We built the product so this page could be short

Overview

This policy describes how Midnight Messenger (the product) handles information when you use the app or this website. It is written to reflect exactly how the system is built, not a generic template. If a section describes a technical guarantee, that guarantee is enforced in code, not just in this document.

Midnight Messenger is built around a simple rule that shows up throughout this policy: if we do not need to see something to run the service, we build the system so that we cannot see it.

What is kept, and where

Here is everything the system keeps, and where it lives. Most of it never leaves your phone.

• On your phone. Your recovery phrase and keys, in the phone's secure storage. Your chats, your contacts, your contact code, and the people you blocked or ignored. If you set a Midnight PIN: a salted Argon2id hash of it (never the PIN itself), how Face ID or your fingerprint counts with it, how many wrong PINs were typed, and a marker of which faces or fingerprints were set up on the phone when the PIN was last typed (never a face or fingerprint itself). Each contact's key, and whether and when you marked them verified. If a chat has disappearing messages, the phone keeps only the id and send time of your own messages that disappeared, for 7 days, so read receipts still work. After you remove or block a chat, the phone still remembers that contact's key, filed under a hash of their username, never the name itself, so the name cannot come back with a different key. That stays on the phone only, until you sign out or delete your account. From build 11: your profile picture if you set one, the pictures your contacts sent you, kept with each chat and gone when the chat goes, and your choices for typing and status.
• Shared only with your contacts. From build 11, two new kinds of data, both your choice. A profile picture, if you set one, goes to the people you chat with, encrypted inside each chat. Your phone resizes it and strips location, camera and time data before it leaves. Typing dots and your online, away or offline status are off until you turn them on, and also travel encrypted inside each chat. None of it is stored on our servers, and nothing new is kept there. Like a message, a relay may hold a picture's encrypted pieces for a contact who is offline, up to 7 days, without waking them. Typing and status are never held at all.
• In a chat backup file, only if you make one. From build 11, you can save your chats to one encrypted file, from Settings, and keep it wherever you choose: your phone's files, a computer, a drive. It holds your chats (never disappearing messages, and never messages still waiting to send), your contacts and whether you verified them, each chat's disappearing-messages setting, profile pictures, and a few settings, like your typing and status choices. It never holds your 24 words, your keys, your Midnight PIN or which app lock you use. It is encrypted with a key made from your 24 words, so only you can open it, and only into the same account. It is never uploaded to our servers. Anyone who has both the file and your 24 words can read your chat history, as they could already take your account with the 24 words alone.
• On the Midnight chain. A registration that proves your account exists: a commitment (a one-way value generated on your device that reveals nothing about you) and the public key your device signs with. Permanent, like everything on a blockchain.
• Our directory. A hash of your username, never the username you typed, mapped to your public keys, and who may add you: people with your contact code, anyone, or nobody new. Your contact code itself is never sent. The directory keeps only a slow one-way hash of it, and replaces that when you change the code. If you delete your account, all of this is removed, and the directory keeps only the hash of the deleted username, your public key and your signed request to delete, each with the date. They make sure the name and key are never used again, and let your other phones check that the deletion came from your account. When you open a chat, the app looks that username up in the directory, by its hash, at most once a day, to notice if a different key is ever named for it. That tells the directory that someone at your internet address looked up that username that day, the same thing it learns whenever anyone adds a contact. Keeping a hash, not the name, stops the directory from being read as a list of names. It does not hide a name from someone who knows or guesses it: they can work out its hash and look it up, which is how people find you. By default, finding your name is not enough to reach you: a new person also needs your 6-digit contact code to send you a chat request. If you choose "Anyone with my username" in Settings, under "Who can add me", the name alone is enough, and someone who looked you up while that was on keeps what they need to send you a request, even after you change it back.
• Relays. Encrypted messages waiting for someone who is offline, deleted once collected or after 7 days. Relays can be run by us or by independent operators, and either way they see only encrypted traffic (see What a relay can see). During the beta on the test network, our relay also holds a delayed view of what it sees for beta testers, in memory only: never stored, gone when it restarts, and removed before launch.
• Alerts. Your phone's push token, kept by our alert service so it can wake your phone with "New message", never the sender or the text. Relays never hold the token: they pass on a sealed ticket that only our alert service can open. Our alert service learns when your phone is woken, never who wrote or in which chat. Alerts reach iPhones through Apple's push service and Android phones through Google's Firebase Cloud Messaging.
• Signup phone check. When you sign up in the phone apps, Apple (App Attest and DeviceCheck) or Google (Play Integrity) confirms the request comes from our real app on a real phone. Apple keeps two bits per iPhone for us, one of which means "has had a free account". Google keeps nothing for us. We store nothing about the phone, and nothing about it is linked to your account or put on the chain.
• Our proof server, at signup. Signing up needs zero-knowledge proofs. Today our proof server, at proof.midnightmessenger.app, makes them, not your phone. To make a proof, the app sends the server the proof's private inputs: the identity secret and nonce your on-chain commitment is built from. Never your 24 words or the seed behind them. The server builds the proof and sends it back, and only the commitment ever goes on the chain. The app uses the proof server only while you sign up, with a short-lived pass from our beta gate. The network service in front of our servers passes these requests on, so it sees them too. We plan to make proofs on the phone itself, targeted for the second half of 2027, and then the secret and nonce will not leave it at all.
• Basic operational metadata. Things like connection timestamps and rate-limit counters, kept only as long as needed to keep the service reliable and abuse-free.

