Privacy Policy
Peer Messenger (“we,” “us,” or “our”) operates the Peer Messenger mobile application and related services at peermessage.net. This Privacy Policy explains how we collect, use, and protect information when you use our services.
1. Summary
Peer Messenger is designed so that what you write and share is kept on your own devices: your messages, photos, videos, documents and blogs, and your contacts’ names. Our servers verify your account, connect your devices to your contacts’ devices, and hold encrypted messages and encrypted copies of your content while they wait to be collected. We cannot read those. The one exception is message text that someone chooses to send us with an abuse report. Section 2 describes what our servers do hold, including your contact relationships in hashed form.
2. Where your information is
What stays on your devices. Your messages, photos, videos, documents and blogs. Your contacts’ names. Your display name and picture. Your call history. Your private encryption keys. These are stored on your phone, and on your linked computer if you have one. Our servers do not hold them in a form we can read, with one exception: the message text that a person chooses to submit with an abuse report (listed below). Much of this information passes through our servers encrypted, and some of it waits there, still encrypted, until it is collected: a message or a call signal to a contact; a copy of your content, contacts, groups, profile and history on its way between your own devices; and the name, picture and note you attach to an invitation (section 6).
What we hold in a form we can read.
- Your registration phone number, and when it was verified.
- A record for each of your devices: a random device id, the kind of device, whether it is your phone or a linked computer, its push-notification tokens, when it was last active, and the result of the genuine-device check made at sign-in, which for an iPhone includes an identifier of the key that check used.
- A history of events on your account, each with its time and the device concerned: a phone registered, a computer linked, a device removed or replaced, a change of number or of the registration lock, a contact removed or unblocked, content published or withdrawn, one person’s access to your content taken back, and messages retracted.
- Your public encryption keys, filed under your phone number. These are the half of each key pair that is meant to be shared: they let your contacts’ devices encrypt to you and confirm that a message came from you. They cannot be used to read anything. Your private keys never leave your devices.
- For a limited time (section 6): the two phone numbers on an invitation; the recipient’s phone number on a message waiting for delivery; on a notice that a contact changed their number, their old and new numbers; on a notice that a contact removed you or deleted their account, their number; a phone number that has asked for a verification code, whether or not it becomes an account, with the count of wrong attempts; and the phone number that is linking a computer.
- The count of recent wrong attempts at your registration-lock PIN, if you set one.
- Abuse reports made by you or about you: both phone numbers, the category, any comment, and the message text the reporter chose to submit.
- Your acceptance of our terms and this policy (document, version, time).
- In our relay’s memory: while your app is connected, which of your devices are connected, the public network address or address prefix of each connection, the local network address each device reports, and the phone numbers of the contacts whose online status your app follows; for about 6 minutes, the pairs of phone numbers the relay has checked as being contacts; during a call whose audio or video our relay carries, and for about 1 minute after the call, a keyed hash for each participant’s device and each participant’s public network address; and, for up to 30 days after a device was last connected, a record of that device: your phone number, the device id, the kind of device, its public key and when it was last seen.
- Server logs: the time, the network your request came from (your IP address with its last part removed, so it names a network rather than your device), the kind of request and its result, a device id, the last four digits of a phone number and, while diagnostic logging is switched on, the local network address your device reports. Your full IP address is written only when a request is refused for exceeding a rate limit.
What we hold as hashes or in encrypted form.
- Your contact relationships and blocks, as keyed hashes rather than phone numbers.
- Messages waiting for delivery, encrypted to the recipient’s devices so that we cannot read them. The sender is recorded as a keyed hash; the recipient is recorded by phone number and device id, as listed above. These include call signals, and encrypted copies of your content, contacts, groups, profile and history on their way between your own devices.
- The name, picture and note you attach to an invitation, encrypted between the two people in the invitation so that we cannot read them.
- Encrypted descriptions of the content you have shared, with keyed hashes of who may open them.
- Your session tokens, your verification codes while they are valid, and your registration-lock PIN if you set one, each as a hash.
- Some of the counters that limit repeated sign-in attempts, stored against a keyed hash of the phone number, of the network address, or of both together. The counts of wrong verification codes and of wrong registration-lock PIN attempts listed above are stored against the phone number itself.
- Any ban we have placed on a phone number for abuse, as a keyed hash with our note of the reason.
Keyed hashes keep your contact relationships from being read at a glance. They do not hide them from someone who holds a copy of our database: other records in the same database connect most hashes to the phone number they stand for. A stolen copy of the database could therefore reveal who your contacts are, whom you have blocked and who has blocked you, who may open what you share, who sent each waiting message to whom, and when an account published, withdrew or retracted something. It would also show directly every registered phone number, the recipient’s number on each waiting message, and the phone numbers on recent invitations, notices and abuse reports; a removal notice that is still waiting shows that two people were contacts. Under valid legal process the same information could be produced.
These lists describe the main kinds of information we hold. They are not a complete inventory: our servers also keep short-lived working records, such as limits on repeated requests, held in memory against a phone number or a network address.
