day when you open the app or in the background if iOS allows it (where the app offers it; otherwise when you tap “Find Friends from Contacts”). Your address book is not uploaded. On your device the app writes the numbers in their international form, turns each phone number and email address into a blinded cryptographic value (OPRF) and sends only those values; our server processes them without being able to see the numbers or addresses, and your device then works out the matches itself. From the check itself the server learns only how many entries were checked — not which ones, and not which of them matched — and does not store them. The people found are added to your mr.enzo contacts (with a check you tap, the ones you add yourself) — so the server learns which mr.enzo users are among your contacts, but not your address book; like any contact of yours, they may see when you are online and add you to groups. To prevent number guessing, the server counts your account’s checks per day (where the app does not offer a number search, only in its memory). A number search (where the app offers it: in the Search tab, from a mrenzo.com/+number link, from a number in a message or on a contact card) works the same way: the number reaches the server only blinded. Names and other address-book details never leave your device: the app shows names from it only on your iPhone, and the notice that a contact of yours joined mr.enzo is made by the app itself, on your iPhone. Where the app offers it, you can turn the check off: take away mr.enzo’s access to Contacts in iOS Settings → mr.enzo.
• Invitation links. A link you share to invite someone (mrenzo.com/pair/…) contains your numeric account ID and your username, and nothing secret. Anyone who gets the link can read them, and when it is opened in a browser our server logs the request like any other (2.9). A mrenzo.com/+number link contains a phone number; when it is opened in a browser, the server does not look the number up and logs it without every digit but the last two.

2.5 Notifications

We store the push tokens of your devices (including the VoIP token that lets calls ring) together with a random installation ID created by the app, to send notifications through the Apple Push Notification service. When your account is moved to another iPhone with app version 1.2.5 or newer, notifications, calls and push-to-talk wake-ups no longer reach the previous iPhone. The notification we send shows the sender’s display name (a neutral title if you turn on “Hide sender in notifications”) and a generic text such as “New message”. So that your iPhone can show who wrote and what, the notification may also carry the message itself — in encrypted form that only your device can open: Apple relays it and cannot read it, and neither can our server. Your iPhone decrypts it and shows the text in place of “New message”; when a message is too large for a notification, your iPhone fetches it, still encrypted, from our server. If you turn on “Hide message text” in Settings (in app versions before 1.2.4 it is called “Protected mode”), the message is not put into notifications and they show “New message” instead of its text; this switch does not hide the sender’s name — “Hide sender in notifications” does. With the notification Apple also receives the technical data the app needs to open the right chat: for a one-to-one message, the sender’s numeric account ID and the message number (not sent if “Hide sender in notifications” is on); for a group or channel, its ID and, unless the name is hidden, its name. The wake-up of an incoming call always carries the caller’s numeric account ID, username and display name, the call number and whether it is a video call: without them the iPhone cannot show the call screen.

• Muted chats. When you mute a chat, the app tells our server which chat is muted and until when, so the server stops sending notifications for it — except a push-to-talk ring from such a chat, which comes silently (2.11). This is stored until you unmute the chat (answering such a ring does that too), the mute ends, you leave the group or delete your account.
• Hidden chats and notifications. So that your iPhone can keep a notification of a hidden chat neutral, the server adds to a notification a short hint — the sender’s account number or the group, and the message number — encrypted to a key that only your device has. Apple relays it and cannot read it. The server does not know which of your chats are hidden.

2.6 The offline network (Bluetooth and local Wi‑Fi)

While the offline network is on (it is on by default, in “Auto” mode), your iPhone exchanges messages with nearby devices running mr.enzo over Bluetooth and Apple’s peer-to-peer Wi‑Fi.

