Privacy by system boundary.

01 / Website

No advertising stack or behavioral analytics.

• No advertising scripts, third-party analytics SDK, persistent marketing identifier, tag manager, tracking pixel, or external webfont.
• No signup form, newsletter profile, or marketing cookie.
• The #invite=... fragment is not part of the HTTP request. The join page does not send it to the network or store it in localStorage, sessionStorage, or cookies.

Cloudflare Pages and normal web infrastructure may still process standard connection metadata such as IP address, request time, and User-Agent for delivery, abuse prevention, and security operations. In v0.5.13 the Channels status preview makes one HTTPS request to M2 Pages while protection is connecting; the response contains Cloudflare's IP-based city, region, country and the requesting public IP. The response is marked no-store, is rendered only for the masking animation, and is not written to the app database or logs. It is IP geolocation, not GPS or device-location access.

02 / Account and contacts

No phone number, email address, contact upload, or global profile.

M2 does not create a central account that joins every Channel into one public identity. Display names are scoped to their Channel. A local alias changes how another member appears on one device without changing that member’s own name.

03 / Relay data

Delivery infrastructure processes ciphertext and limited operating metadata.

The server boundary may contain ciphertext, opaque routing identifiers, server-received time, expiry time, delivery and deletion state, and limited tombstones required for idempotent retries.

Decryption keys, plaintext messages, plaintext attachments, and Signal private keys are designed to remain outside that boundary. Attachment name, MIME type, key, nonce, and digest are carried in the E2EE envelope.

04 / Retention and deletion

Relay ciphertext is removed after verified receipt or expiry.

After the receiving endpoint decrypts and durably commits local state, it sends a signed ACK bound to the recipient mailbox and ciphertext digest. Verification starts deletion of database and object ciphertext.

Undelivered ciphertext is configured to expire from server-received time after a maximum of 48 hours. The exact production configuration and code path have been verified; a 48-hour wall-clock wait has not been recorded for this release.

05 / Generic FCM wake

Push wakes the app; it does not transport the message.

When Android notifications are allowed, FCM sends a high-priority data wake containing exactly wake_type=message and wake_version=2. It has no notification block and no Channel, member, message, sender, preview, count, attachment, mailbox, key, or Onion metadata. M2 synchronizes over Tor and creates the final notification only after durable local commit.

Google and push infrastructure can process an installation token and delivery metadata, which may link activity at the installation level. Android notification permission and system settings are the user-facing control; denying notification access leaves foreground/open Tor synchronization available.

06 / Device storage

Conversation and cryptographic state remain Passcode-scoped.

Flutter and native Signal state use SQLCipher databases excluded from backup and device-transfer paths. One ordinary Passcode gates the current interface and Android Keystore-wrapped keys. A locked vault does not background-decrypt.

There is no Format or Immediate Delete Passcode and entering a legacy destructive credential cannot erase application data.

07 / Infrastructure providers

Current production uses a small set of defined operators.

• Cloudflare Pages for this website
• Cloudflare Workers and private R2 for public release delivery, encrypted attachments, retention safety, and encrypted durable-only database backup
• Hetzner for separate production APP and private PostgreSQL DB hosts, plus the persistent v3 Onion Gateway
• Supabase retained read-only during the bounded migration rollback-observation period
• Firebase Cloud Messaging for generic wake notifications when Android notifications are allowed

The two-node architecture is not a multi-region service and does not claim a commercial availability SLA. M2 prefers explicit failure over an undisclosed fallback transport.

08 / Privacy limits

Privacy controls do not eliminate every observable signal.

• Some network or platform observers may identify use of Tor or installation of the application.
• A global observer may attempt timing and traffic-volume correlation.
• A recipient can copy, photograph, or retransmit plaintext after receiving it.
• A compromised endpoint can expose plaintext before encryption or after decryption.
• Direct APK downloads expose ordinary web-request metadata to the delivery infrastructure.

See the security model and limitations for implementation boundaries and current verification status.