Privacy Policy
The short version
A conversation is stored as a sealed envelope the server cannot open, and it is deleted once delivered. There is no unencrypted mode to end up in: the table that once held readable messages was dropped, and nothing writes one now. There is no advertising, no tracking, and no analytics on this website.
What the server necessarily sees
Encryption protects contents, not the fact of a conversation. To deliver a message at all, the server handles:
- the recipient account and device the envelope is addressed to
- the time it arrived and its approximate size
- the IP address the request came from
For a sealed message the stored record does not identify the sender, and neither does any attachment it carries, the blob is stored without an uploader, because recording one would have handed back exactly what sealing removes. The server still observes the connection that delivered it, so sealed sender is not anonymity.
What is deliberately not recorded
Timing that served no request has been removed rather than retained: when you added a buddy, when you blocked someone, when a member joined a group, and who uploaded an attachment. None of it was read by anything; all of it would have been a durable record of how your social graph formed.
What is stored, and for how long
These windows are read from this server's running configuration when the page is served:
- Delivered encrypted envelopes, deleted the moment your app confirms receipt, or 1 day(s) after delivery if it never does.
- Undelivered encrypted envelopes, deleted after 30 days, whether collected or not.
- Attachments, deleted after 30 days.
- Used one-time prekeys, deleted after 7 days.
- Your contact list, stored while presence needs it; removable by you. "Take my contact list off the server" in the app deletes the server's copy for good, and your contacts live only in your devices' encrypted stores from then on.
- Devices silent for 90 days, expired: keys unpublished, queued mail deleted. The account's newest device is kept, and an account holds at most 6 devices.
An operator running their own server can configure these; the page always shows the instance's live values.
Account information
On a server that uses the shared FlameNet account service, as this one does, your account holds a username and a value your phone derives from your password, which cannot be turned back into it, plus a hashed recovery code if you set one up. There is no email address, and your password never leaves your phone. A server that keeps its own accounts holds a username, an email address and a password hash. Each device you register publishes its public keys. Private keys are generated on your device and are never transmitted.
What stays on your phone
Your conversation history is kept on your device so that closing the app does not lose it. It is sealed there with a key that lives only in that device's secure storage, never in a backup, never on another device, and never here.
A message you have started writing and not sent is kept the same way, so that switching apps or being interrupted does not lose it. It is the one piece of text in the app you have not decided to share with anybody: it gets the conversation's own protection rather than being left somewhere more convenient, it never leaves the device, and signing out removes it along with everything else.
Searching your messages
Searching happens entirely on your device, over the messages already there. Nothing you type into the search box is sent anywhere, and nothing is kept: the words you searched for are often more telling than what you found, so they are not written down, not even on your own phone.
There is also deliberately no search index. An index is built from your messages in readable form, so it would be a second copy of everything you have ever written, one that would have to be protected just as carefully as the first, and could be forgotten about. The app searches what it already has instead.
There is no unencrypted conversation
There is no way, for this app, an older one, or anybody else's, to put a readable message on this server. The routes that accepted one are gone and the table that held them was dropped.
This page once described a message sent with encryption turned off, stored under a key the operator held. That protected against a stolen copy of the database and against nothing else, and it is no longer possible. It is said here rather than quietly removed, because anyone who read that made a decision based on it.
Apple, Google, and the phone itself
Two parties see something about this app that this project does not choose and cannot switch off, so they are named here.
Apple reviews the iOS app and distributes it, so Apple knows who installed it. Apple also carries the wake-up that tells an iPhone to collect its mail. It contains the fixed words "Flamenet" and "New message", a sound, and at most a count of envelopes waiting: never a sender, never a thread, never any content. Apple learns that a device was woken, and when.
Google is not involved in delivery. The Android app contains no Firebase, no Play Services and no push service, and holds its own connection to the server instead, so no message and no notification passes a Google machine. What Google can still see is that the app is on the phone: on a Google-certified Android, Play Protect scans every installed app whichever way it arrived, and Google says it may receive information about apps installed "through Google Play or other sources". On a phone without Google's services, none of that applies.
From 2027 Google intends to require developers to register an identity, a package name and a signing key before an app installs smoothly on a certified Android. An unregistered developer's app stays installable after a one-time setup on the phone that includes a 24-hour wait. Whichever way that is answered here, it changes nothing about what the server holds or what these pages say it holds. See metadata for the detail.
This website
No cookies are set and no analytics are collected. No third-party scripts are loaded on any page, with a single exception: the donate page loads Stripe's script so the payment can be taken here instead of sending you to another site. The card fields there are Stripe's own, running in a frame this site cannot read, the card number never reaches this server. If you choose to leave an email there for a receipt, it is passed to Stripe so they can send it, and is neither stored nor logged by this server.
The front page carries a throwaway poll you can vote in without an account. It counts in memory and starts again when the server restarts. The one thing it remembers about you, in memory and for an hour, is that your address has voted, so that one person cannot vote fifty times; nothing about it is written to disk.
Every page is served under a Content Security Policy that would break it if any other third-party script were added. The donate page's policy names Stripe and nothing else; the rest of the site, including the API, allows no external origin at all.
Your choices
You can delete a device, which removes its keys and any queued messages for it. You can delete your account, which removes the account record and its devices. Messages already delivered to someone else's device are on their device and cannot be recalled by us.
Contact
Privacy questions: privacy@flamenetmessenger.com. Security reports: see the security page.