• What nearby devices see. Your name and your account number are not announced. The radio shows a random code that the app replaces with a new one from time to time. When you and the other person both have app version 1.2.3 or newer, the messages, push-to-talk, photos and service frames for that person go sealed: neither a device nearby nor a phone that carries a message on sees the sender or the recipient, or can tell that two frames come from, or go to, the same person; only the recipient’s phone can recognise a frame as its own and open it. Others see only that it is an mr.enzo frame, its size and its time. To a person with an older version the app sends frames as before: a message, push-to-talk or a service frame (for example of “Find nearby”) then carries your numeric account ID and your public signing key, so that the devices passing it on can check it is genuine, and a device nearby can tell that two such frames come from the same account. In both cases messages are end-to-end encrypted, and nearby devices cannot read them.
• “People Nearby”. The exception is the People Nearby screen. While you keep it open, your phone sends to the phones within radio range, every few seconds and for up to 10 minutes at a time, the same signed code your QR code shows: your username, display name, numeric account ID and public keys (no photo). Any device within range can pick it up (the radio link itself is not encrypted); mr.enzo shows it to the people nearby who have the same screen open, and no phone passes it on. The requests to add someone sent from that screen, and the answers to them, are not sealed either: they carry your account number and signing key, and a request also carries the same code. People you blocked are not shown to you; a contact is added only after one side asks and the other accepts. Close the screen and the sending stops.
• Carrying. To reach the recipient, a message may be carried by other people’s devices for up to 24 hours, and your device may carry theirs. The carrying devices cannot read them.
• Couriers: a message may pass through our server. A phone that carries your message and has internet access can hand it to our server, which then delivers it like any other message. For such a message the server sees what it sees for every message — sender, recipient, time, size — and never the content. The recipient’s address (and, in a sealed frame, the sender’s too) travels sealed, so that only our server can open it. Our server does not record which phone handed over which message; like any request, the hand-over appears in the server logs (2.9) with the courier’s IP address and the time. From app version 1.3.0 every phone with the offline network on is a courier: this cannot be turned off on its own, only together with the offline network (Terms of Use, section 6). In versions before 1.3.0 you can turn off sending through couriers, and carrying for others, in the offline network settings. Messages of an account that has “Hide sender in notifications” on are never couriered: they carry nothing a courier could hand to our server, and reach it only from the sender’s own device.
• Relay mode keeps the radios on while the app is open so that your iPhone passes on other people’s encrypted messages. A phone in relay mode is also a courier: when it has internet access it hands the encrypted messages it carries, other people’s included, to our server as described above, and while relay mode is on this cannot be switched off separately. It changes nothing about what nearby devices can see.
• Without couriers, offline-network traffic does not go through our server. You can turn the offline network off in Settings.

2.7 Link previews

If a message you write contains a link, your iPhone itself opens the page (from app version 1.3.0 always; in earlier versions only with link previews on, which could be turned off in Settings) to read its title, description and picture. The website therefore sees a request from your IP address. The preview then travels inside the end-to-end encrypted message: our server does not see the link, and the recipient’s device does not contact the website to show the preview.

Where the app offers “Via the server if the site won’t open” and you turned it on, and the page did not open on your iPhone, the app passes the link to our server, which opens the page itself to take its title, description and picture. In that case our server sees the link and which account asked, but not the chat or the recipient; it does not store the link or write it to logs, and forgets the answer at once. The website sees a request from our server’s address, not yours. This path is off by default.

2.8 Reports and blocks

• Reports. When you report a user, message, group, channel or story, we store the report: your account, the reported account and item, the reason, your optional comment and — because messages are end-to-end encrypted — the text of the messages you choose to include, which your device decrypts and sends only with the report. Reports are also emailed to our moderation mailbox. We keep a report for one year from when it was filed, also after either account is deleted, and then delete it together with the message text attached to it; a report on a sticker set that has not been reviewed yet is kept until it is decided. Once a quarter we delete the report emails in the moderation mailbox that are older than a year.
• Blocks. We store whom you blocked so the server can stop their messages, calls, stories and online status from reaching you. The record is deleted when you unblock the person or delete your account.

