Privacy Policy

Last updated: October 14, 2026

1. Introduction

Simit Messenger ("Simit", "we", "us") is a privacy-focused, phone-number-based messaging application. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By creating an account or using the app, you agree to the practices described here.

2. Information We Collect

We collect only what we need to provide the service. Simit's servers act as a relay: they pass your messages on, but they do not keep a history of your conversations.

• Phone number. Used to create and verify your account via a one-time SMS code, and to let people who already have your number find you. Your number is stored encrypted, and lookups use a keyed cryptographic hash (HMAC-SHA256) of it. Your number is not shown to other users unless they already have it.
• Profile information. Your display name, optional username, optional bio, and an optional profile photo. Your profile photo is the only image we serve publicly, so your contacts can see who you are.
• Messages and photos, briefly. The content you send (text messages, edits, and photos) passes through our servers and is held only until your recipients' devices have received it, then permanently deleted. See section 5.
• Delivery records. For 30 days we keep a content-free record of each message (message ID, chat ID, sender ID and time) so that "delete for everyone", edits, receipts and reports keep working. These records contain no message content.
• Contacts and connections. If you allow access to your address book, the app sends the phone numbers of your contacts (never their names) so we can tell you which of them use Simit and enforce the mutual-contacts rule. We store these numbers only as keyed hashes. We also store which Simit users you are connected to, the groups you belong to, and the people you have blocked. See section 4.
• Reports. If you report a person, message or group, your device sends us the reported message and up to 10 messages before it from that chat, so our team can review it. This is the only way message content ever reaches our moderators.
• Settings. Your privacy and notification settings, and, if you turn it on, a securely hashed Registration Lock PIN (see section 7).
• Device & technical data. A device push token (for notifications), app version, and basic connection metadata needed to route messages and keep the service reliable.
• Diagnostic data. Basic server-side logs (such as errors and request timing) used to keep the service secure and reliable. We do not use third-party analytics or advertising SDKs.

3. How We Use Your Information

• To create your account and verify your identity via SMS.
• To relay your messages and photos to the people you're chatting with.
• To match you with contacts who also use Simit.
• To send push notifications for new messages (if you enable them).
• To review reports, and to maintain security, prevent fraud and abuse, and keep the service running.
• To diagnose problems and improve the reliability of the service.

4. Contacts & Phone Numbers

Simit is a mutual-contacts messenger: you can only exchange direct messages with someone who also has you in their contacts. To power this:

• Names never leave your phone. When you sync or add contacts, the app sends only phone numbers. The names you saved stay on your device, and Simit shows them from your own address book.
• Numbers are matched using keyed hashes. Your device sends the numbers over an encrypted (TLS) connection. Our servers compute a keyed cryptographic hash (HMAC-SHA256, using a secret key held in a secrets manager) of each number, match it against other users, and discard the raw number. Raw address-book numbers are not stored. We keep the keyed hashes so that friends who join Simit later can be matched with you.
• Your own phone number is stored encrypted and is decrypted only when needed: to send you an SMS code, or to show it to someone who already has your number.

We use this information only to show you which contacts are on Simit and to enforce the mutual-contact rule. We never message your contacts, and we never sell or share your address book. You can add contacts individually by phone number, without granting access to your full address book.

5. Messages & Media

Our servers are a relay, not an archive. Your conversation history lives only on your devices and the devices of the people you talk to.

