Legal
Privacy Policy.
This policy is for everyone who uses Murmur, visits this website or writes to us. It says what we can see, what we keep, why, for how long, and what you can do about it.
Skip to the policy
Contents22 sections
In short
#- We can’t read your messages, photos or files. They’re end-to-end encrypted on your devices, so only the people in the chat can open them.
- Our servers don’t know who sends a message, who you talk to, or who is in your groups.
- We never ask for your phone number, your email or your real name, and we don’t keep IP addresses.
- What our servers keep to run Murmur is short, and every item is listed below with how long we keep it. A valid legal order can force us to hand it over, so we keep as little as we can.
- No ads, no selling or sharing your data, and no trackers or analytics, in the apps or on this website.
- You can see, export, correct and delete your data, most of it right in the app. Questions: privacy@murmur.free.
Who we are
#Murmur Labs LLC makes the Murmur apps for iPhone, Android, Windows and Mac, and runs the servers they use. It is responsible for your personal information.
- In this policy, “Murmur”, “we” and “us” mean Murmur Labs LLC, 30 N Gould St, STE R, Sheridan, WY 82801, United States (murmurlabs.llc).
- This policy covers the apps, our servers, this website and the emails you send us.
- Apple and Google run their own app stores and notification services, under their own privacy policies. We explain below what they see.
The person in charge of privacy
#Murmur has a person in charge of protecting personal information. They make sure we follow this policy and the law, approve our privacy rules, and answer your requests and complaints.
Write to them at privacy@murmur.free.
Where the law asks a company like ours to have a local representative, that representative can also take your questions. Write to the same address and we’ll put you in touch.
What we never see
#What you say, and who you say it to, is sealed on your devices. Our servers pass it along without a key to open it.
Sealed, so we can’t read it
- Your messages (scheduled ones included), voice messages, photos and files, their names and types, reactions, edits, read receipts, poll votes and todo lists.
- Your profile, with your name, photo and bio.
- Your contacts, the people you block, and your other settings (the few our servers apply are listed below).
- Vault, with the notes, photos and files you keep for yourself.
- Your “online” and “last seen” status, which your devices send sealed, only to the people you let see it.
- Group names, pictures, descriptions, pins and topics.
- Who sends each message. The sender’s name travels only inside the sealed envelope.
- Who you talk to, who is in your groups, their roles, and who added or removed whom.
Never kept
- Your phone number, your email (unless you write to us), your real name or your date of birth. We never ask for them.
- Your location, your device’s model or your address book. Murmur never uploads your contacts.
- Your IP address or any log of your connections. Your IP address only carries your connection.
- A log of who sent what, or of who talks to whom.
- Who invited whom to join Murmur.
- The result of the device check at sign-up.
- Your payment identity.
- Your password, your Recovery Key, and any key we could use to open your messages.
We hold no message content and no keys. We hold the few details listed in this policy and in our public data table, and they can be compelled. “Compelled” means a valid legal order, from a court for example, can force us to hand them over.
The data we handle
#To run your account and deliver your messages, our servers handle a few things. Here is each one, with what it is, why we need it, where it lives and how long we keep it.
This is the same list as our public data table, in plain words. That table is checked against our code at every release, and a field our servers store that isn’t listed there fails the build. “Our servers” means the servers we run for Murmur, at our hosting provider.
Your account
#| What | Why | Where | How long |
|---|---|---|---|
| Your account IDA random number that never changes | To deliver to your devices and keep your account together | Our servers, your devices and your contacts’ devices | Until you delete your account |
| Your usernameThe name you chose and the two digits Murmur added, like alibaba.46. It can’t be changed. Kept only in a scrambled form that only our server can check, with a second one that spots look-alike names | So you can sign in, and so people can find you, unless you turn that off | Our servers. It appears in clear only for a moment, at sign-in and when someone looks it up | Until you delete your account, then 90 days of quarantine, unlinked from you |
| Your sign-in record | To check it’s you without ever seeing your password | Our servers. It doesn’t reveal your password | Until you delete your account |
| Your Recovery Key dataYour identity key and your account-state key, sealed so only your Recovery Key can open them, and the public half of a sign-in key made from it | So your Recovery Key works if you lose your devices | Our servers, sealed. Nothing made from your key reaches us until you save it | Until you delete your account. We also keep its 2 previous versions, and any change alerts all your devices |
| Choices our servers applyWhether people can find you by username, who can send you a request, Lockdown Mode, whether a password-only fresh start is allowed, whether password sign-in is on, whether you saved a Recovery Key, and when to delete your account if you’re away | To do what you chose | Our servers | Until you change them or delete your account |
| The day your account was created | To warn people when an account made less than a week ago writes to them | Our servers | With your account. It becomes only the month after 12 months |
| Trust level and limitsYour trust level and any restrictions, failed sign-in counters, daily counters (new chats started, username lookups, group joins, uploads and invites) and the number of upheld reports against the account | To slow down spam, fake accounts and password guessing | Our servers | Counters: 30 days at most. Upheld reports: 180 days. Trust level and restrictions: with your account |
| Terms and ageThe version of the terms you accepted, and with it that you’re 16 or older. Never your date of birth | To show you accepted the terms and are old enough | Our servers | With your account |
| Pending timersLike a new device’s first 72 hours, the first 7 days of an account that signed up with a puzzle, or a pending reset | To make waiting periods work | Our servers | Until the timer ends. A reset: until 30 days after it ends or is cancelled |
| A block counterA single number that changes when you block someone or limit who can add you | So invitations issued before stop working | Our servers. It’s never a list of who you blocked | With your account |
To have an account, you need a username, a password and your device keys, and you accept the terms and declare you’re 16 or older. Everything marked “only if you turn it on” or “only when you choose” is optional.
