Legal information

Messenger is run by a private individual at rgogola-wms.eu. Contact: richardgogola12@gmail.com.

Accounts are created by invitation only. This is not a public service and it is not offered to anyone else.

• Account — e-mail, the name you choose, your password (stored only as a hash, never readable), profile photo and cover if you upload them.
• Messages and attachments — message text, photos, videos, voice messages and files you send. They are stored on the server.
• Posts, comments, reactions and My Day.
• Location — only if you turn it on. What is stored is the city name, when it was last updated, and a coordinate rounded to two decimal places (about 1 km). The rounded coordinate exists only to tell whether you have moved; it is never shown or sent to anyone. Others see the city only — and only those you allow in settings.
• Calls — who called whom, when and for how long. Call content is not recorded.
• Sign-ins — browser type and a hash of your IP address (SHA-256). The IP address itself is never stored.
• Passkeys — the public part of the credential. Your fingerprint or face never reaches the server; those stay on your device.
• Push subscriptions — the address your browser uses to deliver notifications, and the keys used to encrypt them.
• Screenshots — if you take a screenshot inside a conversation, a system message is recorded and the other side will see it.

• Your IP address in readable form.
• Your precise location.
• The content of calls.
• No tracking or advertising scripts. There is no analytics and no third-party cookies.

• The operator. Unencrypted messages are readable on the server, so technically they can be accessed. That is not done, but it is fairer to say so plainly than to imply otherwise.
• OpenStreetMap (Nominatim) — when location is on, coordinates are sent to nominatim.openstreetmap.org to look up the city name. The result is cached locally, so the same place is not looked up twice.
• Your browser vendor's push service — Google (Chrome), Mozilla (Firefox) or Apple (Safari). Notification content is encrypted per RFC 8291 and the push service cannot read it; it sees only that something arrived and when.
• The hosting provider whose server the application runs on.

Data is never sold and never used for advertising.

End-to-end encryption can be switched on per conversation. The key is derived from a password you type in the browser and is never sent to the server. From that point the server only sees unreadable text.

What encryption does not cover:

• Attachments stay unencrypted even in an encrypted conversation — photos, videos and files are visible to the server.
• Who talks to whom, when, and how often.
• Messages sent before you turned encryption on.
• Group conversations — encryption works between two people only.
• The other person's device. If someone takes a screenshot, encryption does nothing about it (you will be told, but it will not be prevented).

• Messages, posts and attachments — until you delete them or the account is deleted. Attachments are additionally deleted automatically after 2 days.
• Notifications — 60 days.
• My Day — 24 hours, then moved to the archive.
• Sign-ins — until you sign out or the session expires.
• Notification queue — at most 2 days.

• Download everything — Settings → Account → Export data. You get a file with your messages, posts and settings.
• Delete your account — Settings → Account → Delete account. This removes your profile, messages, attachments, posts and sign-ins. Messages you sent to other people stay in their conversations — the same as with ordinary mail.
• Correct your data — name, e-mail and photo are editable in your profile.
• Turn off location and notifications at any time in settings.
• For anything else, write to richardgogola12@gmail.com.

The application automatically picks up headlines, links and images from public RSS feeds of news agencies. Rights to that content belong to the original source, not to this application. Every such post links back to the original article. If a source does not want its feed used, a message is enough and the feed will be removed.