Privacy Policy
App and website policy · Updated October 13, 2026
Also available as a convenience translation in Español · Português · Français. This English version governs.
Who we are and what this covers
Jaison Norton operates Midnight Select. This policy covers the Midnight Select Android and iOS alpha apps, its relay services, and this website. Android and iOS are in alpha testing. Features vary by platform and alpha build; the web client remains in development. Contact hello@midnightselect.app with privacy questions.
Midnight Select app privacy
Midnight Select is in alpha testing. The following describes the current app and relay implementation; features may vary by platform and alpha build.
Private chats and calls
Private messages, photos, voice messages, stickers, reactions, payment notes, and profile names and pictures are encrypted on your device using the Signal Protocol. Intended recipients can decrypt them; our message relay cannot read their contents. Calls use end-to-end encryption, with keys exchanged through encrypted sessions. Polls, reports you send to the Midnight Select team, and profile details (each shared only with the audience you choose) are also end-to-end encrypted.
Scheduled messages (Send later): for a one-to-one text you schedule, our relay holds the end-to-end encrypted message (one copy per recipient device) until the time you chose, at most 30 days ahead. It keeps who it’s from and to, the send time to the minute, any disappearing timer and when you scheduled it, but it can’t read the message. You can change or cancel it until then; cancelling deletes it from the relay. Once sent, it’s handled like any other message. If it can’t be delivered, it’s deleted at once and only a “not sent” note with no content is kept for 7 days. Group messages, photos and first messages to someone new wait on your phone instead.
Calls on iPhone: to ring your iPhone while the app is closed, our relay sends Apple a call wake-up that contains only a random call ID, never the caller’s name, number or account. It expires after 45 seconds, and your iPhone shows who is calling only after it decrypts the call. Our relay sees that one account asked to ring another at that moment, as it already sees the call being set up.
Disappearing messages: when a message has a timer, our relay learns when it expires (to the minute), not what it says or your timer setting. It stops delivering it at that time and deletes it within about a minute. View-once photos and videos are deleted from the relay right after they’re opened. Copies kept on backup cells follow the same disappearing time when both cells run the current version; cells on older versions may keep them for up to 30 days, and a modified cell could ignore the time.
Calls: one-to-one and group calls connect through call servers we run ourselves (LiveKit and a TURN server) on our server hosted by Hetzner in Hillsboro, Oregon, USA; no outside call service is involved. Calls are end-to-end encrypted with a key the callers exchange inside their encrypted messages, so the call server only forwards encrypted audio and video. While a call runs it sees participants’ IP addresses (with Hide my IP, calls go over Tor), a random room name (not the chat or group name), each participant’s random account ID (not the username), when people join and leave, and how much data flows. It doesn’t keep call logs: only warnings and errors are logged, in small rotating files, and rooms close two minutes after the last person leaves.
Translation and Personal AI on your phone: chat translation and Personal AI (writing help) run on your phone; your messages, prompts and the AI’s answers are never sent to us or to any AI or translation service, and nothing is logged. On Android, translation language packs (about 73 MB each) download from Mozilla’s servers only when you tap Download, and Personal AI’s open model downloads once from Hugging Face after you tap; those servers see that a file was downloaded from your network, but no account or message content. On iPhone, Apple’s system provides the translation languages, and Personal AI uses Apple’s on-device model or an optional open model downloaded once from Hugging Face. Your Personal AI style profile is encrypted on your phone with a key that never leaves it, isn’t included in backups, can be viewed, exported or wiped, and is erased with your account. Packs and models stay on your phone and can be deleted in the app. Messages sent by iPhone’s optional Autopilot always show recipients that an AI assistant is replying.
Offline mesh (preview, off by default): when you turn it on and the app is open, messages to people you already chat with (texts, and photos, voice notes and files up to 3 MB) can travel through nearby Midnight Select phones over Bluetooth or Wi-Fi when there’s no internet. Phones that carry a message keep it only in memory, for at most 72 hours, and never save it. They can’t read it or tell who sent it, but they can see that a message exists, its size, when it expires, how many phones it has passed through, and a recipient tag that changes with every message. Limits: someone who already has a person’s public key could test whether a message is for them; a carrier may tell that two messages belong to the same conversation (not whose); the first phone to receive a message can tell that the phone it came from wrote it; and nearby devices can see that a mesh-enabled Midnight Select phone is around. First messages to someone new, larger videos, view-once media, group media and Updates never use the mesh. Nothing about the mesh is sent to our servers.