What we never see

Because of how the app is built, the following never reaches our servers in a readable form, ever:

• The plaintext content of any message you send or receive
• Your real name, phone number, email, or government ID
• Your wallet address or any wallet activity tied to your public identity
• The plaintext of any username you register or search for
• Your recovery phrase or the seed it is derived from
• Your contacts, or who you blocked or ignored
• Your Midnight PIN or your contact code
• Your safety codes, or which contacts you verified
• Your profile picture, or what your typing and status updates say
• Which message a reply quotes
• Your chat backups, which stay wherever you save them

We do not run advertising, we do not sell data, and we do not build behavioral profiles. There is no plaintext data set to monetize even if we wanted to.

What a relay can see

Messages travel through relays: servers that pass encrypted messages between phones and hold them for someone who is offline. Besides ours, relays can be run by independent operators. We run two relays of our own, and from build 10 the beta apps send every message through both. Every approved relay is listed, with its uptime, on our public relay status page.

Relay A is a relay we run. Relay B is a relay at a hosting company, in a separate place, so chats keep working while one of them is down. Your phone encrypts each message once and sends the same encrypted copy to both. The other phone uses the first copy that arrives and drops the second. Relay B runs the same code under the same rules: it holds encrypted messages only for someone who is offline, deletes them once collected or after 7 days, and never sees message content or usernames. The hosting company, as its host, can see what any relay sees: encrypted bytes, the internet addresses that connect, sizes and timing. It cannot read a message. Older builds use relay A only. From build 11, Settings lists both relays your app uses.

A relay cannot read what it carries, and it never sees usernames. Like any server that carries traffic, it can see how big each encrypted message is, when it passes, and the internet address it comes from. An operator's relay sees exactly what ours does, and never any content.

To hide how long messages are, the beta apps pad every message and read receipt, inside its encryption, to one of a few fixed sizes (256 bytes, 1, 4 or 16 KiB), so a relay sees the same size for "ok" as for a few lines. Padding hides length. It does not hide timing, or that a message was sent.

From build 11, typing dots, status and profile pictures travel through relays too, encrypted inside the chat like a message. A relay can never read them. What it can see is that a short typing or status update went by, and when, or that a picture update went by. Because these updates are marked apart from messages, a relay can tell roughly when someone in a chat is typing. If updates to several chats line up in time, a relay could guess that those chats belong to one person. To make that harder, each chat's status updates run on their own timer, started at a random moment, and no typing or status goes out while the app is locked. Typing, and the regular status update, go only while the other person's app is open. Typing and status are off unless you turn them on, and with them off, none of this is sent. Relays pass typing and status straight on and never hold them. They hold a picture's encrypted pieces for a contact who is offline, up to 7 days, without waking their phone.

Beta testers can watch this for themselves. Signed in with a beta code at beta.midnightmessenger.app/window, they see a delayed view of what our relay sees: each message's journey (passed straight on, held for an offline phone and picked up, still waiting, or refused), chat requests left in inboxes, sizes rounded up to 256 bytes, the last few bytes of the encrypted data, and counts per hour. It never shows a room, a message id, a key, an internet address, or whether anyone is online. It runs 30 seconds behind, a minute at a time, with times rounded to the minute. With so few testers, someone watching closely may be able to line up some of that timing. The view lives only in our relay's memory. It is never stored, and it is gone when the relay restarts. It shows our relay only, not relays run by operators. It is part of the beta on the test network, and it goes away before launch.

How encryption works

Every conversation uses MLS (Messaging Layer Security, RFC 9420), an open, widely reviewed protocol designed specifically for secure group messaging. Encryption and decryption happen entirely on your device. Our relay server only ever handles the resulting ciphertext, moving it between devices without the ability to read it.

We do not implement our own cryptographic primitives. Every cipher, hash, and proof system used in the app comes from established, independently maintained libraries.

How identity verification works

When you first open the app, your device generates a secure identity key. A cryptographic commitment derived from that key, not the key itself, is registered on Midnight Network through a zero-knowledge proof. This supports verification that a key is registered and that a peer controls it, without revealing the secret key. It does not verify a real-world identity or establish that each account belongs to a unique human.

