Polymorph
Back to Polymorph

Polymorph Privacy Policy

Effective date: TODO Last updated: 2026-05-04

This is a draft for legal review. It is written to match the current product and codebase as closely as possible, but it is not final legal advice.

Our Position

Polymorph exists because human connection and communication should not be used as raw material for data harvesting. We build the service around end-to-end encryption, minimal metadata, no phone-number or email-account requirement, and deleting data when it is no longer needed.

Our goal is simple: provide private communication without turning your social life, conversations, contacts, or behavior into a tracking product.

How We Fund Polymorph

Polymorph is designed to be funded by users through subscriptions and related paid features. We do not fund the service by selling personal data, behavioral profiles, communication metadata, or advertising access to users.

Free accounts are intended to remain useful and are supported by the overall service model, including paid plans.

Who We Are

Polymorph is operated by Polymorph Technologies.

Controller details:

What This Policy Covers

This policy covers Polymorph's apps, websites, APIs, calling infrastructure, cloud backup/sync services, and related support or abuse-reporting workflows.

It does not cover third-party services that you choose to open or use outside Polymorph, such as app stores, payment providers, operating-system services, map tile providers, or links shared by other users.

What We Do Not Ask For

Polymorph accounts are not built around personal identifiers.

We do not require:

You sign in with account keys. If you lose those account keys, we cannot recover the account for you. That is part of the security model.

Privacy Is Not Untraceability

Polymorph is designed to protect private communication, minimize metadata, and avoid personal identifiers such as phone numbers or email addresses. That does not mean using Polymorph makes you untraceable or anonymous in every context.

For example, your device, network provider, payment provider, app store, operating system, contacts, recipients, or information you choose to share may still identify you. Polymorph may also process limited service metadata and respond to valid legal obligations as described in this Policy.

Privacy means we avoid collecting, reading, selling, or exploiting your communication data. It does not mean Polymorph can guarantee invisibility, immunity from lawful process, or protection from activity outside our service.

What We Collect

We collect only the information needed to provide, secure, sync, and maintain the service.

Account And Authentication Data

We process:

When this policy refers to device IDs or device identifiers, it means Polymorph-generated identifiers created when a device signs in to your account. They are not hardware serial numbers, operating-system advertising IDs, or other device identifiers from outside Polymorph.

Device session tokens are stored server-side as hashes. Device information is minimized; the server-side migration path intentionally reduces device metadata to a small platform field where possible.

Handle And Profile Data

If you choose a handle, the server stores it using a blind index for lookup and encrypted handle storage. This lets Polymorph check availability and resolve handles without keeping handles as ordinary plaintext database fields.

Some profile fields are designed as client-owned private profile data. The API rejects plaintext updates for private profile fields such as display name, status text, and avatar metadata through the public profile endpoint. Those fields are synced through encrypted client-side account data instead.

Polymorph's Circles feature lets you present different display names, avatars, and status text to different groups of contacts. The intent is that these presentations are shared only with the contacts or groups they are meant for.

Communication Metadata

To route messages, calls, sync updates, and notifications, we need limited service metadata. Depending on the feature, this may include:

We use this metadata to operate the service. We do not use it to profile you, rank your behavior, build advertising audiences, or sell behavioral data.

Encrypted Content

The server stores or routes encrypted payloads for features such as:

The current Messenger path uses MLS-based encrypted message delivery and encrypted durable account snapshots. Message attachments are encrypted client-side before upload. Story media and profile/avatar media are also encrypted client-side before upload. Personal Files cloud sync encrypts file bytes and filenames before upload.

Calls through the SFU are configured to require end-to-end media encryption. If encrypted media cannot be established, the app treats that as a call failure.

Scheduled And Special Messages

Scheduled messages, silent messages, and one-time-view messages require some additional routing metadata, such as scheduled visibility time or whether a push notification should be suppressed.

For scheduled messages, Polymorph stores per-recipient reveal metadata so the recipient device can reveal the message at the right time. The message payload itself is still transported inside the encrypted messaging layer.

Diagnostics

If the app records diagnostics, the data is intentionally bounded. Diagnostic events may include:

Diagnostic details are truncated and capped. They are for reliability and debugging, not behavioral analytics.

Abuse Reports

If you report abuse, we store the minimum information needed to review the report:

Because Polymorph is end-to-end encrypted, we generally cannot inspect chat content unless you choose to include information in a report or otherwise share it with us.

Payment And Subscription Data

Polymorph does not require a phone number or email address for the app account. Paid plans may be handled through a payment provider such as Stripe, app stores, or banks.

Payment providers may process payment information, billing identifiers, fraud signals, and transaction records under their own terms and privacy policies. Polymorph should only store the minimum subscription state needed to provide the paid plan.

TODO: confirm final billing architecture and document exactly which payment provider identifiers Polymorph stores.

Website Data

When you visit Polymorph websites, ordinary web infrastructure may process:

We do not use website visits to build behavioral advertising profiles.

What We Cannot See

Polymorph is designed so we cannot read the contents of your end-to-end encrypted communications. This includes chats, groups, message media, stories, location payloads sent through Messenger, personal Files cloud content, and encrypted backups/snapshots.

Important limits:

Current Launch-Blocking Accuracy TODOs

Before this policy is published, confirm or fix the following:

Why We Use Data

We use the data described above to:

We do not sell user data. We do not share user or behavioral data for advertising. We do not use communication content for profiling.

Legal Bases

Where the GDPR applies, our legal bases may include:

Permissions On Your Device

Polymorph may request device permissions depending on the features you use:

Location sharing is sent through encrypted Messenger payloads. Live location updates are intended to be encrypted before leaving the device. Map tile requests may still be visible to the tile provider unless and until Polymorph operates its own tile service.

Who We Share Data With

We use service providers only as needed to run Polymorph. Depending on the deployment, these may include:

These providers process data for infrastructure purposes. They are not allowed to use Polymorph user data for advertising or unrelated behavioral tracking.

International Transfers

Polymorph may process data in the EU/EEA and in other locations where our infrastructure or providers operate.

TODO: document final hosting regions, subprocessors, and transfer safeguards.

Retention And Deletion

We keep data only for as long as needed for the service, security, legal obligations, or user-requested functionality.

Our product principle is: delete means delete. When you delete cloud-backed data, the server removes metadata and deletes referenced blobs where possible. Object-storage garbage collection also removes unreferenced blobs.

Some short-lived or operational records may remain temporarily while deletion, sync, delivery, audit, abuse-review, or backup-cleanup workflows complete.

TODO: define exact retention windows before publication.

Your Rights

Depending on where you live, you may have rights to:

Because Polymorph does not require email or phone-number identity, we may need you to prove account control with your account keys or an authenticated session before acting on a request.

Security

Polymorph uses technical and organizational safeguards intended to protect the service, including:

No system is perfect. Encryption protects content in transit and at rest, but it does not protect content after it is decrypted on a compromised device or shared with another person.

Children

TODO: decide age eligibility and parental-consent requirements for launch regions.

Changes To This Policy

We may update this policy as Polymorph changes. If changes are material, we will provide notice in a reasonable way, such as in-app notice or website notice.

Contact

Privacy contact: TODO

If you are in the EU/EEA, you may also have the right to lodge a complaint with your local data protection authority.