Offline calls and Meet in person: offline voice calls connect two nearby phones directly over Wi-Fi, with no call server. The other phone sees your phone’s local network address, and the Wi-Fi network can see that two devices are exchanging encrypted audio, not what’s said. Meet in person shows a QR code with your public keys; anyone who can see your screen can read your account ID and @username from it. Nothing from it is sent to our servers.
Updates
You choose who sees each update and how long it lasts: 24 hours (the default), 36 or 48 hours at most.
Updates shared with your contacts, or only some of them, are end-to-end encrypted like private messages: each person gets their own encrypted copy, and our relay can’t read them. Each recipient’s app removes the update when its time is up (older app versions remove it after 24 hours). This is done by the apps, so a modified app could keep a copy. Deleting one removes it from your phone; copies already delivered stay on recipients’ phones until their time is up. Undelivered copies and their attachments are removed from the relay on delivery or after 30 days.
Updates shared with Everyone are public posts and are not end-to-end encrypted: the text, style, caption and media are stored on the Midnight Select server that is your home relay, and our relay can read them. Only signed-in Midnight Select users can see them, never people you’ve blocked, and they aren’t on the web. They last for the time you choose: 24, 36 or 48 hours. When one expires (removed within about 10 minutes), when you delete it, or when you delete your account, the post and its media are removed from the server. Copies someone already downloaded to their phone can’t be recalled.
Highlights: you can add an update to your profile as a highlight and choose who sees it (“Everyone I chat with”, “Mutual interest and up” or “Contacts only”). This doesn’t follow the original update’s audience. Strangers and people you’ve blocked never see highlights. They’re kept on your phone (up to 12) and shared only inside your end-to-end encrypted profile, so our server can’t open them, even for an update that was public. Highlights don’t expire. You can remove one at any time, though anyone who already viewed it may have kept a copy. The old encrypted file on our server is no longer used and is deleted within 30 days.
Our server’s daily backups are kept for 7 days. Occasional safety copies made before server updates are kept until we delete them, and may include deleted updates until then.
We don’t keep lists of who viewed an update; “seen” marks exist only on phones. Replies to an update are ordinary end-to-end encrypted messages. Privacy blur runs on your phone and covers faces before a photo is encrypted or posted; it can miss faces, so check before you share.
Information our relay services keep
| Information | Purpose | Retention |
|---|---|---|
| Random account ID, public keys, and login-token hash | Account authentication and message delivery | Until account deletion |
| Username | Let friends find your account | Until changed or account deletion |
| Queued encrypted messages, sender ID, time, and size | Store-and-forward delivery | Deleted on receipt acknowledgement; at most 30 days, or at the message’s disappearing time if sooner |
| Encrypted attachments | Photo and file delivery | At most 30 days |
| Keyed phone-number hash, if a number is added | Prevent repeated account creation and abuse | Retained after deletion for abuse prevention; no fixed deletion period. The relay does not store the number itself. |
| Hash of a random per-install ID | Prevent duplicate accounts | Until account deletion |
| Vouches, trust level, and Founding badge status | Verification tiers and Founding program | Until account deletion |
| Communities published to Discover: name, handle, description, join rules, and chosen area | Public community discovery | Until community or account deletion |
| Apple push token (iPhone) or the UnifiedPush address you chose (Android), and your chosen alert sound, one per account (your most recent phone) | Generic new-message wake-up, without sender or message content | Until you turn alerts off, the token or address stops working, the device changes, or account deletion |
| Scheduled messages: encrypted copies, sender and recipient IDs, send time, optional timer | Send later for one-to-one text | Until sent or cancelled (at most 30 days); a “not sent” note without content for 7 days if delivery fails |
| iPhone call token (Apple PushKit), one per account | Ring your iPhone for incoming calls, with only a random call ID | Until you turn ringing off, sign out, recover or move your account, the token stops working, or account deletion |
| Cell operator links: which cell ID you linked and when | Cell operator badge and DUST sponsorship | Until you unlink the cell or delete your account |
| Online minutes per linked cell, per day (stored by cell ID) | Cell operator certification and sponsorship | 400 days |
| Cell operator certification date | Badge shown when others look up your username | Until account deletion |
| One-time cell activation and link codes (stored only as hashes) | Linking a cell to your account | 10 to 15 minutes, or until used |
| Short-lived call relay (TURN) credentials, not tied to your account ID | Connecting calls | Minutes |
| Data carried through cell tunnels, per cell, rounded and delayed | Operate the network | Aggregate only, without account identifiers |
| Daily aggregate service counts | Operate the service | Retained without account identifiers |
Network information, contacts, and location
The message-relay application does not write IP-address logs. Abuse rate limits use short-lived counters in memory. Infrastructure and call services must process network addresses to connect devices. During a call, the call server and its call relay see your network address and call room, unless Hide my IP is on, in which case they see a Tor address. They cannot decrypt end-to-end encrypted audio or video, and the call relay keeps no logs. This policy does not promise that all infrastructure is free of operational logs.