2.9 Diagnostics and server logs

• Diagnostics. The app sends technical events to our server — errors and warnings, connection and call set-up steps, and crash and hang reports that iOS provides (MetricKit), with the device model and iOS version. They are linked to your account ID so we can investigate problems; some events also carry the numeric account ID of the other person (for example whom you called, or whose message could not be decrypted) and the call number. The events are built not to contain message content or encryption keys, and are written to the server logs. Once a day the app also sends the performance totals iOS collects for it (MetricKit): how long it ran on screen and in the background, processor time, the amount of data sent and received over Wi‑Fi and cellular, average screen brightness of its content and peak memory, together with the offline-network mode that was set. They contain no content and no identifier of other people, and are linked to your account ID like the other diagnostics. About transcribing voice and video messages, diagnostics say how and in which language it ran, whether it worked and how long it took, and about a video message that the recording stopped and why; they contain no audio, text or picture. All of this sending can be turned off with the “Error Reports” switch in the Privacy section of the app’s settings: then the app sends nothing described in this paragraph and does not collect iOS crash reports, and what was written while the switch was off is not sent after it is turned on again either. This switch does not turn off the server logs (below).
• Server logs. Our servers log technical data about requests: IP address, time, the requested address (search terms and sign-in tokens are removed from it before it is logged), app and system version, your account ID and username for signed-in actions, and errors, as well as delivery records: the numeric account IDs of the sender and the recipient of a message, call or push-to-talk transmission, and the time. The call relay logs the IP addresses of the devices that connect to it. A phone number or an email address is logged only in part: a number as its country code and last two digits, an address as its first letter and its domain. We use logs only for security, abuse prevention and fixing problems. They are kept for at most 30 days and then deleted automatically.
• Usage statistics. Our server also keeps daily totals of how the service is used — for example how many accounts connected, how many messages were relayed, how many calls were started and notifications sent, and which app versions are in use. Only the counts are stored: no account ID, device identifier, IP address or message content. To count how many different accounts connected on a day, the server keeps account IDs in memory for that day only and then stores just the number. While the service is small, a breakdown can describe a single person — for example the number of accounts on one app version, or the length of the only call of a day — so those breakdowns (per app version, call durations, individual diagnostic event names) are deleted after 30 days, like server logs; the other daily totals are kept for up to 2 years. We use these statistics only to run and improve the service.

2.10 What stays on your device

Your message history, media, contacts and call history are stored on your iPhone. Deleting the app removes them from the device.

Two things the app hands to iOS, on your iPhone only. Calls made in mr.enzo are listed in Recents of the Phone app; you can stop that with “Show Calls in Phone Recents” in the You tab → Privacy. And so that the iOS share sheet can suggest your chats, the app tells iOS the names and pictures of the chats you write in — never the messages. The app removes a suggestion when you delete or hide the chat or block the person, and all of them when you sign out or delete your account; iOS also lets you turn such suggestions off in its Settings, in the Siri section.

2.11 Push-to-talk

With push-to-talk you hold a button and speak to one contact, who hears it almost at once, also on a locked iPhone. It is off until you switch it on in Settings. Speaking works only between two people who have each added the other as a contact, and only while both have push-to-talk switched on; you can stop a particular contact from reaching you this way.

• The ring. A contact you have not blocked or stopped from reaching you by push-to-talk can ring you while your push-to-talk is off: you get a notification that names them (a neutral text if you hide the sender in notifications), and you can answer it or ignore it. Answering turns your push-to-talk on. It is a Time Sensitive notification, so it can come through a Focus unless you turn that off for mr.enzo in iOS Settings, and it comes with a ring sound. If you muted your chat with them, their ring comes silently into the notification list — no sound, no banner, never through a Focus — on app version 1.2.5 or newer, and not at all on older versions; answering it also unmutes the chat. Our server accepts at most 10 rings a minute from one account. A ring carries no audio. It goes through our server, or over the offline network when you are near each other.
• What the server keeps of a ring. The ring notification goes through Apple (section 4): Apple receives the caller’s name and numeric account ID and the time of the ring — neither the name nor the ID if you hide the sender in notifications. So that a ring is not lost when its notification does not arrive, our server keeps an unanswered ring — only the caller’s account ID and the time — in memory, never on disk, for at most 10 minutes, and hands it once to your app when it asks. It is gone as soon as your app has taken it, when you switch push-to-talk on, or when you talk to that contact.
• The audio is end-to-end encrypted. Our server passes the encrypted audio on and keeps it in memory only, for at most about three minutes, in case the listener’s phone connects a moment late; it is never written to disk.
• As with calls, the server sees who speaks to whom, when and for how long, and who rings whom.
• To wake the listener’s iPhone we use Apple’s Push to Talk service. For each transmission Apple receives the listener’s push-to-talk token, the time, a random transmission number and the speaker’s numeric account ID — no name and no audio. Unlike a message notification, this ID is included even if “Hide sender in notifications” is on.
• We store the push-to-talk token of your device and the list of contacts you stopped from reaching you this way. The token is deleted when you switch push-to-talk off, sign out or delete your account.
• Between nearby phones without internet, push-to-talk and its ring go over the offline network (2.6) and do not touch our server.