The scrambled form of your username lets us answer a lookup without keeping the name in clear. But since we hold the key that makes it, we could check whether a given username exists, or test a list of names.
Your devices
#| What | Why | Where | How long |
|---|---|---|---|
| Your identity key and device listYour identity key, your devices’ certificates and their list, with the earlier signed versions of that list and of your identity key, kept so key changes can be checked. So we know how many devices you have and their platform type (iPhone, Android, Windows or Mac), but never their model | To check that each device is really yours, and deliver to each one | Our servers | Until you delete your account |
| Each devicePublic keys that let people start a chat with you, whether its sign-in key is kept in secure hardware, a random notification ID, the day it was added, its last active day, when its first 72 hours end, and the app version it last connected with (so a scheduled message never reaches an app too old to open it) | To deliver messages, protect you from a device added by someone else, and remove devices and accounts that are no longer used | Our servers | Until the device is removed. Its last active day is replaced each time. A device that stays offline for 90 days is removed, after a notice at day 75. Your last device never is |
| Devices that leftFor each device removed, including by a fresh start or by deleting your account, its device ID, your username, why it left and the day. Never what it held | So someone still writing to that device learns it’s gone, instead of losing their message | Our servers | 180 days at most, even after your account is deleted |
| Sign-in and linking sessionsA sign-in in progress, a puzzle your device is solving, and the sealed box that hands your keys, and the way to your history, to a new device you link | To sign you in and link your devices | Our servers, in memory. The box is sealed for your new device | A sign-in: 1 minute. A puzzle: 5 minutes. A linking box: 10 minutes |
Messages, files and groups
#| What | Why | Where | How long |
|---|---|---|---|
| Sealed messagesFor a mailbox our servers can’t link to you, the time each one arrives, a rounded size, the version of the chat’s keys (it goes up when someone joins, leaves or renews their keys), whether to wake a device, and whether it’s a direct chat or a group | To deliver them | Our servers, encrypted | Until each device has fetched it, 30 days at most. In large groups (over 256 devices), a message stays until its 30 days are up, even after delivery. An encrypted copy can sit in our server backups for up to 14 days |
| Scheduled messagesA message you schedule, sealed on your device for each device that will get it, with when it goes out, those devices, a rounded size, whether it wakes a phone, and a scrambled form of the right to cancel it. Never who scheduled it, or what it says | So it goes out at its time, even if your phone is off | Our servers, encrypted | Until its time, a year at most, or a week with a photo, a file or a voice message. Then it’s delivered like any message. A record that it went out or was cancelled stays 30 days more, without the message |
| Sealed photos, files and voice messagesA rounded size, the upload time, and whether a file is pinned. A voice message is padded to the next of a few set sizes, so every one up to about 15 seconds weighs the same, and a longer one shows only a rough length. No sender is tied to a file. No chat either, except that a pinned file is tied to its group (never to the group’s members), to count the group’s quota | To deliver them, and keep pinned files | Our servers, encrypted | 30 days. Pinned files stay while they’re pinned, within the group’s quota |
| History for new devices and membersEncrypted history you send to your new device, or recent history a group shows its new members, if the group turned that on | To move history | Our servers, encrypted | 24 hours at most |
| Encrypted recordsYour profile, your account state (contacts, blocks and settings) and the state of your groups. We see only their sizes and when they change | To keep your devices and your groups in sync | Our servers, encrypted | As long as they exist |
| Group changesFor a group mailbox our servers can’t link to its members, each change to the group, sealed for its members, with its order number; how many changes the group made today; and whether it has more than 256 devices | To keep every member’s copy of the group in step, and stop floods of changes | Our servers, encrypted | Changes: 30 days. Today’s count: 1 day. Whether it has more than 256 devices: while the group exists |
| Contact links, invites and passesAn encrypted card for your contact link, the use of invite links, and for a community pass a group’s admins create, its limits, expiry and number of uses (never who used it) | To make links and passes work | Our servers | As long as the link or pass exists. You can reset your contact link at any time |
| Message requestsWhether a request has been answered, and how many messages it holds (3 at most). Never who sent it | So a stranger can send only 3 messages until you reply | Our servers | Until you answer. A request with no answer disappears after 30 days |
