Privacy Policy
The short version
An encrypted conversation is stored as a sealed envelope the server cannot open. It is deleted once delivered. A conversation with encryption turned off is stored in a readable form so search and previews work, and the operator can read it. There is no advertising, no tracking, and no analytics on this website.
What the server necessarily sees
Encryption protects contents, not the fact of a conversation. To deliver a message at all, the server handles:
- the recipient account and device the envelope is addressed to
- the time it arrived and its approximate size
- the IP address the request came from
For a sealed message the stored record does not identify the sender, and neither does any attachment it carries — the blob is stored without an uploader, because recording one would have handed back exactly what sealing removes. The server still observes the connection that delivered it, so sealed sender is not anonymity.
What is deliberately not recorded
Timing that served no request has been removed rather than retained: when you added a buddy, when you blocked someone, when a member joined a group, and who uploaded an attachment. None of it was read by anything; all of it would have been a durable record of how your social graph formed.
What is stored, and for how long
These windows are read from this server's running configuration when the page is served:
- Delivered encrypted envelopes — deleted after 1 day(s).
- Undelivered encrypted envelopes — deleted after 30 days, whether collected or not.
- Attachments — deleted after 30 days.
- Used one-time prekeys — deleted after 7 days.
- Your contact list — stored while presence needs it; removable by you. "Take my contact list off the server" in the app deletes the server's copy for good, and your contacts live only in your devices' encrypted stores from then on.
- Devices silent for 90 days — expired: keys unpublished, queued mail deleted. The account's newest device is kept, and an account holds at most 6 devices.
An operator running their own server can configure these; the page always shows the instance's live values.
Account information
An account holds a username, an email address, and a password hash. Each device you register publishes its public keys. Private keys are generated on your device and are never transmitted.
What stays on your phone
Your conversation history is kept on your device so that closing the app does not lose it. It is sealed there with a key that lives only in that device's secure storage — never in a backup, never on another device, and never here.
A message you have started writing and not sent is kept the same way, so that switching apps or being interrupted does not lose it. That is worth saying out loud because it is the one piece of text in the app you have not decided to share with anybody: it gets the conversation's own protection rather than being left somewhere more convenient, it never leaves the device, and signing out removes it along with everything else.
Searching your messages
Searching happens entirely on your device, over the messages already there. Nothing you type into the search box is sent anywhere, and nothing is kept: the words you searched for are often more telling than what you found, so they are not written down, not even on your own phone.
There is also deliberately no search index. An index is built from your messages in readable form, so it would be a second copy of everything you have ever written — one that would have to be protected just as carefully as the first, and could be forgotten about. The app searches what it already has instead.
There is no unencrypted conversation
This section used to describe what happened to a message sent with encryption turned off: it was stored under a key the operator held, which protects against a stolen copy of the database and against nothing else. That path is gone. On 2026-09-04 the routes that accepted a readable message were removed and the table that held them was dropped, so there is no longer a way — for this app, an older one, or anybody else's — to put a readable message on this server.
We are saying what changed rather than quietly deleting the paragraph, because anyone who read the old one made a decision based on it and deserves to know it no longer applies.
This website
No cookies are set and no analytics are collected. No third-party scripts are loaded on any page, with a single exception: the donate page loads Stripe's script so the payment can be taken here instead of sending you to another site. The card fields there are Stripe's own, running in a frame this site cannot read — the card number never reaches this server. If you choose to leave an email there for a receipt, it is passed to Stripe so they can send it, and is neither stored nor logged by this server.
Every page is served under a Content Security Policy that would break it if any other third-party script were added. The donate page's policy names Stripe and nothing else; the rest of the site, including the API, allows no external origin at all.
Your choices
You can delete a device, which removes its keys and any queued messages for it. You can delete your account, which removes the account record and its devices. Messages already delivered to someone else's device are on their device and cannot be recalled by us.
Contact
Privacy questions: privacy@flamenetmessenger.com. Security reports: see the security page.