3. How we use information
- Authenticate you via one-time passcode (OTP) SMS
- Route encrypted requests between your device and your contacts’ devices
- Deliver push notifications for invites and pending requests
- Maintain security, prevent abuse, and comply with law
- Improve reliability of our services
4. SMS and text messaging
Peer Messenger uses SMS only to deliver one-time verification codes when you request sign-in. We do not send promotional or marketing text messages.
- Opt-in: You choose to receive SMS by entering your mobile number and affirmatively consenting in the Peer Messenger app or on our SMS opt-in page.
- Message frequency: Messages are sent only when you request a verification code. You may receive up to 3 verification messages per hour per phone number.
- Charges: Message and data rates may apply.
- Mobile information non-sharing: Mobile information, including your phone number and SMS opt-in consent, will not be shared with third parties or affiliates for marketing or promotional purposes. We use a messaging provider (Twilio) solely to deliver verification codes on our behalf under contract; they do not use your number for their own marketing.
- Help: Email support@peermessage.net.
- Opt-out: Verification texts are transactional and sent only at your request. To stop receiving them, do not request a code. You may delete your account in the app under Settings → Delete account, or contact support@peermessage.net.
5. How we share information
We do not sell your personal information. We share data only:
- With service providers that help us operate the app (e.g., SMS delivery, push notification services, cloud hosting), under contractual obligations to protect your data and use it only to provide services to us
- When required by law or to protect rights, safety, and security
- With other users only as you direct — for example, profile details and content you choose to share with contacts
We do not share, sell, rent, or transfer mobile phone numbers or SMS consent data to third parties, affiliates, or lead generators for their own marketing purposes.
6. What we keep, and for how long
We do not keep your content: photos, videos, documents and blogs are served from your own devices. What our servers hold of it is encrypted: copies that wait there until they are collected or expire, as described below, and the encrypted descriptions of what you share, which are kept while you share it. The periods below are applied by scheduled clean-up, so a record can remain for a time after its period ends, usually no more than about an hour.
- A message waiting for delivery, including an encrypted copy of your content on its way between your own devices, is deleted when it is delivered, and after 3 days if it could not be delivered.
- An invitation record holds the inviter’s and the invitee’s phone numbers. An invitation that is not answered expires after 14 days. If an invitation is declined, cancelled or expires, its record is deleted 7 days later. If it is accepted, its record is replaced 14 days after it was accepted by the hashed contact relationship described in section 2, and the phone numbers in it are deleted then. The encrypted name, picture and note attached to an invitation are removed when it is declined or cancelled, or when the inviter’s device has collected the reply to an accepted one, and otherwise when the invitation record is deleted.
- A notice waiting for your devices is deleted when they collect it. One that is never collected is deleted after 14 days if it is about a change of number, or 30 days if it is about a removal.
- A phone number that asked for a verification code is kept, with the hash of the code, for up to about an hour after the code expires or is used, or about two hours when the code was used to change a number.
- The history of events on your account is kept for up to 24 months.
- Server logs are kept for up to 30 days. Each log is rotated daily and anything older than 30 days is deleted. Under very heavy traffic a log can also be rotated by its size, so its entries may be kept for a shorter time, never a longer one.
- Encrypted backups of our database are kept for up to 42 days while backups are running normally. If backups stop, the most recent copies are kept until they resume.
- In our relay’s memory, connection details are discarded when your app disconnects, or within a few minutes if the connection is lost without a clean disconnect. The results of contact checks are discarded within about 6 minutes, and call details within about 1 minute after the call. The record of each of your devices is kept for up to 30 days after the device was last connected. The relay’s memory is cleared when the relay restarts.
- An abuse report that has been handled is deleted 365 days after it was filed. A report that has not been handled is kept until it is. A report that concerns child safety is kept for as long as the law requires.
- Your acceptance of our terms and this policy is kept permanently, as the record of what you agreed to.
- Most of the rest of section 2 is kept while you have your account. When you delete your account in the app, it is deleted, with these exceptions: abuse reports about the account; your acceptance records; blocks that other people placed on your number, so that they still hold if the number is registered again; any ban on the number; the notices that tell your contacts’ devices that you have gone or changed number, which hold your number until they are collected, or for up to 30 days; the relay’s record of your devices, for up to 30 days; and some short-lived security records that are cleared later rather than at once, such as the record that a device was removed and the counters described in section 2. Copies remain in the logs and backups for the periods above.
7. Security
Traffic between apps and our servers uses TLS. Content shared between peers is end-to-end encrypted. No system is perfectly secure; use a strong device passcode and keep your app updated.
8. Your choices
- You choose which contacts to add and what content to share.
- You can delete your account in the app at any time, under Settings → Delete account. That deletes what our servers hold about your account, as described under “What we keep, and for how long”.
- You may ask for a copy of the account data our servers hold by emailing privacy@peermessage.net.
9. Children
Peer Messenger is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
10. International users
Our servers may be located in the United States. If you use the service from another country, your information may be processed in the U.S.
11. Changes
We may update this policy from time to time. We will post the revised version on this page with an updated effective date.
12. Contact
Privacy: privacy@peermessage.net
Support: support@peermessage.net