Privacy Policy

Effective 2026-07-30 · Operated by the operator of this IMess deployment

What IMess stores, what it does not, and who can see it. Every statement below describes how this specific server is configured — not a policy aspiration.

1. Who is responsible

the operator of this IMess deployment operates this deployment and decides how the data on it is handled. The authors of the software do not run this server and receives nothing from it.

2. What the server holds

Account details

Your email address, display name, handle, and profile picture if you set one. Email is required because it is how account activation and password reset work.

Credentials

A hash of your password — never the password itself — and the session cookies that keep you signed in.

Devices

One entry per device you sign in from: a device identifier, a label, and the public keys that device uses. You can see and remove these yourself in the application.

Conversation structure

Which conversations exist, who is in them, and when messages were sent. This metadata is not encrypted from the server — it has to route messages.

Message content

Stored and relayed end-to-end encrypted. The server holds ciphertext it cannot decrypt, and neither the operator nor anyone with access to the server can read your messages.

Files and images

Encrypted before upload and stored as opaque blobs on this server's own asset storage. Same position as message content.

Server logs

The web front end records request lines, including IP addresses and timestamps, for operating and debugging the service. No retention period has been set, which means these logs are kept until the operator deletes them. If that matters to you, ask.

3. What the server does not do

• No analytics or tracking. No third-party analytics service is configured, no usage telemetry is sent anywhere, and the pages you are reading load nothing from another domain.
• No advertising. Your data is not sold, rented or shared for marketing, and there is no advertising on this service.
• No federation. This server does not exchange data with other backends. Your account and conversations exist only here.
• No push notification provider. No credentials for Apple or Google push services are configured, so no notification data is handed to either. Clients receive messages over their own connection to this server while running.

4. Why the server holds it

Everything in section 2 is held for one reason: to run the service you asked for. Account details identify you to the people you talk to; credentials sign you in; device records let your other devices encrypt to the right keys; conversation structure routes messages; logs keep the service working and let abuse be investigated.

None of it is used for any other purpose.

5. Who else sees it

The people you message see what you send them, on their own devices, outside this server's control.

Beyond that, data is disclosed only where the operator is legally compelled to do so — and in that case, what can be disclosed is limited by what the server actually holds. Message content is not among it.

6. How long it is kept

Messages are kept until you or another participant deletes them. Account data is kept until you delete your account, at which point it is removed from this server.

Messages already delivered to other participants stay on their devices after you delete your account. That is inherent to end-to-end encrypted messaging: the operator has no way to reach into someone else's device.

7. What you can do

• See and change your details — in the application, under account settings.
• See and remove your devices — under device settings. Removing a device revokes its access immediately.
• Delete your account — from account settings. This removes it from this server.
• Ask what is held about you — email support@imess.click.

Note: inbound email to this domain is not currently monitored. To make a request that needs an answer, use whatever channel the operator gave you when your account was created.

8. Security

Traffic between your client and this server is protected by TLS. Message content is additionally end-to-end encrypted, so it is not readable on the server even by someone who has access to it.

No system is perfectly secure. This is a small, privately operated deployment rather than a commercially audited service, and you should judge what you send accordingly.

9. Changes

This policy may change. The current version is always the one published at https://imess.click/doc/privacy, and the effective date above changes with it.