| PresenceWhether your device has an open connection | To deliver messages right away | Our servers, in memory | About 90 seconds. Your “online” and “last seen” travel sealed between devices, and we keep none of it |
| Your daily “last seen” signOnce a day, your device sends a sealed sign that carries only the day, never a time. It lets your contacts see “last seen recently” when they can’t see your time. None in Lockdown Mode | To deliver it at a random time, so it never shows when you used Murmur | Our servers, encrypted | A random 1 to 12 hours, then it’s delivered like any message |
| Lookups and first contactsA username someone looks up, and the keys a new contact fetches to start a chat with you | To find someone who is findable, and start a chat | Our servers, for a moment | Not kept. Only counters that limit them |
| The username you’re choosingThe number shown to you while you sign up, kept with a scrambled form of the name you typed. Never with your IP address | So your account gets the number you saw | Our servers, in memory only | 10 minutes after you last see it, 30 minutes at most, then forgotten within a minute |
Your encrypted text backup, only if you turn it on
#- What
- A copy of your text history, meaning messages, reactions, edits, pins, and any Telegram archives you imported. No photos, files, voice messages or todo lists, and never disappearing messages. Only your Recovery Key opens it, and we can’t. We see only its size and when it changes
- Why
- So your history can come back on a new device
- Where
- Our servers, encrypted
- How long
- The last 2 copies. Deleted when you delete your account
Anyone who holds your Recovery Key could read this backup, so keep the key somewhere safe.
Notifications
#| What | Why | Where | How long |
|---|---|---|---|
| Notification tokensA token for each device, when it’s woken, whether direct chats and groups notify it, and whether its notifications carry the message (not with No Name or Content, or in Lockdown Mode) | To wake your device when a message arrives | Only on our notification relay, a separate machine, under a random ID | Deleted after 30 days without activity on that device |
| Muted chatsThat you muted a chat, when your device can’t skip its notifications on its own (this can happen on iPhone), or if you choose it for a very large group | So we don’t wake your device for that chat | Our servers, for that chat’s mailbox, which they can’t link to you | Until you unmute it. When you delete your account, your device clears it; otherwise it goes when that chat’s mailbox is no longer used |
Signing up
#- What
- A one-time token showing that your app passed Apple’s or Google’s device check or, on computers and for anyone who prefers, solved a small puzzle
- Why
- To slow down fake accounts, without asking for a phone number
- Where
- Our servers check the token, but can’t link it to the device that got it. A separate service issues the tokens, with no access to accounts. To limit tokens per device, it keeps a scrambled form of the device’s check key, and a count
- How long
- The result of the check is never stored. The issuing service keeps its record of used tokens until its keys change, every month, and the count 30 days
Link previews
#- What
- The address of a link you send, without the part after the #
- Why
- To show a preview of the page in your message
- Where
- Once you’ve sent the link, your device asks our relay for the page, on a separate connection that isn’t tied to your account. The site sees our relay, not you. The preview travels sealed, inside your message
- How long
- Never stored or logged. We count only how many previews are made each day, never which
Link previews are on when you start, and never made while you type, in a message request, or for Murmur’s own links. Turn them off in Settings › Privacy › Link Previews.
Purchases
#| What | Why | Where | How long |
|---|---|---|---|
| A “supporter” flagOn your account, if you bought an optional supporter item. To set it, our servers check the store’s receipt, which holds no name or card | To give you what you bought | Our servers, without your payment identity | As long as the benefit lasts |
| A “community plan” flagOn a group. To set it and follow its renewals, our servers check the store’s receipt, which holds no name or card | To give the group more room for its files | Our servers | While the plan is active |
Reports and safety
#| What | Why | Where | How long |
|---|---|---|---|
| Abuse reportsThe category, the messages the person reporting chose to send (with their original signatures and the sender’s certificate), the report’s status, and a scrambled form of the reporting account | To check reports, act on abuse, protect children and meet our legal duties | Our servers, encrypted for our safety team | 90 days after the case is closed. If we act on an account, at least 1 year after that decision, so it can be checked and challenged. One year when the law makes us report it to the authorities. Longer only under a legal hold (an order to keep specific data) |
| Staff action recordsWhat our staff did on an account | To check our own work | Our servers, in a log no one can rewrite | 2 years, longer only under a legal hold. After you delete your account, no longer linked to it |
Some data about you can come from other people. If someone reports you, we receive the messages they chose, with your signature and your certificate.