2.12 Stickers and the public sticker catalogue

• Making a sticker happens on your iPhone (the subject is cut out of a photo by iOS on the device). Your own sticker sets are kept on your device.
• Sending a sticker in a chat works like sending a photo: it is encrypted on your device and our server cannot open it. From its size, and from the same file being sent again, the server may be able to tell that an attachment is probably a sticker.
• Publishing a set is your choice, and a published set is public. If you submit a set to the catalogue, its pictures and title are stored on our server without end-to-end encryption. We look at every set and every update before it appears (pre-moderation). After approval the set is shown to users of the app, who can add it. Your name and username are shown with it only if you turn that on; your account is recorded as the owner of the set in any case and is visible to the moderators.
• What we do not record: which account added, opened or searched for which set. A set only has a counter of how many times it was added. As for every request, the server logs (2.9) hold the IP address, time and address of such requests, which includes the number of a set, until the logs rotate.
• Removal. You can unpublish or delete your set at any time; people who already added it keep their copy. Anyone can report a set from the app, and rights holders can write to ajkzantokaev@gmail.com. A set that breaks the Terms of Use is removed from the catalogue and from the devices it was added to. The pictures of a set removed by moderation are kept for a limited time as evidence (normally 30 days; another period where the kind of violation or the law requires it), also if the author’s account is deleted meanwhile. Reports and the record of moderation decisions keep numeric account IDs.
• Pictures you uploaded for a set that was never submitted are deleted after 24 hours.

2.13 Features that work only on your iPhone

• Translating a message uses Apple’s Translation framework on your device, after detecting the language on the device. The text is not sent to us, and the app does not send it to anyone else. iOS may download language packs from Apple; Apple then learns that your device asked for a language, not what you translate.
• Turning a voice message or a video message into text uses Apple’s speech recognition on your iPhone only: the audio does not leave your iPhone. You can choose the transcription language — one for all chats and one for a single chat; the choice is kept only on your iPhone. For some languages iOS downloads a language pack from Apple — only after you tap; without a network iOS downloads it later by itself. Apple then learns that your device asked for a language, not what was said. If a language cannot be recognised on the device, transcription is unavailable for it. iOS asks for your permission first.
• Translations and transcripts are kept in memory while the chat is open and are not stored.
• App lock, hidden chats and the second passcode. The passcodes and the list of hidden chats exist only on your iPhone. We do not have them and cannot reset or recover them; Face ID and Touch ID are handled by iOS.
• “Find nearby” (where the app offers it; finding by distance and direction needs ultra-wideband hardware, which Apple does not enable on every iPhone or in every country). It starts only after you invite a saved contact and they accept. The two iPhones exchange short-lived ranging tokens through end-to-end encrypted messages — through our server, which cannot read them, or over the offline network when there is no internet — and then measure distance and direction between themselves with Apple’s Nearby Interaction. It runs only while both of you keep its screen open and stops as soon as either of you closes it. Distance and direction are never sent to our server, and the tokens are not stored. While you and your contact are finding each other over Bluetooth (“Find nearby” where Ultra Wideband is unavailable), your phone sends an encrypted service frame over Bluetooth every 20 seconds. If your contact has app version 1.2.3 or newer, the frame is sealed like the other frames of the offline network (2.6) and shows neither of you; to an older version it carries your account number and signing key, as before; any device within Bluetooth range can pick it up (the Bluetooth link itself is not encrypted), and phones with mr.enzo do not pass it on. Only your contact can tell that it is addressed to them and read it; the distance and the signal strength never leave the phone.
• In-person verification of a contact’s safety number is recorded on your device only.
• The Paste button on the code screens reads the clipboard only when you tap it and takes only the code; nothing from the clipboard is stored or sent.

