Effective 9 October 2026 · applies to the Z app, the relay service at zmessengers.com and the transparency log at kt.zmessengers.com
Z is built so that, wherever it can be, we cannot know things about you, rather than merely promising not to look — and where we can, this page says so. It describes exactly what data exists, where it lives, and what the operator of the relay and the transparency log, and Cloudflare in front of both, can and cannot see.
Your identity keys, contacts, messages and attachments are stored only on your device, in a vault encrypted with XChaCha20-Poly1305. The vault key lives in your operating system's keystore, optionally protected by an app passphrase or your device's biometrics. "Wipe everything" in Settings destroys all of it irreversibly. An encrypted backup is written only when you ask for one, and only where you choose to put it.
To move a message from you to a recipient, the relay momentarily handles: ciphertext (undecryptable to it), the opaque mailbox ID it is addressed to (a hash, not a key or a name), and the network connection carrying it. Envelopes are sealed, so the relay is not told which mailbox sent them, and padded to fixed size buckets. Queued ciphertext for offline recipients is held in RAM only, is deleted the moment the recipient confirms delivery, and expires after at most 72 hours. The relay writes nothing to disk — its code is tested to contain no disk-write calls. This service runs as two copies behind one address, which share queued mail through a store the host keeps in memory with saving switched off and no public address; the same ciphertext, the same operator, the same host, and nothing written down anywhere. Restarting that memory erases everything it held. Operational logs contain aggregate connection counts only, never message data.
To check that the devices your contacts' apps announce are the ones their accounts published, the app uses a public transparency log at kt.zmessengers.com. It is on by default. When your account's device list changes, the app publishes it there: your account's public key, the list's version and fingerprint, and the list itself, sealed under a key derived from your public key — which we receive with it, so we can read it. And the app checks your contacts there up to four times a day — at a random time, or, on a phone almost always, a few seconds after you open the app, because a phone is rarely running at the random time the check is due — from your IP address, asking for groups of 32 to 64 accounts at a time, padded with decoy groups it keeps, and never for a contact by name. So the log's operator, which is us, and its host see which groups your IP address asks about — your contacts' among decoys they cannot tell apart — and when you add a contact outside them, and, since on a phone the check almost always runs just after you open the app, roughly when you open it, up to four times a day — but not your contact list. Versions of the app before this one asked for each contact by name, which did show it. The log keeps what is published for good; that is what makes it a log. The log service does not record requests; the infrastructure in front of it keeps request logs under its own terms. You can point the app at another log, or at none, in Settings once Developer mode is on.
A handle is a name, like @alex.42, that people can look up to send you a contact request. The app never asks you for one: you can claim one in Settings, pause it, give it a new inbox or give it up, and nothing about handles is sent anywhere until you claim one or look one up. Handles need a handle service, which is not running yet; until it is, the app says handles are not available.
If you claim a handle, the app publishes a record of it to a public handle log: keys made for the handle — never your account's key — how much work a request to it must cost, and a commitment to its recovery code, under a label computed from the handle, with the hour it was published. The recovery code itself is shown to you once and stored nowhere, by us or by the app. Anyone can look a handle up. The log keeps every record for good, as a log must; giving a handle up publishes a last record that takes no requests. When you claim, change or look up a handle, the log's operator sees your IP address — and of a lookup, only a group of 32 to 64 handles, not which one. Requests to your handle go to an inbox at the relay made for the handle, not to your own mailbox: the relay sees how many arrive and when, and the IP address your device reads them from. A request you send to a handle carries your display name and public key to whoever holds it.
Push is on by default on Android, and used only if you allow Z notifications. Then the app registers an opaque Firebase Cloud Messaging token with the relay, so it can send a content-free wake signal ("you have mail") when a message arrives while the app is closed. Without that permission nothing is registered, and if you take it away later the app withdraws its registration the next time it starts or comes back to the front. The notification contains no message content and no sender. The token is held in relay RAM until 30 days after your app last connected, and is deleted when you turn push off in Settings — if you do that while your phone is offline, as soon as it is back. Delivery of the wake signal is performed by Google Firebase under Google's privacy terms; Google never receives message content. With push off, none of this exists.
Honesty requires stating this: like any server on the internet, a running relay can transiently observe connection metadata — the IP address of a connection and the timing of encrypted envelopes passing through RAM. Z does not record, store, or analyse this, and its RAM-only design means there is no historical record to hand over: a subpoena for stored data would yield nothing, because nothing is stored. Sealed sender and size padding are implemented, so an envelope in transit does not identify its sender and its length reveals little; what remains is that a mailbox is active — and the timing of delivery receipts. The app holds each receipt back for a random five seconds to a minute, so a single one no longer pairs a sender with a recipient; a pattern over many messages still can, and you can turn receipts off.
This service — the relay and the transparency log — is reached through Cloudflare, which terminates the encrypted connection (TLS) in front of it. Cloudflare therefore sees, beside your IP address, the same connection metadata the relay does: the mailbox ID your device connects as, the mailbox each envelope is addressed to and its padded size, your push token, and which groups of accounts your app asks the log about. It never sees message contents, which are end-to-end encrypted inside that connection. Running your own relay and log removes it from the path.
Z is not directed at children under 13, and we do not knowingly collect information from anyone — child or adult.
Material changes to this policy will be published at this address with an updated effective date. Questions: [email protected].