Diagnostics and support, only when you choose
#| What | Why | Where | How long |
|---|---|---|---|
| Crash reportsOnly if you turn crash reports on. Cleaned on your device first, and you see a preview of exactly what leaves it | To fix crashes | Our own servers, never an outside crash service | Until the problem is fixed, then deleted |
| Debug reportsOnly if you send one. It holds a fixed list of fields and a diagnostic ID that lasts 24 hours, during which our team can look at the sealed records of that one group, which they still can’t open | To help with a problem you asked about | Our servers | Until the problem is fixed, then deleted |
| Messages to our official accountWhat you write to Murmur’s official account in the app. Our support team sees only what you send it, never your other chats or your keys | To answer you | Our servers and our support team | As long as we need it to help you |
| Emails you send usWith your email address | To answer you | Our email provider and our team | As long as we need it to answer you, unless the law makes us keep it longer |
| Community and panel reportsTotals that a group’s admins, or people who join our research panel, choose to share with us, like how many members are active | To know whether communities settle in on Murmur | Our servers, as totals only | 13 months |
Connections and counting
#| What | Why | Where | How long |
|---|---|---|---|
| Your IP addressA scrambled form of it is counted in memory to slow down abuse. That only asks your device for a little extra work, and never blocks you | To carry your connection, and slow down abuse | Our servers, in memory only | Never stored or logged, and never tied to your account. The scrambled form: 1 hour at most |
| Server logsA closed list of fields, which never includes account, device or group IDs, IP addresses or tokens | To keep our servers running | Our own machines | 7 days |
| Outage tracesHow a request moved through our servers, for a small sample of requests, and only while we handle an outage. The same closed list of fields as server logs | To find and fix the problem | Our own machines | 72 hours |
Your network (your internet provider, a Wi-Fi network) can still see that you use Murmur, when, and roughly how much data you send. Murmur doesn’t hide that, but you can connect through a VPN or Tor, and people who do are welcome.
Totals
#- What
- Counts that show Murmur is working; how many accounts and devices there are, and how many are active; how many messages, photos and files pass through our servers each day, and their volume; notifications sent and failed; link previews; username lookups; sign-ups by kind of check, and sign-up invitations; deleted accounts; how many new accounts are still active after 4 weeks and after 30 days; reports received, and spam reports per 1,000 new accounts; how account recoveries go; attempts blocked by our limits; how many people use several devices, a computer or a text backup; speed and errors. Today’s active accounts are counted in memory, in a way that can’t be traced back and is reset every day; over a week or a month, we go by the last day each device was active, and keep only the total. Devices connected right now, and devices by notification service (Apple, Google, another service or none), are counted on the spot, without keeping anything new
- Why
- To know Murmur works and how big it is, without following anyone
- Where
- Our servers, totals only, never tied to anyone
- How long
- Totals: 13 months. Devices connected right now and by notification service: never stored
How we use your data
#Only to run Murmur and keep it safe. Never for ads, and never sold.
- To give you an account, deliver your messages and files, and keep your devices in sync.
- To keep Murmur safe, by slowing down spam, fake accounts and password guessing, checking reports, and protecting children.
- To follow the law, including valid legal orders and the reports the law requires.
- To fix the problems you report, and the crashes you choose to send.
- To count totals, never people.
We don’t sell your personal information, and we don’t share it for advertising. No ads, no trackers, no analytics or crash-report kits from other companies, and no profile of you for marketing. No AI reads your conversations on our servers, and reports never go into an AI tool.
Limits that apply on their own
#- Some anti-abuse limits apply automatically. They’re based on account data, never on what you write. That data is how old the account is, how many new chats it starts, failed username lookups, how fast it joins groups, upheld reports, past restrictions, and whether it signed up with a device check or a puzzle. We call these trust levels. They’re always on, because they protect everyone. We don’t assess you in any other way, and we build no profile of your interests, habits or preferences.
- When a limit or a restriction applies to you, the app tells you, and why.
- You can ask us what information was used, the main reasons and factors behind the decision, and to correct that information. You can appeal in the app within 7 days. And at any time, you can ask a person on our team to review an automatic decision by writing to privacy@murmur.free.
What stays on your device
#Most of Murmur lives on your devices, not with us.
- Your messages, photos, files and contacts are stored in an encrypted database on your devices. Its key is random, never made from your password, and protected by your system’s secure storage. It’s left out of your phone’s or computer’s own backups. You can also lock Murmur with a PIN or your device’s unlock.
