Version of 2026-10-19.
This policy explains what personal data the Comessenger service (the iPhone app and the web version) processes, why, on what legal basis, for how long, who receives it and how you can control it. In short: neither we nor anyone else can read the content of your messages; the server keeps only what the service cannot work without.
The data controller is Colibry LLC, address: 20 W 64th St, New York, NY 10023, USA. For any question about your data, including exercising the rights in section 9, write to support@colibry.co.
Message text, photos, videos, voice messages, files and their captions are encrypted on your device with keys we do not have (end-to-end encryption, a Signal-based protocol). The server receives only ciphertext and keeps it only until delivery.
The same encryption protects a place or a contact you share in a chat: it goes only to the people in that chat, and the server sees neither coordinates nor phone numbers. A place is a single point you sent yourself; location is requested only while the app is open, and the app cannot track you in the background. The map for a place is drawn by your iPhone, which downloads map tiles of that area from Apple.
Voice-to-text (on your request) runs on the iPhone itself, using the speech recognition built into iOS, offline. Neither the audio nor the text is sent anywhere; the text stays on the phone.
Chats on the phone are kept in an encrypted database. The chat backup on the server is encrypted on the phone with a key derived from your password: without the password nobody can read it, including us.
| Data | Why | Retention |
|---|---|---|
| Phone number — only a keyed hash and the last 4 digits | sign-in, finding a person by number | while the account exists |
| Name, "about", profile photo (the photo is encrypted) | your contacts see them | while the account exists |
| Password — only a hash (argon2id) | sign-in | while the account exists |
| Devices: public encryption keys, name, last activity time, push and incoming-call tokens, a hash of the Telegram notification address | delivering messages, notifications and calls | while the device is linked |
| Chats and their members, message times | delivery | while the chat exists |
| Encrypted messages | delivery while the recipient's device is offline | until delivered, at most 30 days |
| Encrypted files (photos, videos, voice messages, documents) | delivery | until delivered, at most 3 days |
| Encrypted chat backup | restoring on a new device | until you delete it or delete the account |
| People you blocked | blocking | until you unblock them |
| Privacy settings (who sees "online", photo, "about") | applying your settings | while the account exists |
| Calls: chat, caller, audio or video, time, duration, outcome (the conversation itself is not recorded) | call history | 90 days |
| Invite links: code, whose link, validity | inviting people you know | link validity (30 days) plus 30 days |
| Phone verification codes: number hash, time, delivery method | sign-up, abuse prevention | 2 days |
| Reports — encrypted on the device with the support team's key, with the latest messages of the chat as the reporter sees them | handling reports, user safety | up to 90 days after the decision, including after account deletion |
| Acceptance of the Terms and its version | proof of agreement to the Terms | while the account exists |
The server keeps no request log with IP addresses: an IP address is used only in memory, to rate limit requests. Server database backups are encrypted before upload and deleted after 30 days, so deleted data disappears from them completely within that period.
Only if you allow access to contacts: the app shows which of your contacts already use Comessenger. For that it sends not the numbers themselves but their hashes (SHA-256 with a salt common to all users), and only numbers not checked before. The server compares them with the hashes of users' numbers, answers who was found, and does not store your address book. Names from the address book are not sent anywhere. A hash hides numbers from intermediaries, but a number can be guessed from its hash, so matching is limited (at most 20,000 numbers a day per account) and hashes are never logged. Without contacts access the app works: you can find people by number.
Connecting Telegram is optional. If you connect it, the app works with Telegram directly from your phone through Telegram's official library (TDLib). The Telegram session, chats and contacts stay only on the phone; messages travel directly between the phone and Telegram, and our server does not receive them. These messages are encrypted and processed by Telegram under its own privacy policy, not by us.
Only notifications about new Telegram messages pass through our server, so that they arrive when the app is closed. Telegram sends them to our server encrypted with a key that exists only on your phone; the server cannot read them and hands them to Apple for delivery to the phone. The server keeps only a hash of the notification address (while Telegram is connected) and stores neither the notifications nor when they arrived.
We do not show ads. In public Telegram channels Telegram itself shows sponsored messages, as its terms for apps require. The app shares nothing with Telegram beyond what chats need and collects no data for advertising.
We make no decisions about you by automated means alone and do no profiling.
We do not sell data, do not share it for advertising and do not track you. Data goes only to those the service cannot work without, and only as much as needed:
The main server and its data are in the Netherlands, the read-only database replica is in the USA, the call server is in the Netherlands, the backup relay servers are in Germany and Russia (no data is stored on them), Cloudflare operates worldwide. By using the service you agree that your data is processed in these countries. We protect it with end-to-end encryption of content, encrypted connections and backups, and by keeping as little as possible.
You can:
To do so, write to support@colibry.co and give the phone number linked to your account — we will answer within 10 business days.
End-to-end encryption of content; encrypted connections (TLS); the password and phone number are stored only as hashes; backups are encrypted before upload; only the operator has server access, by keys. A passcode and Face ID lock protect chats on the phone itself.
The web version keeps encryption keys and chats in your browser's storage on that computer. No advertising or analytics cookies are used.
The service is not intended for children under 13. If you learn that a child under 13 has signed up, write to us and we will delete the account.
If this policy changes, the new version with a new date will appear on this page; for significant changes the app will ask you to review the new version.