3. What we do not do

• We do not show ads and do not use your data for advertising.
• We do not track you across other companies’ apps or websites and do not use the advertising identifier.
• We do not include third-party analytics, advertising or tracking SDKs.
• We do not sell your personal data or share it for money.

4. Service providers and disclosure

Daily database backups are kept on the main server and, encrypted, on a second server of the service owner: hosting provider Timeweb Cloud, Amsterdam, the Netherlands. The key that decrypts those copies is not kept on any server. The copies are kept for 7 days.

Three things reach others without passing through us: a website whose link you send receives the link-preview request described in 2.7 directly from your device (or, if you turned on the fallback in 2.7, from our server); iOS may download language packs for translation and speech recognition from Apple (2.13); and when a call is set up the app may ask a public Google server for its own network address (2.2). The other on-device features in 2.13 do not send your content to Apple.

We share data with nobody else.

Requests from authorities

We disclose data only when the law requires it — on a valid order of a competent authority — or when it is needed to protect people from serious harm.

• What we hold is what sections 2 and 5 list: mainly the account and profile, contact lists, the encrypted messages still waiting for delivery together with who sent them to whom and when, the logs with IP addresses, and what is stored without end-to-end encryption — stories posted from app versions before 1.2.1, profiles, the names and member lists of groups and channels, published sticker sets, and reports with the messages attached to them.
• What we do not hold and therefore cannot hand over: the readable content of one-to-one chats, group and channel posts, attachments, calls and stories posted from app version 1.2.1 or newer — where our server stores any of it, it stores it encrypted and has no key — and private keys, which stay on users’ devices.

5. How long we keep data

6. Deleting your account

Open You → My Profile → Delete Account in the app and confirm by typing your username; the app may also ask for a code sent to your email address. If you cannot use the app, email ajkzantokaev@gmail.com from your account’s email address and we will delete the account for you.

Where the app offers it, an account that has not been used for the period you choose — 1, 3, 6 or 12 months, or 12 months unless you choose otherwise — is deleted by itself, just as when you delete it in the app (Settings → Privacy → “If Away For”).

Deleted from our servers straight away:

• your account and profile, profile photo, contact list, blocks, push tokens, public keys, sign-in sessions and the record of your consent;
• your stories, the files you uploaded, your group and channel posts and reactions, your scheduled messages, and your muted-chat and push-to-talk settings;
• the encrypted messages that were waiting for you, including their copies in the delivery queue;
• the sticker sets you published: they are taken out of the catalogue and their pictures are deleted (people who already added a set keep their copy).

A group you created passes to one of its admins or, if there is none, to its longest-standing member; a channel you created passes to one of its admins or is deleted.

What stays, and for how long:

• messages you already sent stay on the recipients’ devices, and the encrypted copies of your messages that a recipient has not collected yet stay in the delivery queue until collected or expired — at most 30 days;
• a message that someone sends to your former account after it is deleted, or a waiting copy that could not be removed at that moment, is removed by the same hourly clean-up — at most 30 days later;
• database backups, until they expire (section 5);
• server logs, until they are deleted — at most 30 days;
• reports and moderation decisions (2.8 and 2.12) and the pictures of a sticker set removed by moderation — until their retention period ends.