- Your private keys stay on your devices. Our servers only ever hold them sealed, in your Recovery Key data and for a few minutes when you link a new device, so we can’t use them. Your Recovery Key stays with you. We keep no copy, and we’ll never ask for it.
- Vault, your own chat for notes, photos and files you keep, lives on your devices. With several devices, it passes sealed through our servers like any message, and is deleted there once they have it.
- Search runs only on your devices.
- Voice to text, in the iPhone app, works on your iPhone with Apple’s speech recognition. The words are never sent, not even to your other devices.
- Your security log (new devices, failed sign-ins, password or key changes) is end-to-end encrypted on your devices.
- Messages you save for later stay on your devices, synced sealed between them, and go nowhere else. A scheduled message is different. It waits sealed on our servers, so it goes out at its time even if your phone is off (see Messages, files and groups).
- Polls and todo lists are counted and kept by each member’s app, never by us.
- My Stats are counted on your devices, and the private name and photo you give a contact with Edit Contact stay on them too.
- Link previews are made by the sender’s device.
- Admin tools, meaning a group’s light auto-moderation and its statistics, run on the admin’s own device.
- Telegram import works on a computer, from Telegram Desktop’s export. The archive is read only, visible only to you, encrypted on your device, and synced to your own devices (and to your text backup, if it’s on). Telegram IDs are removed; display names are kept. Our servers don’t process it. It holds other people’s names and words, so it’s for your personal use.
- Disappearing messages and view-once photos are deleted by the devices in the chat. Disappearing messages are never backed up, exported or moved to a new device, and view-once photos are never exported.
What this can’t protect is a device that’s unlocked or infected with spyware, and the copies your phone’s system keeps, like notification history.
What other people can see
#The people you talk to see what you send them. Here is what that includes.
- The people in a chat or a group see what you send there, and can save, screenshot or forward it.
- People you chat with, and the members of your groups, can see your name. Your profile photo shows only to your contacts by default. In Settings › Privacy › Profile Photo, you can show it to everyone you chat with, or to nobody. Your bio works the same way, in Settings › Privacy › Bio.
- When someone forwards a message you wrote, it says only “Forwarded”, unless you let your name show in Settings › Privacy › Forwarded Messages.
- The people you chat with, in direct chats and in groups, see when you’re online, or when you were last seen. In Settings › Privacy › Last Seen & Online, you can keep it to your contacts, or turn it off, and your contacts then see only “last seen recently” or “last seen a long time ago”. Strangers never see it, even after they send you a request, and Lockdown Mode turns it all off.
- Everyone in a group can see who else is in it. In a group, you can hide your username from members who aren’t your contacts.
- Your device signs your messages, so the people who receive them can prove they came from you. You can’t deny having written a message. That’s also what makes reports trustworthy.
- When you write to someone for the first time, your message waits in their Message Requests. Until they accept, you see no sign that it was delivered or read. If your account was made less than a week ago, they see a warning that it’s new.
- Read receipts and “typing…” are on by default. If you turn off Typing Indicators, you don’t see other people’s typing either. Neither is ever shown in requests, and they’re off in groups over 100 members.
- Anyone who types your exact username, number included, can find you and send you a request. It’s on by default. You can turn it off in Settings › Privacy › Find Me by Username, and choose who may send you a request in Allow Requests From, whether everyone, people you share a group with, or nobody.
- When you mark a contact’s security code as verified, your device tells theirs, sealed. Once you both have, the lock in your chat turns green for both of you.
- Group admins see the answers you give to their join questions, and the reports members send them.
- If a group’s admins turn on history for new members, people who join can read recent messages.
- Anyone with a group’s invite link can join and read new messages, unless whoever made the link approves each new member first.
What Apple and Google see
#They carry notifications and sell apps. They never see your messages, but they can tie your device to your Apple or Google account.
Notifications
#- On iPhone, notifications go through Apple. On Android, they go through Google. A notification carries at most the new message, sealed so that only your device can open it, which means Apple, Google and we can’t read it, or tell who sent it. But Apple or Google see a token and when your device is woken, and can link that device to your Apple or Google account. Authorities can ask them for that.
- Your device opens the message and writes the notification itself. What shows on your screen is your choice, in Settings › Notifications › Previews, between Name and Message, Name Only (the default) or No Name or Content. With No Name or Content, the notification carries no message at all.
- On Windows and Mac, notifications come only while Murmur is running, over our own connection. No other company’s notification service is involved.
- In the Android app from murmur.free, you can use UnifiedPush instead of Google. The UnifiedPush service you choose then sees when your device is woken.
