Your conversations are yours. Not ours.

Who we are

OUT Messenger makes the OUT Messenger app for iPhone and runs this website. In this policy, “OUT”, “we” and “us” mean OUT Messenger. For anything about your data, write to info@outmessenger.com.

What we never collect

• Your phone number
• Your address book or contacts
• The readable text, photos or voice of your messages
• Your location
• Advertising identifiers or tracking data
• Cookies or analytics on this website

Message content

Message and live-captured media content is encrypted on the sender’s device and is intended to be readable only by the participating devices. The relay stores ciphertext envelopes only until delivery or expiry, never longer than seven days.

Identity and routing

The service processes a cryptographic OUT ID, public key material, one-time prekeys, short-lived authentication sessions, invitation tokens and an optional public @username. It does not require a telephone number or upload the iPhone address book.

To deliver a message without naming its sender, the sender’s iPhone obtains a delivery route to the recipient. A route record holds the recipient’s OUT ID, a keyed digest of the sender’s OUT ID and an expiry of at most eight days, and is removed after it expires. When a message is collected before its expiry, a record of its identifier, route and expiry (no content) is kept until that expiry, so the sender cannot tell collected from waiting. When someone starts a conversation, one of the recipient’s published one-time keys is marked as used, with the day only, and removed after 31 days. Counters that limit notifications and stop strangers from filling a queue are kept in the server’s memory only and are lost when it restarts.

Restoring an OUT ID

Recovery is optional. If you turn it on, your iPhone creates a passkey for our service, kept by iCloud Keychain or your passkey manager and unlocked with Face ID, Touch ID or your passcode; if you prefer, or your iPhone cannot make a passkey, OUT gives you a recovery code instead, which you keep yourself and which our service never receives. From the passkey or the code your iPhone derives a key that seals a copy of your contacts, blocks and @username before it leaves the iPhone. The service stores the sealed copy, a recovery public key and your device key’s signature over it; it cannot open the copy, use the passkey or learn the code. When you restore on another iPhone, your @username and the sealed copy move to the new OUT ID, the old account is deleted, and a record of the move (the two OUT IDs, public keys and signatures, no content) is kept for 180 days so that your contacts can confirm it is you. Turning recovery off or deleting your account deletes the sealed copy.

Voice calls

A call can ring only on the iPhone of someone who has the caller in their contacts. Setting up a call travels end-to-end encrypted, like messages, and the audio is encrypted end to end between the two iPhones, with new keys for every call. Every call is relayed through a TURN server run by Cloudflare, so neither person learns the other’s IP address; Cloudflare processes both iPhones’ IP addresses to pass on the encrypted audio and cannot hear it. Our service hands out TURN credentials that expire on their own and keeps no record of who asked for them or for whom, beyond short-lived rate limits and a monthly total. To ring a locked iPhone, the service keeps that iPhone’s VoIP push token, sealed like its notification token, and sends Apple a push that carries only random call identifiers and a tag the recipient’s own iPhone issued, never a name or an OUT ID; the small mailbox that lets a locked iPhone connect the call exists only in the server’s memory, for that call. OUT keeps no call history: there is no call log in the app, calls do not appear in the iPhone’s Recents, and the service stores no record of who called whom.

Meteor names

A Meteor is an optional temporary name, such as @silver-orbit-47, that you can hand to people you do not know instead of your own @username. Each Meteor is an account of its own, with its own OUT ID, keys and mailbox, so whoever writes to it sees only the Meteor, never your @username, OUT ID or profile.

The service keeps the link between a Meteor and its owner only as a keyed digest and an encrypted copy of the owner’s OUT ID, under a key that is never stored in the database. It uses the link to let only the owner sign in as the Meteor, see it and burn it, to notify the owner’s iPhone, to end the Meteor with its owner’s account and to act on abuse reports: a report against a Meteor keeps its own encrypted copy of the owner’s OUT ID for the 30 days the report is kept, even after the Meteor burns. While both are in use, the service necessarily sees that they connect from the same iPhone, and their session records, renewed within minutes of each other and kept about an hour (their order longer, in database logs and backups), could suggest the pair.

A Meteor burns when its owner burns it; after 1, 7 or 30 days, if its owner gave it that lifetime (one given none lasts until it is burned or goes unused for 180 days); and when its owner’s account is deleted, suspended or expires, or is restored on another iPhone. Its account, mail and routes are then deleted; a keyed digest of its name is kept so that the name is never issued again, and blocks that others placed on it are kept like any block. A Meteor cannot place calls or send messages through Constellation.

Constellation

Constellation is optional. When an iPhone has no connection, OUT can hand a waiting text message to nearby OUT members who have agreed to carry messages and have OUT open (up to four at a time), and their iPhones pass it to our service once they are online. Only while OUT is open, a member who carries makes its iPhone visible to nearby iPhones through Apple’s peer-to-peer networking (Wi-Fi and Bluetooth), as an OUT iPhone that carries messages, under a random name that changes every time OUT starts, telling only whether it is online and a protocol version; an iPhone looking for a path only searches, after Find a path is tapped. iOS asks for Local Network permission first.