Registration is sponsored, meaning the network fee is paid on your behalf. We never require you to hold or fund a cryptocurrency wallet to use the app.

You can also check a contact yourself. Each chat shows a 60-digit safety code made from both of your keys, to compare in person or on a call. It is computed on your phone and never sent. Scanning a contact's QR code in person checks their key the same way. A username's key never changes, so if a different key is ever named for a contact, the chat keeps the key it started with and warns you.

From build 11, when you mark a contact verified, by comparing the code or scanning their QR code, they see a line in the chat: "@yourname verified your safety code". That note travels inside the encrypted chat, like a message, so our servers never learn who verified whom. It does not mark you verified for them. Each person checks the other for themselves.

Data retention

Encrypted message envelopes are held only when the person you are messaging is offline, and are deleted from the relay the moment their device collects them. Anything never collected is deleted automatically after 7 days. Your directory entry, the hash of your username and the keys that let people reach you, stays with your account. After you delete your account, the directory keeps only the hash of the deleted username, your public key and your signed request to delete, each with the date, for good, so the name and key are never used again. On-chain identity commitments are public and permanent by nature of the ledger they are recorded on, and nobody, us included, can delete them. They reveal nothing about you beyond the fact that a registration occurred.

What is kept on your phone stays there until you delete it or sign out. Signing out removes your keys and chats from that phone. A chat backup file you saved is not touched: it stays wherever you put it until you delete it, and we never hold a copy. In a chat with disappearing messages on, each message is deleted from both phones when its time is up, and the timer travels inside the encryption, so our relay never sees it. From build 11, a reply carries only a reference to the message it answers, never its text again. Each phone shows the quote from its own copy, so when a disappearing message goes, its quote goes with it. Profile pictures are kept on the phone with the chat, and go when the chat goes. Typing and status are never kept in your history. Removing a chat does not remove the key the phone remembers for that contact. Signing out or deleting your account does. When you delete a chat, block someone or sign out, your phone asks the relay to drop the alert ticket it holds for you there, and a relay drops any ticket not renewed for 60 days. When you change your contact code, the directory's hash of the old one is replaced.

Third parties

Identity commitments are published to Midnight Network, a public, permissionless ledger. Anyone can see that a commitment exists; no one, including us, can derive your identity from it. We use a sponsor service to pay registration fees on your behalf, which processes a sealed transaction without ever learning who you are.

When you sign up in the phone apps, Apple or Google checks that the request comes from our real app on a real phone, as described above. Alerts are delivered by Apple's push service on iPhone, and by Google's Firebase Cloud Messaging on Android. An alert carries only the text "New message" and the number on the app icon. Apple or Google learns that your phone got an alert, and when, never who sent it or what it says. Firebase analytics are switched off in the app. Our second relay, relay B, runs at a hosting company. That company can see encrypted bytes, the internet addresses that connect, sizes and timing, never what a message says. Relays can be run by independent operators, who see only encrypted traffic, the same as our own relays. At signup, the app sends the private inputs for its proofs to our proof server, through the network service in front of our servers, so that service sees those requests as it passes them on, as described above.

Our help channel is on Discord, which Discord runs, not us. What you post there is public to everyone in the server, and that includes what you write to Sky, our AI assistant. Sky's answers are written by an AI, Anthropic's Claude, so what you ask her is processed by Anthropic to answer it. We keep a copy of Sky's conversations, and when you give her feedback about the app (a bug, something confusing, or an idea), the team reads it, with your Discord name and when you posted it. Sky never asks for your username, contact code or recovery phrase, so never post them. Nothing from the app goes to Sky or to Discord unless you post it yourself. Security problems go privately to the address under Contact, never to Discord.

We do not share, sell, or otherwise provide message content, usernames, or identity information to advertisers, data brokers, or analytics platforms, because that data does not exist on our servers in a usable form to begin with.

Your rights and control

Your 24-word recovery phrase is the only way to restore your identity, and it is generated and stored on your device. We cannot see it, recover it, or reset it on your behalf. You can stop using the app at any time. Signing out erases everything the app kept on that phone. To keep your chats, save a chat backup first, from Settings: it is your file, and you decide where it lives and when to delete it. Your registration on Midnight cannot be deleted by anyone, us included. Our directory keeps the hash of your username and the keys that let people reach you. You can delete your account in the app, in Settings. Your username stops working at once, and the app erases your keys and chats from the phone. To make sure your username and key are never used again, our directory keeps the hash of the deleted username, your public key and your signed request to delete, each with the date, and nothing else about you. The steps are on Delete your account. Messages waiting on a relay are deleted once collected, or after 7 days. Questions about your data go to the address under Contact below.

Changes to this policy

If this policy changes in a way that materially affects how your data is handled, we will update the date at the top of this page and provide notice inside the app ahead of the change taking effect.

Contact

Questions about this policy or how your data is handled can be sent to support@devbyone.com.