- In Lockdown Mode, notifications never show names or messages, and carry none.
Signing up
#Apple or Google see that our app made a device check when you signed up. On computers, your device solves a small puzzle instead, and no one else is involved.
App stores and purchases
#- If you get Murmur from the App Store or Google Play, the store knows you downloaded it.
- If you buy something in the app, the store handles the payment and knows who paid. We never see your card, and we keep no payment identity, only the flag described above. To set it, our servers check the store’s receipt, which holds no name or card.
Their own privacy policies cover what they do.
Who else receives data
#Only the few companies and bodies Murmur needs. Never advertisers or data brokers.
| Who | What for | What they get |
|---|---|---|
| Our hosting provider, a data center company | Running our servers, database and storage, and keeping our encrypted backups in a second data center | Encrypted content and the data listed in this policy, on encrypted disks |
| Apple and Google | Notifications, the sign-up check, their app stores | See What Apple and Google see |
| The UnifiedPush service you choose, on Android | Notifications without Google | When your device is woken |
| Cloudflare, which hosts this websiteNever the Murmur app, which talks only to our own servers | Sending you this website’s pages, and protecting the site from attacks | Your IP address and the page you ask for |
| Our email provider | Our mailboxes, like privacy@murmur.free | The emails you send us |
| The child-protection bodies the law requires us to report toSuch as the CyberTipline of the National Center for Missing & Exploited Children (NCMEC) | The reports of child sexual abuse the law requires | What was reported, and what we hold about the account (our Child Safety Standards) |
| AuthoritiesWith a valid legal order, or without one only when someone’s life is in immediate danger (only the minimum) | Legal requests | What we hold, as listed in this policy (our law enforcement guidelines) |
| Our local representatives, where the law asks for one | Taking questions from people and authorities there | Only what you or they send, and what we need to answer |
| Security experts who help us during an incident | Handling the incident | Only what the incident needs, under confidentiality |
- Our service providers sign a written agreement that they use the data only for us, protect it at least as well as this policy does, and don’t keep it when the work ends.
- Apple and Google act under their own policies.
- If Murmur is ever sold or merged, the buyer must take on the same commitments. A special share in our company has a vote on any change of control, and can block it unless the buyer adopts our rules of no ads or tracking, no selling or sharing your data, and no weakening of end-to-end encryption.
Where your data lives
#On the servers we run for Murmur, with encrypted backups in a second data center.
- Where a server sits doesn’t change what it can reveal. What protects you is the design. We hold no message content and no keys, and we publish the rest.
- Some data is handled by others, wherever they run:
- what Apple and Google handle for notifications, sign-up checks and their stores;
- the emails you send us, through our email provider;
- your visits to this website, through Cloudflare, which hosts it;
- what you send our local representatives;
- on Android, what the UnifiedPush service you chose receives;
- the child-safety reports the law requires.
- Before we give personal information to a service provider, or send it to another country, we assess the risks to your privacy, and every provider signs a written agreement with us.
- When your data goes to a country whose law protects it less than the law where you live, it’s protected by the safeguards that law requires for such transfers, such as standard contractual clauses. Write to privacy@murmur.free for a copy.
The legal reason for each use
#Some privacy laws ask us to name the legal reason for each use of your data. Here they are.
| What we do | Legal basis |
|---|---|
| Run your account, deliver your messages and files, sync your devices, and provide the features you turn on (text backup, link previews, purchases) | Our contract with you, the Terms of Service |
| Keep Murmur safe, with anti-abuse limits, trust levels, sign-up checks, server logs, staff action records, handling reports and incidents, and enforcing our rules | Our legitimate interests in keeping Murmur and the people who use it safe |
| Count totals | Our legitimate interests in knowing the service works, without following anyone |
| Answer the emails you send us and your messages to our official account | Our legitimate interests in answering you (our contract with you, when it’s about your account) |
| Deliver this website, through Cloudflare, and protect it from attacks | Our legitimate interests in a website that works and stays safe |
| Answer valid legal orders, and make the child-safety reports the law requires | Legal obligation, where the law that applies to you requires it. Otherwise, our legitimate interests in meeting our legal duties, and protecting children |
| Meet our other legal duties, like answering your requests, reporting incidents and working with our local representatives | Legal obligation |
| Crash reports, debug reports, and the reports you choose to share as a panel member or group admin | Your consent. You can withdraw it at any time, in the app |
| Share the minimum we hold when someone’s life is in immediate danger | Vital interests |
You can object to any use based on our legitimate interests by writing to privacy@murmur.free.
How long we keep things
#As short as we can. Each item in The data we handle says how long. Here are the rules behind it.
- When a period ends, the data is deleted automatically.
