Privacy Policy

What stays on your device

Your messages, photos, videos, files, voice messages, contacts, display names, profile pictures and shared locations are kept in an encrypted database on your phone. They leave the device only end-to-end encrypted (Signal protocol with post-quantum key agreement), addressed to the people you chat with. We cannot read them. Your name and profile picture are sent the same way, only to your contacts.

What the server stores

• Account: a random account ID, public encryption keys, a hash of the access key your app uses to sign in, and the date you were last online. No name, phone number or e-mail.
• Push token: the Firebase Cloud Messaging (Android) or Apple Push Notification service (iPhone, Mac) token of your device, to wake the app when a message or call arrives.
• Undelivered messages: encrypted envelopes with the sender and recipient account IDs and the time sent. They are deleted as soon as the recipient's device confirms delivery, and after 7 days at most.
• App version: with each connection the app sends its platform (Android, iPhone or Mac), its version and the major version of the operating system. The server keeps only daily counts of devices per version, not linked to any account, for 90 days; we use them to see how many devices have updated.
• Files: encrypted pieces of attachments that the server cannot decrypt. They are deleted after 7 days.
• Upload counter: how many bytes your account uploaded today, to enforce a daily limit. Kept for 2 days.
• Blocked accounts: the account IDs you blocked, with the time, so that the server drops what they send to any of your devices. Removed when you unblock them or delete your account.

Reports

When you report someone, the server stores the reported account ID, your account ID, the category you chose, your comment, the time and, if you report from a group, the group's ID and name. Only if you tick "attach the last messages", your device also sends up to 5 of that person's last messages in the chat, decrypted: the text, the time and, for files, only their type, name and size (never the files themselves). Reports are kept for 90 days and read only by the server's operator to act on breaches of the Terms of Use. If the reported account is on another Mailbees server, that server is told only the category, with a code that lets it tell reporters apart but not identify you; your account ID, comment and messages are not passed on.

IP addresses and logs

The server uses your IP address in memory to limit the rate of requests; it is not written to the database. When a call cannot connect directly, it is relayed by our TURN server, which records the IP addresses of the call's participants in technical logs. These logs are kept only briefly for troubleshooting and are overwritten automatically. Call audio and video are encrypted end to end and are never recorded.

Usage statistics

If the server's operator turns this on, the app counts a fixed list of events: which screens were opened, steps such as signing up, accepting an invite or sending a voice message, how many messages were sent, edited or reacted to, how fast the app started (in ranges such as "under 1 second") and how many errors and crashes there were. Only these numbers are counted: no text, contacts, chat or message IDs, and not when or in what order things happened. Once a day the app sends the totals to your server; the server does not store them with your account and adds them to daily sums for each platform and app version, kept for 90 days. Only the operator of your server sees these sums, and groups of fewer than 5 devices are hidden; nothing is sent to us or to other servers. To stop it, turn off Settings → Privacy → Send usage statistics: the counts collected so far are erased at once.

Services of other companies

Push notifications go through Google Firebase Cloud Messaging on Android and Apple Push Notification service on iPhone and Mac. Google or Apple receives your device's push token and an empty signal ("new message" or "incoming call"), never the content or who wrote to you. See Google's Privacy Policy and Apple's Privacy Policy. Our servers are rented from hosting providers and hold only the data listed above. There are no ads, third-party analytics or tracking SDKs in the app, and we do not sell or share data with anyone.

Permissions

• Camera: scanning invite QR codes and video calls.
• Microphone: voice messages and calls.
• Location: only while you share your location in a chat, for the time you choose; sent end-to-end encrypted to that chat only.
• Notifications: new messages and incoming calls. Notifications do not show message text.
• Photos and files: only the items you pick in the system picker; the app has no access to the rest of your storage. On iPhone the app asks to add to Photos only when you save a received photo or video.

Deleting your account

In the app, open Settings → Delete account. Your account, keys, push token and undelivered messages are deleted from the server at once, and all chats, messages and files are erased from your device. Encrypted file pieces that you sent expire within 7 days. Messages you already sent stay on the devices of the people who received them.

If you no longer have the device, the account is deleted automatically after 90 days without connecting. You can also ask us to delete it sooner: write to pentabion@gmail.com with your account ID (shown in Settings) if you have it.

Children

Mailbees is not directed to children under 13, and we do not knowingly hold data about them.

Contact and changes

Questions about privacy: pentabion@gmail.com. If this policy changes, the new version is published on this page with a new date.