7. Your choices and rights

You can change your profile at any time, choose who sees your phone number, turn off the offline network (and, in app versions before 1.3.0, couriers on their own and link previews), push-to-talk, “Read Receipts” and “Error Reports”, unpublish a sticker set, hide the sender in notifications, keep the text out of notifications with “Hide message text”, and withdraw access to Contacts, the camera, the microphone, speech recognition or Bluetooth in iOS Settings; where the app offers it, you can also choose who sees your email address and who can find you by your number, stop others from finding you by your email address (“Find Me by Email”), in app versions before 1.3.0 turn off “Sync Contacts” and remove the people it found (from 1.3.0 the check stops when you take away access to Contacts), and sign out other devices. Depending on where you live (for example under the EU/UK GDPR), you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw consent at any time. Write to ajkzantokaev@gmail.com; we answer within one month, and requests under Russian personal data law within 10 working days. You may also complain to your data protection authority (in Russia, Roskomnadzor). An email address — or, where the app offers sign-in by phone number, a phone number — is required to create an account; everything else in your profile is optional. We make no automated decisions with legal effect about you and do not profile you.

When an account is created, the app asks everyone for a consent to the processing of personal data. It is a separate document — Consent to the processing of personal data — which Russian personal data law requires; the consent limits no right you have under other laws. The legal bases under the GDPR are these:

Under Russian personal data law (Federal Law 152-FZ) we process data to enter into and perform our agreement with you (the Terms of Use), to protect rights and legitimate interests — ours and other users’ (security, reports, diagnostics) — and on the basis of your consent where it is required.

8. Children

mr.enzo is not intended for children under 13 — or under a higher age if the law of your country sets one for services like this (up to 16 in some EU countries). If you are under 18 — or under the age of majority where you live, if that is higher — you may use mr.enzo only with the permission of a parent or guardian. We do not ask for your age, and the birthday you may add to your profile is not used to check it. We do not knowingly collect data from children under 13; if you believe a child under 13 uses mr.enzo, contact us and we will delete the account.

9. Security and international transfers

All connections to our server use TLS, and content is end-to-end encrypted as described above. No system is perfectly secure, but we work to protect your data and limit what we store. Our servers are in the European Union: in Germany and, for the encrypted backup copies (section 4), in the Netherlands. The developer is based in Russia and runs the service from there: server administration, the handling of reports and support correspondence are done from Russia. There is no European Commission adequacy decision for Russia. Apple, Google and Resend may process the data they handle for us (section 4) in other countries, including the United States, under their own safeguards.

10. Changes

If we change this policy, we publish the new version on this page with a new date and version number and add a line to the History below. A change that significantly affects how we use your data is published on this page before it takes effect, with the date from which it applies. When the consent to the processing of personal data changes in substance, the app asks you to accept its new version the next time you open it.

11. Contact

Questions or requests: ajkzantokaev@gmail.com.