- Our server backups roll over within 14 days, so deleted data leaves them too.
- We keep something longer only when the law requires it, for a report the law makes us send to the authorities (1 year), information we used to make a decision about an account (at least 1 year after the decision, so it can be checked and challenged), or data covered by a legal hold (an order to keep specific data). A legal hold keeps only the data concerned.
- When you delete your account, almost everything goes at once.
- If you stop using Murmur, your account is deleted after 12 months without use. You can choose 1, 3, 6, 12, 18 or 24 months instead, and you’re warned first.
Your rights
#You can see, take, correct and delete your data. You can do most of it yourself, in the app.
You have the right to:
- know what we hold about you, and get a copy;
- get it in a structured, common format, or have it sent to another organization, where the law allows;
- correct what’s wrong or incomplete;
- delete your account and your data;
- withdraw your consent, for example by turning off crash reports;
- ask us to stop spreading information about you, where the law allows;
- know when a decision about you was made automatically, why, and have a person review it;
- where the law gives you these rights, also limit how we use your data, and object to uses based on our legitimate interests.
How to use them
#- In the app. Change your profile and settings at any time. On a computer, Export my data gives you all your chats and the data our servers hold about your account, in a form you can import again (disappearing messages and view-once photos are never exported). Without a computer, write to privacy@murmur.free for a copy of what our servers hold. To delete your account, go to Settings › Account › Delete Account.
- By writing to us. Write to privacy@murmur.free with your username and what you’d like. Since we don’t know your email or phone number, we’ll ask you to confirm the request from one of your devices, in the app. We’ll never ask for your password or Recovery Key. To delete your account, use the app. We never delete one because of an email.
- We answer within 30 days, and it’s free.
- If you have no device left, we can’t tell that an account is yours, because we hold nothing else that could prove it. That’s the price of holding so little.
Wherever you live
#- We don’t sell personal information or share it for targeted advertising, in any sense a law gives those words, including about anyone under 16, and we don’t use sensitive information to infer anything about you.
- You won’t be treated differently for using your rights.
- Someone you authorize can make a request for you. We’ll still ask you to confirm it from one of your devices.
- If we refuse a request, you can appeal by writing to privacy@murmur.free with “Appeal” in the subject. We answer in writing. If you’re still not satisfied, you can contact the authority that protects personal information where you live.
Complaints
#Tell us first. If you’re not satisfied, a privacy authority can help.
Write to privacy@murmur.free. The person in charge of privacy reviews every complaint, and we answer you in writing, with what we found and what we did.
Not satisfied? Contact the authority that protects personal information where you live or work.
You can also contact that authority directly, without writing to us first.
Children and the age of 16
#Murmur is for people 16 and older.
- When you create your account, you confirm you’re 16 or older, as our terms require. We never ask for your date of birth, and our servers keep only the version of the terms you accepted.
- Where your app store shares your age range with apps, Murmur uses it on your device to apply the 16 and older rule, and doesn’t keep it.
- We don’t knowingly hold data about anyone under 16. If we learn that an account belongs to someone younger, we close it.
- If you’re a parent or guardian and think your child under 16 has a Murmur account, write to safety@murmur.free with the username. Our team looks into it, and closes the account only if it finds that it belongs to someone under 16. A message on its own is never enough, so nobody can close someone else’s account just by writing to us.
- Our Child Safety Standards say how we protect children, and how we act on abuse.
Security
#We protect your data by holding as little as we can, and sealing the rest.
- Every chat and every group is end-to-end encrypted with MLS, an open standard. Each device has its own keys.
- Your password never leaves your device, not even when you create it. It proves it’s you, and it never unlocks your messages.
- Your devices store Murmur’s data encrypted, with the keys in your system’s secure storage.
- Your connection goes straight to our servers, encrypted, with no middleman that decrypts it. Message sizes are rounded, so they look alike.
- Our servers use encrypted disks and encrypted backups. Our staff reach them only through a private network, with hardware security keys. Bulk or legal actions need two people, and every staff action goes into a log no one can rewrite.
- The code that seals your messages, meaning the encryption, the protocol and the server, is published. Anyone can read it and check how your messages are protected. Independent security firms reviewed the design, audited the code and tried to break in, and every report is published.
- Found a security problem? Write to security@murmur.free.
No system is perfect. If something goes wrong, here is what we do. The technical details are in How it works.
Requests from authorities
#We hold no message content and no keys, so those can’t be handed over. What we do hold can be compelled by a valid legal order.
- We answer valid legal process that binds us, whatever country it comes from. An authority whose order doesn’t bind us goes through the channels the law gives it, such as mutual legal assistance between governments.
- We tell the person concerned, unless a law or a court forbids it, or the case involves child sexual exploitation.
