We built the product so this page could be short

Overview

This policy describes how Midnight Messenger (the product) handles information when you use the app or this website. It is written to reflect exactly how the system is built, not a generic template. If a section describes a technical guarantee, that guarantee is enforced in code, not just in this document.

Midnight Messenger is built around a simple rule that shows up throughout this policy: if we do not need to see something to run the service, we build the system so that we cannot see it.

What we collect

The service stores only what is required to deliver encrypted messages and resolve usernames:

• Encrypted message envelopes. Our relay temporarily stores and forwards ciphertext so it can be delivered to your conversation partner. It cannot decrypt this content.
• A public identity commitment. A one-way cryptographic value generated on your device during registration and published to Midnight Network. It proves you registered without revealing the secret behind it.
• A hashed username, if you choose one. If you register a username, our directory stores only its cryptographic hash and the public key it resolves to, never the plaintext username you typed.
• Basic operational metadata. Things like connection timestamps and rate-limit counters, kept only as long as needed to keep the service reliable and abuse-free.

What we never see

Because of how the app is built, the following never reaches our servers in a readable form, ever:

• The plaintext content of any message you send or receive
• Your real name, phone number, email, or government ID
• Your wallet address or any wallet activity tied to your public identity
• The plaintext of any username you register or search for
• Your recovery phrase or the seed it is derived from

We do not run advertising, we do not sell data, and we do not build behavioral profiles. There is no plaintext data set to monetize even if we wanted to.

How encryption works

Every conversation uses MLS (Messaging Layer Security, RFC 9420), an open, widely reviewed protocol designed specifically for secure group messaging. Encryption and decryption happen entirely on your device. Our relay server only ever handles the resulting ciphertext, moving it between devices without the ability to read it.

We do not implement our own cryptographic primitives. Every cipher, hash, and proof system used in the app comes from established, independently maintained libraries.

How identity verification works

When you first open the app, your device generates a secure identity key. A cryptographic commitment derived from that key, not the key itself, is registered on Midnight Network through a zero-knowledge proof. This supports verification that a key is registered and that a peer controls it, without revealing the secret key. It does not verify a real-world identity or establish that each account belongs to a unique human.

Registration is sponsored, meaning the network fee is paid on your behalf. We never require you to hold or fund a cryptocurrency wallet to use the app.

Data retention

Encrypted message envelopes are held only when the person you are messaging is offline, and are deleted from the relay the moment their device collects them. Anything never collected is deleted automatically after 7 days. Username directory entries persist for as long as your username stays registered, and can be removed on request. On-chain identity commitments are public and permanent by nature of the ledger they are recorded on, but they reveal nothing about you beyond the fact that a registration occurred.

Third parties

Identity commitments are published to Midnight Network, a public, permissionless ledger. Anyone can see that a commitment exists; no one, including us, can derive your identity from it. We use a sponsor service to pay registration fees on your behalf, which processes a sealed transaction without ever learning who you are.

We do not share, sell, or otherwise provide message content, usernames, or identity information to advertisers, data brokers, or analytics platforms, because that data does not exist on our servers in a usable form to begin with.

Your rights and control

Your 24-word recovery phrase is the only way to restore your identity, and it is generated and stored on your device. We cannot see it, recover it, or reset it on your behalf. You can stop using the app at any time, and you can request removal of your username registration and any stored message envelopes associated with your account.

Changes to this policy

If this policy changes in a way that materially affects how your data is handled, we will update the date at the top of this page and provide notice inside the app ahead of the change taking effect.

Contact

Questions about this policy or how your data is handled can be sent to [email protected].