Hide my IP (optional, off by default): the app can run Tor on your phone and send its relay, call, Midnight test-wallet, and link-preview traffic through the public Tor network, so our cells and call servers see a Tor address instead of yours. Your network can see that you use Tor. Map tiles, Cardano wallet lookups, links you open in your browser, and Apple push notifications do not go through Tor. A “Through cells” option (not available yet; it needs a second public cell) sends message traffic through a second cell, which sees your IP address but only encrypted data. In that mode, calls and the Midnight test wallet connect directly, and no link previews are made; only the Tor option covers calls. Hide my IP does not make you anonymous.
AI community hosts: Official communities have an AI host, always labeled as AI. Messages posted in those communities are read by the host so it can reply. The host’s AI runs on confidential computing via Chutes on the Bittensor network, which is checked to be sealed before every use, or on an open model on a Midnight Select cell. Your private chats and other communities are never sent to an AI host.
Link previews (on by default; Privacy & safety): when you send a link with previews on, your phone fetches the page’s title and image to build the preview. With Hide my IP through Tor this goes through Tor; otherwise the website sees your connection. If Hide my IP is on but not connected, no preview is made. People you send it to never contact the website; they see only what your phone included. You can turn previews off in Privacy & safety.
If you allow it, the app reads your contacts on your phone, for example to show names on texts. Contacts are never uploaded, and there is no server-side contact discovery. Invite texts are written and sent by you from your phone; we never send them for you. We do not upload your device location. “Near me” and map features operate on your device. Area eligibility uses a yes/no answer you select; the area you choose when publishing a Discover community is public. We do not add advertising or third-party analytics to the app, and we do not sell app personal information.
Wallet and blockchain
The wallet is non-custodial: private keys remain on your device, and we cannot move your funds. The alpha wallet uses Midnight test networks only, with no real-money assets. Transaction visibility depends on whether the supported asset and transaction are shielded or unshielded under Midnight’s rules. Public blockchain records cannot be erased through app-account deletion. Account deletion is not a transfer of wallet assets. If you share a wallet address, in your profile or when someone uses “Ask for their address”, the people you share it with can see that address, and payments to a public (unshielded) address can be seen by anyone on the test network.
Ordinary SMS and MMS
If you choose Midnight Select as the default text app on Android, ordinary SMS/MMS messages are stored on your phone and delivered through your mobile carrier. They are not end-to-end encrypted private chats and are not sent to our private-message relay. Each message is labeled: “Shield” for an end-to-end encrypted Midnight Select message, “SMS” or “MMS” for a carrier message. The app never switches a Shield message to SMS on its own.
Founding program and service providers
If you link an app account to a website signup, the relay requests your invite code, Founding place, email-confirmation status, and confirmed referral counts from the website for Founding eligibility. Your email address is never shared with the app. Website email handling is described below. Our relay and call infrastructure process the technical information needed to deliver their services. Push alerts are optional. On iPhone, Apple delivers them: our relay sends Apple the same generic alert every time (“Midnight Select”, “New message”) with the alert sound you chose, never the sender, message text or chat, so Apple can see that an alert was sent, when, and the sound name. On Android, if you choose a UnifiedPush app (such as ntfy), our relay sends an empty wake-up to the address that app gave you, at most once every 10 seconds; the push service you chose can see that a wake-up was sent and when. Google services are not used for this. Your phone then fetches your encrypted messages and decrypts them itself. If you don’t set up push, nothing about your alerts is sent to anyone else. Carriers handle SMS/MMS. The Tor network carries your traffic only when you turn on Hide my IP. Midnight infrastructure handles submitted blockchain transactions according to network rules.