- We challenge orders that are too broad. Without an order, we share data only for the child-safety reports the law requires, and when someone’s life is in immediate danger (only the minimum).
- Twice a year, we publish a transparency report, with requests received and data handed over, by country and type.
- A legal order could force us to start keeping more about an account from that point on, and forbid us to tell you. That’s why we hold no content and no keys, and why we publish what our servers can see.
- We don’t keep IP addresses.
The details are in our law enforcement guidelines.
If something goes wrong
#If an incident puts your data at risk, we tell you and the authorities.
- We keep a register of every privacy incident, even small ones, for at least 5 years.
- We act at once to limit the harm, and to stop it from happening again.
- If there’s a risk of serious harm, we promptly tell the people concerned, and the authorities that protect personal information, within the time the law sets.
- Since we don’t have your email, we tell you in the app and on this website. After a serious incident, we publish what happened and what we changed.
How we govern personal information
#Here is how we manage personal information inside Murmur, in plain words.
Roles
#- The person in charge of the protection of personal information approves these rules, is consulted from the start of every project that touches personal information, and handles your requests, complaints and incidents. They can hand part of this role to another member of our team, in writing.
- Each person on our team gets only the access their job needs:
- Nobody at Murmur can see message content or keys.
- The people who run our servers can see the data listed in this policy, and nothing more.
- Our support team sees only what you send to Murmur’s official account, and the debug reports you choose to send.
- Our safety team sees the reports people send, with the messages they chose, and the account data needed to act on them. Child-safety evidence is kept in a vault that only two people together can open, and every opening is logged.
- Legal requests and bulk actions need two people.
Privacy impact assessments
#Before we build or change a system that handles personal information, and before any personal information goes to a service provider or to another country, we assess the risks to your privacy and how to reduce them. We update these assessments whenever Murmur changes in a way that matters.
Private by default
#Murmur’s defaults protect you without you changing anything. Notifications show only the sender’s name, your profile photo and bio show only to your contacts, a forward of your message doesn’t carry your name, and crash reports stay off until you choose. Where a default trades a little privacy for everyday comfort, like read receipts, link previews, Last Seen & Online or being findable by username, you can turn it off in Settings › Privacy.
Training
#Everyone on our team who can reach personal information signs a confidentiality commitment and is trained on these rules before getting access, and regularly after that.
Incident register
#We record every privacy incident, even small ones, with what happened and what we did, and keep the record at least 5 years, as explained in If something goes wrong.
Keeping and destroying data
#Every kind of data has a set period, listed in The data we handle. When it ends, we destroy the data (on your devices, by destroying its key) or keep only totals, never tied to anyone. The rules are in How long we keep things.
Service providers
#Each service provider signs a written agreement before it gets any personal information, as described in Who else receives data.
Handling complaints
#The person in charge of privacy reviews every complaint, looks into it and answers in writing, as explained in Complaints.
This website
#This site is plain files. No cookies, so no cookie banner. No analytics or trackers, so no visitor is tracked, and nothing is loaded from anywhere else.
- The only thing this site stores in your browser is your theme (light or dark), if you change it. It stays in your browser.
- The Download page reads which system you use, in your browser, to show it first. Nothing is sent.
- App store buttons are plain links, so nothing loads from a store until you click.
- When you follow a link from this site to another site, your browser doesn’t tell that site which page you came from.
- This website is hosted by Cloudflare. To send you a page, Cloudflare receives your IP address and the page you ask for, and uses them only to deliver the page and protect the site from attacks. The Murmur app never goes through Cloudflare, and talks only to our own servers.
- We don’t track you, so Do Not Track and Global Privacy Control have nothing to switch off, and we honor them all the same.
- Contact and invite links (app.murmur.free/add#… and app.murmur.free/join#…) open Murmur, straight from our own servers. The part after the # never reaches a web server. It stays on your device, and your app reads it.
- No page on this site asks for your username, your password or your Recovery Key, and none can delete your account, because only you can, in the app.
More in How it works, under This website.
Changes to this policy
#- When we change this policy, we tell you in the app and on this website at least 30 days before the change takes effect, the same way as for our terms. We have no email to send it to.
- For an important change, we explain what changes and why, in plain words.
- Earlier versions stay available. Ask us at privacy@murmur.free and we’ll send the one you need. We keep which version of the terms you accepted.
Contact
#- Privacy, your rights and complaints (the person in charge of privacy)
- privacy@murmur.free
- Child safety
- safety@murmur.free
- Legal and law enforcement requests
- legal@murmur.free
- Security problems
- security@murmur.free
- Anything else
- hello@murmur.free
Murmur will never ask for your password or Recovery Key on a website or in a message.