Polymorph User Agreement

Effective date: TODO Last updated: 2026-05-04

This is a draft for legal review. It is written to match the current product and codebase as closely as possible, but it is not final legal advice.

1. About Polymorph

Polymorph is a private messaging and communication service operated by Polymorph Technologies.

Polymorph provides features such as encrypted chats, groups, calls, media sharing, stories, location sharing, backups, multi-device sync, Circles, file sharing, and related communication tools.

2. Acceptance

By creating an account, signing in, using the app, or using Polymorph services, you agree to this User Agreement and the Privacy Policy.

If you do not agree, do not use Polymorph.

3. Eligibility

TODO: decide minimum age and region-specific requirements.

You may not use Polymorph if you are legally barred from using the service or if your account has been terminated for serious abuse.

4. Your Account Keys

Polymorph accounts use account keys instead of requiring a phone number or email address.

You are responsible for keeping your account keys safe. Do not share them with anyone. If you lose them, Polymorph cannot recover your account or encrypted content for you.

This is not a support limitation. It is part of the security model.

If you have a paid subscription and lose access to your account, you may still be able to cancel payment through the payment provider, app store, Stripe, or your bank.

5. Handles And Profile Identity

Polymorph handles, display names, profile pictures, status text, badges, and other account identifiers help people understand who they are communicating with. You are responsible for how you present yourself through those features.

You do not own a handle merely because you registered it. Polymorph may reserve, limit, rename, or reassign handles where reasonably necessary to:

• prevent impersonation, scams, confusion, or abuse
• protect trademarks, legal rights, public figures, organizations, or brands
• support verified accounts, official accounts, or future identity features
• comply with legal obligations or resolve credible disputes
• protect the reliability, trust, or safety of the service

If possible and appropriate, we will try to provide notice or a chance to choose a different handle. In serious cases, such as impersonation, fraud, legal risk, or security risk, we may act without prior notice.

6. Your Devices

Polymorph supports true multi-device use. There is no master device. You may sign in on a phone, computer, or tablet, and your devices can sync in realtime.

You are responsible for devices you connect to your account. If a device is lost, stolen, shared, or compromised, remove it from your account if possible and protect access to your local device.

Remembered sessions and local unlock are convenience and security features, but they do not protect against all local compromise, malware, or someone who has access to an already-unlocked device.

7. Privacy And Encryption

Polymorph is designed so that communication content is end-to-end encrypted by default. This includes chats, groups, calls, media sharing, stories, location payloads sent through Messenger, personal Files cloud content, and encrypted Messenger backups/snapshots.

End-to-end encryption means Polymorph generally cannot read your communication content. It also means we cannot recover encrypted content if you lose your account keys.

You understand that:

• recipients can read, save, copy, screenshot, report, or share content you send to them
• encryption does not protect content after it is decrypted on a compromised device
• some metadata is necessary to operate the service
• abuse reports or support requests may include information you choose to send to us

Polymorph's privacy protections do not make you untraceable or anonymous in every context. Your device, network provider, payment provider, app store, operating system, contacts, recipients, or information you choose to share may still identify you. Polymorph may also process limited service metadata and respond to valid legal obligations as described in the Privacy Policy.

8. Your Content

You keep ownership of content you create or send through Polymorph.

You give Polymorph the limited rights needed to operate the service, such as routing encrypted messages, storing encrypted backups, syncing account data, delivering files, processing reports, and providing support.

Because content is end-to-end encrypted, Polymorph does not actively monitor ordinary private messages for content moderation. We may act on abuse reports, operational metadata, or information lawfully provided to us.

9. Acceptable Use

Polymorph's privacy protections are provided to protect lawful private communication. They are not a license, invitation, or safe harbor for unlawful, harmful, abusive, or unauthorized activity. You are solely responsible for how you use your account, devices, and any Polymorph identifiers, files, messages, or other service features made available to you.

Do not use Polymorph to:

• violate the law
• harass, threaten, exploit, or abuse people
• send spam, scams, malware, or phishing attempts
• impersonate others in a misleading or harmful way
• distribute non-consensual intimate content
• exploit minors or engage in child sexual abuse material activity
• interfere with the service, infrastructure, or other users
• attempt unauthorized access to accounts, systems, or data
• use automation to scrape, enumerate, spam, or overload the service
• bypass plan limits, security controls, or abuse-prevention systems

We may restrict or terminate access for serious abuse, security risk, legal requirements, or substantial violation of this Agreement.