Reports
When you report someone, the app sends an end-to-end encrypted message to the official @midnightselect account with the reason, the reported username and account ID, up to 10 messages you choose, and your note. The Midnight Select team (the operator and any moderators he designates) reads reports to review them and act on abuse. We keep a report until it is resolved and delete it within 90 days after that, unless we need it longer, for at most one year, to meet a legal obligation or to stop repeated abuse. Blocking happens on your phone and is not sent to us.
Your choices and deletion
You can delete messages, set disappearing-message timers, block or report people, leave communities, make an encrypted chat backup that only you can open with its code (we never receive it), and request deletion of your private-chats account. See Delete your Midnight Select account for in-app steps, an external email request, and the information retained after deletion. Messages already delivered to other people’s devices are outside our control. Newsletter unsubscribe and signup deletion are separate choices.
Security and children
The app code is licensed under AGPL-3.0. Public source availability is planned for launch. An independent security audit is planned before public launch, with results to be published. No system guarantees absolute security or anonymity; devices, recipients, carriers, and infrastructure can still reveal information.
You must be 13 or older to use Midnight Select, and you confirm this with a checkbox when you sign up; we don’t ask for your birthdate. We don’t knowingly allow accounts for children under 13. Contact us if you believe a child under 13 has provided personal information. Adult Community 18+ requires age verification.
Website and newsletter privacy
Information you provide
We collect your email address, optional first name, and optional platform interests (Android, iOS, and Web) when you request updates. We record the signup source, consent time, and version of the consent notice. Each signup gets a random invite code, and if you joined through someone’s invite link we record their invite code so referrals can be counted. We do not collect the names or contact details of people you invite; invites are sent from your own email or messaging app. If you link the Midnight Select app to your signup with a one-time code, the website shares only your invite code, your Founding place in confirmed-signup order, whether your email is confirmed, your confirmed referral counts, and the invite code of whoever invited you. Your email address is never shared with the app. Existing waitlist records may contain an email, name, signup source, and submission time.
How we use information
We use signup information to manage interest in the alpha, send updates you request, and invite eligible testers. Platform interests help us tailor platform announcements and testing invitations. General development updates may go to all confirmed subscribers. We do not sell website signup information. Confirmed signups get a download link for the platforms that are open to testers, and an invite code to create an account.
Service providers
The website is hosted on Cloudflare, including a database for signup records. Resend delivers our confirmation messages and updates; we keep your subscription, unsubscribe, and suppression records ourselves on Cloudflare. MailerLite was our previous email provider; we are closing that account and keep only the unsubscribe and suppression records needed to honor your choices. Proton Mail provides our general-contact mailbox, hello@midnightselect.app, and newsletter-reply mailbox, update@midnightselect.app. These providers process information needed to operate their services and may process it outside your country.
GIF search: when you search for GIFs in the app, our server sends only your search words to GIPHY (Shutterstock) to find matching GIFs. GIPHY never receives your IP address, account or device. GIFs you send travel as encrypted attachments, like photos.
Security and technical information
Hosting providers may process IP addresses and request information for delivery and security. Our signup protection uses short-lived keyed hashes of your IP address and email to limit abuse; it does not store raw IP addresses in the signup database. Expired rate-limit records are removed when subsequent signups are processed.
Analytics and cookies
This website does not add advertising trackers or optional website analytics. Hosting access controls may use essential cookies. If you open an invite link or sign up, your browser stores the relevant invite code in its local storage so a referral can be credited; it is not sent anywhere until you submit the signup form. Email delivery, bounce, and unsubscribe information is used to operate the mailing list. Optional email open and click tracking should remain disabled unless we update this notice and the relevant choices.
Your choices
Confirm your email to receive newsletter updates. You can unsubscribe using the link in each marketing email. To request access, correction, or deletion of your signup information, contact hello@midnightselect.app. Unsubscribing stops marketing messages; minimal suppression information may remain to honor that choice.
Retention
We retain signup information while it is needed for the prelaunch program, requested updates, or consent and suppression records. You can ask us to delete information that is no longer needed. We review records as the program changes. No internet service can guarantee absolute security.
Changes and contact
Updates to this notice will appear here with a revised date. Questions can be sent to hello@midnightselect.app.