History

• 12 November 2026 (version 2026-11-12). Retention table: from the server released together with app version 1.3.4, for someone whose phone was offline during a call the server keeps a missed-call record — who called, when, and whether it was a video call — until the app collects it, at most 8 days (in a backup copy made when the connection dropped, at most 30 days). The app adds it to the call history. Before, only the notification told of such a call.
• 6 November 2026 (version 2026-11-06). Sections 2.7 and 7 and the table of legal bases: from app version 1.3.0 the “Sync Contacts” and link-preview switches are gone — your address book is checked while you allow access to Contacts (take it away in iOS Settings to stop it), and the preview of a link you send is always made by your iPhone.
• 1 November 2026 (version 2026-11-01). Section 2, “Couriers”: from app version 1.3.0 every phone with the offline network on is a courier, with no switch of its own; section 7 likewise.
• 28 October 2026 (version 2026-10-28). Brought in line with app version 1.2.5 and the server released with it. Section 2.1: “Who can see my number” — “My Contacts”, “Selected Contacts” or “Nobody”; by default only you can see your email address; a username can be changed once every 14 days; search by username, display name or email address does not show you to someone you blocked; where the app offers them, the “Find Me by Email” switch, which stops others from finding you by your address, and “Sign Out Other Devices” with the account changes that end the other sign-ins. Section 2.2: video messages; the files of disappearing messages and of messages deleted for everyone are deleted from the server; a message with a hidden sender waits for delivery for up to 30 days; the “Read Receipts” switch. Section 2.5: after your account is moved, notifications no longer reach the previous iPhone; a muted chat still gets the push-to-talk ring, silently. Section 2.8: reports are kept for one year. Section 2.9: the “Error Reports” switch; server logs are kept for at most 30 days. Section 2.11: a contact whose chat you muted rings you silently, and answering unmutes the chat; instead of one ring a minute per contact, our server accepts at most 10 rings a minute from one account. Section 2.13: transcribing video messages and choosing the transcription language. Sections 2.1 and 4: where the app offers it, you can sign in with a phone number; the SMS code is sent and checked by our SMS provider Prelude, and only a number confirmed by SMS signs in. Sections 2.1, 2.2, 2.4, 2.9, 4, 5 and 7 — the phone number: a number can be added, confirmed, changed and removed, with a notice by email; an account unused for more than 45 days does not open with one SMS; an unconfirmed number is taken off its account when somebody else confirms it; where the app offers it, the profile number is the confirmed number, “Who can see my number” also has “Everybody”, there are “Who can find me by my number” and “Who can see my email”, friend finding runs by itself and the people found are added to your contacts, numbers can be searched and mrenzo.com/+number links work, and search does not find a username of the letter “p” and a number’s digits; contact cards and the message about a new number; numbers and addresses are logged only in part. Sections 5 and 6: where the app offers it, an account that has not been used for the period you choose (12 months by default) is deleted by itself. The retention table changed.
• 26 October 2026 (version 2026-10-26). Brought in line with app version 1.2.4. Section 2.6: between phones with app version 1.2.3 or newer, the frames of the offline network are sealed and show neither the sender nor the recipient; the People Nearby screen, which shows your name and account to the phones nearby while it is open, is described. Section 2.11: the push-to-talk ring — a Time Sensitive notification — and the unanswered ring our server keeps in memory for at most 10 minutes. Section 2.3: stories posted from app version 1.2.1 or newer are end-to-end encrypted. Section 2.7: the optional link-preview fallback through our server. Section 2.2: who added a member to a group. Section 2.5: “Protected mode” is now called “Hide message text”; it is made clear that it does not hide the sender’s name. One row added to the retention table.
• 21 October 2026 (version 2026-10-21). So that a deleted group or channel post does not appear again when the author’s app repeats a send whose answer never reached it, the server keeps a record of it without its content after the deletion: 90 days after deletion by the author or an admin, one day after deletion by the auto-delete timer (section 2.2). One row added to the retention table.
• 20 October 2026 (version 2026-10-20). From app version 1.2: if you call someone yourself or answer their call, the server remembers that fact so that this person can see whether you are online (section 2.4); so that the sender sees the second tick once a message is shown in a notification, the server keeps the message number and the time the notification arrived for 8 days, without the text or the sender’s name (section 2.2). Two rows added to the retention table.
• 11 October 2026 (version 2026-10-11). From 12 October 2026 our server keeps every encrypted one-to-one message until the recipient’s app confirms it — usually a fraction of a second — and not only when the recipient is offline: this way a message is not lost when the recipient’s connection has just dropped. The longest storage time is unchanged, 30 days, and the server still cannot read a message. Added how long delivery and read marks are kept (at most 8 days). Section 2.2 and the retention table changed.
• 9 October 2026 (version 2026-10-09). Brought in line with the server released together with app version 1.1.1: a one-time code and the address it was sent to are removed about a minute after the code expires; undelivered messages are removed by an hourly clean-up after 30 days; deleting an account also removes the copies waiting for it; the username of a new account is no longer made from the email address; sign-in by phone number is off; the record of consent is described. Corrected 2.5: a notification may carry the message in encrypted form. Added: the fallback request to a Google server when a call is set up (2.2 and section 4), invitation links (2.4), what the app hands to iOS (2.10), requests from authorities (section 4), the parent’s permission for people under 18 (section 8). Sections 4 to 7 are laid out as tables and lists. The notes “from version 1.1” were removed from the text.
• 30 September – 8 October 2026. Several editions; the last of them described app version 1.1: push-to-talk, the public sticker catalogue, “Send later”, post-quantum key agreement, encrypted reactions, couriers and relay mode in the offline network, the optional phone number and birthday in the profile, muted and hidden chats, the features that work only on the iPhone and “Find nearby”. These editions also named the operator and said where backup copies are kept.
• 28 September 2026. First version.