Montana Messenger is built to collect as little as possible. This page states exactly what the application handles, what leaves your device, who sees it and for how long it is kept.
Identity
Your identity is a 24-word phrase generated on your device; your Montana address is derived from it. We never see the phrase or the keys, and nobody, including us, can restore them for you. The phrase is the only way in: the application asks for no phone number and no e-mail address, and no service of ours confirms one.
Your contacts
The application does not ask for access to your Contacts. When you choose to share a contact in a chat, the system picker opens your address book in a window of its own and gives the application only the one contact you pick. Nothing from your address book is sent to us.
Montana Messenger does not ask for your e-mail address and has no sign-in by e-mail. If you write to contact@montana.one, your letter is used only to answer you.
Messages, calls and media
Every message, photo, video, voice message and file is end-to-end encrypted with post-quantum cryptography: ML-KEM-768 for the session, ML-DSA-65 for signatures, ChaCha20-Poly1305 for content. The keys live only on the devices of the people in the conversation.
When both phones are reachable, a message travels directly between them. Otherwise it waits on a Montana node as a sealed envelope, and media as sealed chunks, that the node cannot open. Undelivered material is kept for at most 7 days and then deleted. When you send a link, your device fetches its preview from that site, as a browser would; the device of the person who receives it does not.
Voice and video calls are encrypted end to end by DTLS-SRTP, the standard of calls on the internet, and each call's key fingerprint is confirmed inside the post-quantum session. A node only forwards the call set-up inside the encrypted session and never holds a key to the audio or the picture.
Your history
Your conversations live on your device and are never sent to our servers in readable form. So that your 24 words can bring them back on a new phone, a copy sealed with the key your 24 words open is cut into parts kept by the people you write to: the application asks you about it when you first open it, and the switch Keep my copy with my contacts in Settings, Data and Storage turns it off. A keeper sees only a part's size and when it changes, and cannot open it; your device likewise keeps sealed parts for your contacts while Keep parts for my contacts is on. If you turn on the iCloud copy in Settings, once a day the same sealed copy goes to the iCloud storage of your own Apple Account. The words are in neither, and without them nobody can read the copy. Deleting the application erases the history on that device.
Diagnostics
Diagnostic logs leave your device only if you allow it: the application asks after it is installed or updated, and the switch Share diagnostics in Settings, Privacy turns them on or off at any time. They help us find and fix defects and hold event records, timings, error codes and crash reports, together with the device model, operating-system version and application build.
The logs never contain message content, names, phrases or addresses. The diagnostic identifier is a random value unrelated to your identity, and the identifiers of your correspondents are replaced with irreversible salted hashes on your device before anything is sent. Logs are kept on a Montana node for at most 7 days and then deleted. They are not linked to you and are not used for tracking.
Permissions
Each permission serves one feature. Camera and microphone: photos, videos, voice messages and calls; the camera also scans a person's QR code. Photo library: choosing and saving media. Location: sending a place in a chat when you choose to, while the application is open; it is never read in the background. Speech recognition: showing a voice message as text on the device when you ask; the sound is never sent. Face ID: showing your 24-word recovery phrase.
Notifications
To wake a sleeping device we send a notification through Apple's service. It carries no content: the message is fetched and decrypted on your device after the wake-up.
No tracking
Montana Messenger contains no advertising, no third-party trackers, no third-party analytics and no third-party software development kits that report to anyone. Nothing is sold, and nothing is shared beyond what this page describes. No data is used to track you across other applications or websites. GIF search is answered by GIPHY through a Montana node, which passes on only the words you search, so GIPHY never sees your device.
What we never have
Your recovery phrase. Your keys. The content of your messages and calls. Who you talk to. Where you are: a place you send in a chat reaches only that chat.
Children
Montana Messenger is not directed to children; you must be 18 or older to use it.
Your choices
Montana Messenger asks for no phone number and no e-mail address, so no account of yours exists on our side. Deleting the application removes everything it stored on the device, and nothing of yours stays with us to remove. For any question about your data write to contact@montana.one.
Changes and contact
Changes to this policy are published on this page with a new effective date. Questions: contact@montana.one.