A carried message stays end-to-end encrypted for its recipient and is sealed a second time to our service’s own key, so the carrying iPhone cannot see who sent it, to whom, or what it says; it holds at most 50 such messages, in memory only, and never passes one on after 24 hours. The service opens the outer seal, checks the sender’s signature and delivers the message as if the sender had sent it; the sender’s iPhone still sends the message itself once it is back online, and the recipient receives it once.

Of a carried message the service keeps only the carrier’s counts of messages and bytes for the day, the month and in total, and of thanks received, for as long as the carrier’s account exists; for up to eight days, a keyed digest of a random thank-you code beside the carrier’s account, so that the sender can thank the carrier without either being named; and for about a day, a keyed digest of the message linked to no account, so that a copy carried twice is delivered once. These are written later, in shuffled batches mixed with other carriers’ when there are any, and no stored record names the carrier beside a carried message, its sender or its recipient; on a quiet service, though, when such a batch was written could narrow down which messages one carrier carried, for someone holding the database’s logs or backups.

The message itself is kept like any other (see Message content). While it runs, the service sees which account carried which message. You can stop carrying messages at any time in Settings.

Integrity and notifications

Apple App Attest material is processed to distinguish authentic app instances from automated abuse. When you choose a new @username, the app sends a DeviceCheck token that only Apple can read; our service passes it to Apple to read and update two bits Apple keeps for this iPhone (how many new usernames were chosen from it this calendar month), and does not store or log the token. When a new OUT ID is created, our service sends Apple the receipt Apple issued with that iPhone’s App Attest key and receives an approximate count of the App Attest keys made for OUT on that iPhone in the last 30 days; the count is compared once with a limit, to decide whether to create the OUT ID, and is not stored or logged; only how many checks were made, and how many were over the limit, is counted. If notifications are enabled, an encrypted APNs device token and a content-free wake-up signal are used. Notification payloads do not include message text or sender identity.

Operational protection

Source network information is transformed into keyed digests for short-lived rate limiting. A coarse daily activity date supports inactive account cleanup, and short-lived sending counters enforce fair-use limits. These records support service operation, not advertising. The application is designed not to write message plaintext to service logs.

Profiles and safety

If you choose a generated avatar, the service stores its signed style settings, not an uploaded photo. Blocking stores the two OUT IDs needed to prevent contact; if the blocked person deletes their account the block is kept, so that registering again does not lift it, and if you delete your own account your blocks are deleted with it. An abuse report stores a selected category, keyed digests of the reporter’s and the reported OUT IDs, and its review state, for up to 30 days; it contains no message text or attachments. The reporter’s digest lets moderators tell one person’s repeated reports from reports by several people. The keys behind these digests are held by the service, so the service can match a digest to an OUT ID it already knows; they are not anonymous to the service. A message you receive, and your own copy of a text, photo or voice message you send, is kept by the service as a copy sealed on your iPhone with a key only that iPhone holds, until the message disappears (once it is read, after ten minutes, unless its conversation uses another time; a file as soon as it is opened), is deleted, or its unread day ends; the service cannot open it. If you contact support by email, your email address and the information you choose to send are available to support. Do not include private messages or recovery codes in a support request.

Retention and deletion

Undelivered encrypted envelopes expire automatically. An inactive account is deleted after the period its holder chooses in Settings: 1, 3 or 6 months, or 1 year; 6 months unless they change it. An account suspended for abuse is kept, without activity, so that the suspension does not end by itself; it holds no messages. When a public @username is let go (its account deleted, expired or the name freed), a SHA-256 digest of the name and of the OUT ID that held it is kept for 30 days, so that nobody else can take the name in that time; the same OUT ID can take it back. You can permanently delete the server account and the device identity from Settings; related server records are removed, except blocks against that account and abuse reports described above, subject to infrastructure backup and recovery retention.

Photos and voice

Sending photos, voice messages and PDF files is free for everyone. OUT has no in-app purchases or subscriptions, and no payment information of any kind is processed. Photos, voice messages and files travel end-to-end encrypted like text, and daily sending counters, which limit how much one account can send, expire at the next UTC day.

Where data is processed

Our service runs on Microsoft Azure in the European Union (North Europe region). Push notifications are delivered through Apple Push Notification service, and Apple’s DeviceCheck and App Attest services answer the integrity checks described above. Voice calls are relayed through Cloudflare’s TURN service, on Cloudflare’s global network, which may be outside the European Union. We do not sell or share personal data for advertising.

Legal basis

We process the limited data described here to provide the service you asked for (performance of a contract) and to keep it secure and free of abuse (our legitimate interests).

Your rights

Depending on where you live, including under the EU General Data Protection Regulation, you can ask to access, correct, delete or export your data, and object to or restrict its processing. You can delete your OUT account at any time in Settings. To exercise any right, email info@outmessenger.com. You also have the right to complain to your local data protection authority.

Age limit

OUT is for people aged 18 and over. We do not knowingly provide the service to anyone younger.

Limits

Memory-based handling limits the history OUT creates; it cannot guarantee that iOS or a recipient never makes a copy. Recipients can still capture or record what they see. OUT is under active security review, and its privacy and security properties must not be treated as a guarantee against every device compromise or forensic technique.

Changes and contact

We will publish material changes on this page and update the date above. Questions and requests: info@outmessenger.com.