• Messages. When you send a message, it is held on our servers only until each recipient's phone has received it, and then it is permanently deleted from our servers, including any edits and read receipts. If a recipient stays offline, the message is deleted after 30 days regardless. Our servers keep no message history.
• Photos. Before a photo leaves your phone, the app encrypts it with a random key created for that photo. The encrypted file is uploaded to private storage. It is never given a public link and is never served through a content delivery network. Recipients' phones download and decrypt it, and once every recipient has it, the encrypted file is deleted (after 30 days at most). The photo's key travels inside the message, which is itself deleted after delivery.
• Delete for everyone. When you delete a message for everyone, it is removed from your recipients' devices, and from our servers if it is still waiting to be delivered.
• Delivery records. For 30 days we keep a content-free record (message ID, chat ID, sender ID and time) so that deletes, edits, receipts and reports keep working. It contains no message content.
• On your device. Messages and photos are stored in the app on your iPhone. Signing out or deleting the app deletes them from that phone. The setting "Include messages in iPhone backup" is off by default: while it is off, your messages never leave your phone in a backup, but they are lost if you lose or replace your phone. If you turn it on, they are included in your iCloud or computer backup, which is governed by Apple's or your computer's backup terms.

6. How We Share Information

We do not sell, rent, or trade your personal information. We share information only:

• With your recipients — the people and groups you choose to message.
• With service providers who help us operate the app (for example, our SMS verification provider, cloud hosting and storage, a content delivery network for profile photos, and push-notification delivery through Apple), bound by contractual confidentiality and used only to provide the service.
• For legal reasons — when required by applicable law, regulation, legal process, or to protect the rights, safety and security of our users and the service.

7. Data Security

All communication between the app and our servers is encrypted in transit using TLS. Data is stored on protected infrastructure with restricted access, and storage is encrypted at rest. Photos are additionally encrypted on your device before upload. Your phone number is stored encrypted, and the secret keys used for phone-number encryption and hashing are held in a secrets manager.

• Registration Lock. You can set an optional Registration Lock PIN (recommended). If someone takes over your phone number, for example through a SIM swap, they may receive your SMS code, but without the PIN they cannot register your Simit account on another phone. Your PIN is stored only as a strong one-way hash (Argon2id), never in readable form. If you forget it, you can register again after 7 days of inactivity on your account.
• Notifications. Notification previews are set to "Name only" by default, so message text is not included in your notifications. You can choose Nothing, Name only, or Name and message. Notifications are delivered through Apple's push notification service, and message text passes through it only if you choose "Name and message".
• Reciprocal privacy. If you hide your last seen, you also can't see other people's. If you turn off read receipts, you won't receive other people's read receipts either.

Simit is not end-to-end encrypted (see section 5). While no system can be guaranteed perfectly secure, we take reasonable technical and organizational measures to safeguard your information.

8. Data Retention

• Message content (text, edits, receipts): held only until delivered to every recipient's device, then permanently deleted; at most 30 days if a recipient never comes online.
• Photos: encrypted files are deleted once every recipient has downloaded them; at most 30 days.
• Delivery records (no content): 30 days.
• Reports: the report, including the messages your device sent with it, is kept for as long as needed to review it and enforce our Terms.
• Account information (encrypted phone number, profile, settings, contact hashes, connections, groups and blocks): for as long as your account is active. Deleting your account removes it from our active systems.
• Server backups: our database backups are kept for 7 days. This means a message that was still waiting for delivery when a backup was taken could remain in that backup for up to 7 days after it was deleted from our live systems. Backups are encrypted, access-restricted and used only for disaster recovery.

Messages stored on your own device remain there until you delete them, sign out, or delete the app. Copies on your recipients' devices are under their control, except that "delete for everyone" removes a message from their devices too.

9. Your Rights & Choices

• Access the personal data associated with your account.
• Correct inaccurate profile information from within the app.
• Delete your account and associated data at any time from Settings.
• Export your account data from the app or by contacting us. Your message history is on your device, not on our servers.
• Block users and control privacy settings (last seen, read receipts, profile-photo visibility, notification previews, Registration Lock, and more) in the app.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. To exercise any of these rights, contact us at the address below.

10. Children's Privacy

Simit is not intended for children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

11. International Transfers

Your information may be processed and stored on servers located outside your country of residence. Where we transfer data internationally, we take steps to ensure it remains protected in accordance with this policy and applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. Your continued use of Simit after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy questions or requests, contact us at [email protected]. For general support, see our Support page.