Effective 8 September 2026 · applies to the Z app and the relay service at zmessengers.com
Z is built so that we cannot know things about you, rather than merely promising not to look. This page describes exactly what data exists, where it lives, and what the relay operator can and cannot see.
Your identity keys, contacts, messages and attachments are stored only on your device, in a vault encrypted with XChaCha20-Poly1305. The vault key lives in your operating system's keystore, optionally protected by an app passphrase or your device's biometrics. "Wipe everything" in Settings destroys all of it irreversibly. An encrypted backup is written only when you ask for one, and only where you choose to put it.
To move a message from you to a recipient, the relay momentarily handles: ciphertext (undecryptable to it), the opaque mailbox ID it is addressed to (a hash, not a key or a name), and the network connection carrying it. Envelopes are sealed, so the relay does not learn which mailbox sent them, and padded to fixed size buckets. Queued ciphertext for offline recipients is held in RAM only, is deleted the moment the recipient confirms delivery, and expires after at most 72 hours. The relay writes nothing to disk — its code is tested to contain no disk-write calls. This service runs as two copies behind one address, which share queued mail through a store the host keeps in memory with saving switched off and no public address; the same ciphertext, the same operator, the same host, and nothing written down anywhere. Restarting that memory erases everything it held. Operational logs contain aggregate connection counts only, never message data.
If you enable push, the app registers an opaque Firebase Cloud Messaging token with the relay so it can send a content-free wake signal ("you have mail") when a message arrives while the app is closed. The notification contains no message content and no sender. The token is held in relay RAM with a 30-day expiry and is deleted when you disable push. Delivery of the wake signal is performed by Google Firebase under Google's privacy terms; Google never receives message content. With push off, none of this exists.
Honesty requires stating this: like any server on the internet, a running relay can transiently observe connection metadata — the IP address of a connection and the timing of encrypted envelopes passing through RAM. Z does not record, store, or analyse this, and its RAM-only design means there is no historical record to hand over: a subpoena for stored data would yield nothing, because nothing is stored. Sealed sender and size padding are implemented, so an envelope in transit does not identify its sender and its length reveals little; what remains is that a mailbox is active.
Z is not directed at children under 13, and we do not knowingly collect information from anyone — child or adult.
Material changes to this policy will be published at this address with an updated effective date. Questions: [email protected].