10. Reports And Safety

You may report abuse through the app where available. Reports may include your account, device, the reported account, category, optional conversation identifier, and any note you choose to provide.

Because Polymorph is end-to-end encrypted, we may not be able to verify the contents of private conversations unless you provide relevant information.

We may review reports, take action on accounts or devices, preserve limited records where legally necessary, and cooperate with lawful requests where required.

11. Paid Plans

Polymorph may offer Free, Plus, Pro, or other paid plans. Paid plans may include benefits such as more storage, larger uploads, more Circles, uncompressed uploads, faster transfer speeds, animated profile pictures, or a Polymorph Supporter badge.

Plan features, prices, limits, and availability may change. If we materially change a paid plan, we will provide notice where required.

Payments may be handled by Stripe, app stores, banks, or other payment providers. Their terms and privacy policies also apply.

12. Cancellation, Non-Payment, And Downgrades

You may cancel a paid plan through the place where you subscribed, such as Stripe, an app store, or your bank.

If a subscription is canceled, expires, or cannot be paid, Polymorph should degrade paid features cleanly instead of immediately destroying user data.

The intended downgrade behavior is:

• core messaging, encryption, and access to your account continue
• paid-only profile extras may stop displaying or stop being editable
• creating new paid-only resources may be blocked
• existing Circles above the free-plan limit may become read-only or require choosing which Circles remain active
• storage above the free-plan limit may block new uploads or backup growth until you upgrade again or delete enough data
• larger upload limits, uncompressed upload behavior, and faster transfer treatment may stop applying

TODO: finalize exact downgrade grace periods and in-app behavior.

13. Storage, Uploads, And Backups

Storage and upload limits depend on your plan. Polymorph may refuse uploads, sync, backups, or file operations that exceed your plan limits or technical safety limits.

Encrypted backups and sync are intended to help you restore data across devices, but no backup system is perfect. Keep your account keys safe and keep important local copies where appropriate. Personal Files cloud sync encrypts file bytes and filenames before upload.

14. Deletion

Polymorph's product principle is that delete means delete. When you delete cloud-backed data, Polymorph should remove the active metadata and delete referenced blobs where possible.

Deletion may not immediately remove every temporary technical record, queue entry, diagnostic record, abuse report, legal hold, or provider-level backup. Those records should be removed according to defined retention rules.

TODO: define and implement the user-facing account deletion path and retention schedule before launch.

15. Third-Party Services

Polymorph may rely on third-party or separately operated services for:

• app distribution
• payment processing
• push notifications
• hosting, database, and object storage
• TURN/SFU calling infrastructure
• map tiles
• operating-system permissions and device services

Those services may have their own terms and privacy policies.

16. Service Changes And Availability

Polymorph is evolving. Features may change, be limited, be renamed, or be removed. We may perform maintenance, deploy updates, suspend features, or limit usage to protect reliability and security.

We aim to provide a reliable service, but we do not guarantee uninterrupted or error-free operation.

17. Security Research

Do not test Polymorph security in a way that harms users, accesses data you are not authorized to access, degrades service, or violates the law.

TODO: add responsible disclosure contact and safe-harbor policy if desired.

18. Intellectual Property

Polymorph Technologies owns the Polymorph app, website, brand, design, software, and related intellectual property, except for third-party components and content owned by users or others.

You may not copy, modify, distribute, reverse engineer, or misuse Polymorph software except where allowed by law, an applicable open-source license, or written permission.

TODO: align this with actual licensing strategy before publication.

19. Termination

You may stop using Polymorph at any time.

We may suspend or terminate access if:

• you seriously violate this Agreement
• you create security, legal, or operational risk
• we are required to do so by law
• continued service would harm Polymorph or other users

Where reasonable and lawful, we will try to avoid unnecessary loss of access to encrypted user data. However, if you lose your account keys, we cannot restore access.

20. Disclaimers

Polymorph is provided as available and as permitted by law. We do not promise that the service will always be available, error-free, or suitable for every purpose.

We do not control what recipients do with content you send them. We cannot recover lost account keys. We cannot protect content on a compromised device after it has been decrypted there.

21. Limitation Of Liability

TODO: legal counsel should draft liability limits appropriate for the launch jurisdictions, consumer-law requirements, paid plans, and app-store terms.

22. Changes To This Agreement

We may update this Agreement as Polymorph changes. If changes are material, we will provide reasonable notice. Continued use after changes take effect means you accept the updated Agreement.

23. Governing Law And Disputes

TODO: choose governing law, venue, consumer-rights carveouts, and dispute process.

24. Contact

Contact: TODO