Privacy policy.

• Your messages, calls, photos, videos, voice notes, documents, stickers, GIFs, statuses and the locations you share are end-to-end encrypted. Only the people in the chat or on the call can read, see or hear them. We can’t, and neither can anyone else.
• Our servers pass encrypted messages on and delete each one as soon as the devices it was sent to have saved it. A message that can’t be delivered is deleted after 30 days. Your chat history is kept on your own devices.
• To run UIMessage we handle some information we can read: your phone number and profile, which of your contacts use UIMessage, your groups and their members, your devices, and records of who messaged or called whom and when. We keep each only as long as section 8 says.
• We don’t sell your information, share it for advertising or track you across other apps and websites. The apps contain no advertising, analytics or crash-reporting code.

End-to-end encrypted means the content is locked on your device with keys that only the devices in the conversation hold, and unlocked only on those devices. Our servers store and pass on the locked copy and have no key to open it. That covers:

• messages: text, replies, reactions, edits, deletions, link previews, and the lines a group shows when it changes;
• photos, videos, voice notes, documents, stickers and GIFs;
• statuses: their photos, videos and captions;
• locations and live locations;
• voice and video calls and screen sharing, one-to-one and in groups;
• the chat history your phone sends to a Mac, iPad or browser you link to it.

Every device makes its own keys, and its private keys never leave it. Your phone vouches for each device you link by signing your account's list of devices. Each pair of devices talks through its own session, set up with a post-quantum key agreement (X25519 with ML-KEM-768) and continued with the Double Ratchet, so the keys keep changing and a key stolen later can't unlock earlier messages. Groups use sender keys, given only to the members in the group's own signed membership record. Every photo, video and file has a key of its own, sent inside the encrypted message, and calls get theirs the same way. To make sure nobody is in the middle, compare your safety number with a contact: open the chat, tap their name, then Encryption. The details are in How UIMessage's encryption works.

Some information has to be readable by our servers for UIMessage to work: to sign you in, deliver messages to the right devices, apply your privacy settings and keep people safe. This is all of it.

• The content of your messages, calls, photos, videos, files, statuses and shared locations, which are end-to-end encrypted.
• The names in your address book, or the numbers in it that aren’t on UIMessage.
• Your precise location. Locations you share travel end-to-end encrypted. The app uses your location only when you choose to share it, and in the background only while you share your live location, for the time you picked.
• What you search for in the app: searches run on your device. Link previews are made by the sender’s device and travel inside the encrypted message, so neither we nor the people you send them to contact the linked site.
• Advertising identifiers, analytics or crash reports: the apps contain none of them.
• Your email address, unless you write to us.

Only to run UIMessage: to create your account and sign you in, deliver messages, calls and notifications to the right devices, show your profile to the people your settings allow, keep your devices in step, prevent spam, fraud and abuse, keep the service secure, answer you when you contact us, and meet our legal obligations.

Our safety systems never look at what you say. They count how accounts are used, such as a burst of new accounts from one network, an account messaging many people it has never talked to, or many people blocking the same account, and some may limit an account for a while on their own. Every automatic action is recorded, and you can ask us to review it. The Community Guidelines explain how.

We don’t use your information for advertising or profiling, or to train AI models, and we don’t sell or rent it to anyone.

We run UIMessage’s servers ourselves. These companies handle some information so we can deliver what you ask for:

World’s map, on iPhone, iPad and Mac, is drawn from OpenStreetMap and Overture Maps Foundation data that our own server fetches and serves: your device asks only us for it, and nothing about you goes to either.

We don’t share information with anyone else, except when the law requires it. We answer only valid legal requests, and only with information we hold, which never includes the content of messages or calls: we can’t read it.

UIMessage Web runs in your browser, linked to your phone. It keeps its keys and your chat history in the browser’s own storage, sealed with a key the browser can’t export, and deletes all of it when you sign out. It sets no cookies; it remembers your appearance setting in the browser.

This website sets no cookies and runs no analytics, ads or scripts from anyone else. It remembers in your browser only that you’ve seen its opening animation and closed its privacy note. Like any web server, ours log each request (the network address, the time, the page asked for and the browser’s user agent) for security and to fix problems, for UIMessage Web too, and delete the logs after 14 days.

Delete your account on your phone, in Profile → Account → Delete account. The Mac app, UIMessage Web and linked iPads can't delete the account. If you no longer have the app, ask us.

Deleting your account signs out every device and deletes, at once: your number and profile; your two-step verification PIN; your contact list; your place in your groups; messages still waiting for you or from you; your statuses; your photos and files on our servers; and your encryption keys and Spark codes. The app deletes the chat history on your phone, and your linked devices delete theirs as they sign out.

What stays: messages you sent stay on the devices of the people you sent them to. We keep an empty record of the account, with no number, name or photo, so your chats show others that the account was deleted, and with it the account’s privacy settings and blocks, its decisions and review requests; the device and sign-in session records described above; and the sign-in attempts, report and safety records until their time runs out. An account can’t be deleted while it’s under review. If you delete an account that’s restricted or banned, we keep a keyed fingerprint of its number until the restriction ends, so signing up again doesn’t lift it.

• Choose who sees your profile photo, about, last seen and online status, and who can add you to groups, in Profile → Privacy.
• Block or report anyone from their chat.
• See your devices, and sign any of them out, in Profile → Devices.
• Turn on two-step verification in Profile → Account, so nobody can sign in with your number without your PIN.
• Allow or stop access to your contacts, camera, microphone, photos, location and notifications in your device’s settings at any time. Without access to your contacts, you can still start a chat by number.
• Delete messages, chats or your whole account.

You can also ask us for a copy of the information we hold about your account, or ask us to correct or delete it, by writing to hello@uimessage.com with the number. We check that a request comes from the number's owner before we act on it, and answer within 30 days. Where you live may give you these rights by law, for example in the European Union, the United Kingdom and California, and you can complain to your data protection authority. We don't sell or share personal information as California law uses those words.

We use information to provide the service you signed up for (our contract with you); to keep UIMessage and the people who use it safe and to prevent abuse, which is in our and their legitimate interests; with your permission, which you can withdraw in your device’s settings, for your contacts, location, camera, microphone and photos; and when the law requires it.

UIMessage is for people aged 13 or older, or older where the law of your country says so. We don't knowingly collect information from children under 13. If you think a child under 13 has an account, tell us at hello@uimessage.com.

Besides end-to-end encryption, every connection to our servers is encrypted in transit, and the information above is kept on our own servers, out of public reach. Our team works with it only through private tools: the admin dashboard needs a passkey, shows each person only what their role needs, and records every action in a log that can’t be changed. On your devices you can lock chats and set a two-step verification PIN. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

Our servers are in Canada. Apple, Google and Twilio may process the information they handle in the United States and other countries, under their own privacy commitments.

We’ll update this policy when UIMessage changes. The date at the top shows the current version; when a change matters, we’ll also tell you in the app.