Mishkat
Privacy Policy
Last updated: April 13, 2026
Mishkat ("we", "us", "our") is a private, end-to-end encrypted messaging application. We built Mishkat with a single principle: collect as little data as technically possible. This Privacy Policy explains what information we process, why, and how we protect it.
1. Information We Collect
1.1 Information stored on your device only
The following data is generated and stored exclusively on your device and is never transmitted to our servers:
- Private key — Your secp256k1 private key, stored in the iOS Secure Enclave / Keychain via
expo-secure-store. - Contacts & nicknames — The contact list you build inside Mishkat, including nicknames you assign.
- Messages — All plaintext message content. Messages are encrypted on your device before transmission; we never have access to the decrypted content.
- Call history — Records of calls you make or receive.
- Media — Photos and images you share are encrypted before sending.
- Avatar — Your profile picture, stored locally.
- PIN & biometric settings — Your app lock configuration.
1.2 Information processed by our relay server
Our server acts as a lightweight relay to deliver messages and call alerts. It processes:
| Data | Purpose | Retention |
|---|---|---|
| Public key | Routes messages to the correct device | Stored while you are registered; deleted when you clear data in the app |
| Push notification token (Expo push token) | Delivers push notifications via Apple APNs | Stored while you are registered; deleted when you clear data in the app |
| VoIP push token | Wakes the app for incoming calls via Apple PushKit | Same as above |
| Encrypted message payloads | Forwarded to the recipient in real-time | Not stored. If the recipient is online, the message is forwarded immediately. If offline, it may be queued briefly in memory and discarded after delivery. |
| WebRTC signaling data (SDP, ICE candidates) | Establishes peer-to-peer call connections | Not stored. Forwarded in real-time and then discarded. |
1.3 Information we do NOT collect
We never collect, store, or have access to:
- Your name, phone number, or email address
- The content of your messages (they are encrypted before leaving your device)
- Your contacts or address book
- Location or GPS data
- Device identifiers for advertising (no IDFA, no GAID)
- Analytics, crash reports, or usage telemetry
- Browsing history or app usage patterns
2. How We Protect Your Data
2.1 End-to-end encryption
Every message, photo, and file is encrypted on your device using secp256k1 elliptic curve Diffie-Hellman (ECDH) key exchange before being transmitted. The relay server only ever sees ciphertext — encrypted data that it cannot decrypt.
2.2 No-account architecture
Mishkat does not require you to create an account, provide a phone number, or give an email. Your identity is a cryptographic key pair generated on your device during onboarding. The private key never leaves your device.
2.3 Key storage
Your private key is stored in the iOS Keychain via Apple's Secure Enclave technology (accessed through expo-secure-store). This is the same hardware-backed secure storage used by Apple Pay and Face ID.
2.4 Transport security
All connections between your device and our relay server use TLS 1.2+ encrypted WebSocket connections. The app does not permit cleartext HTTP traffic (NSAllowsArbitraryLoads is set to false).
2.5 Zero-knowledge relay
Our relay server's sole function is to forward encrypted payloads between devices. It has no ability to decrypt, read, or analyze the content of any message or call. The server:
- Does not store message content
- Does not log who messages whom (no metadata logging)
- Does not perform content analysis or scanning
- Cannot comply with a decryption order because it does not hold decryption keys
2.6 Disappearing messages
When enabled, messages are automatically deleted from both devices after the timer expires (configurable from 30 seconds to 4 weeks). Once deleted, the messages cannot be recovered.
2.7 App lock
You can protect the app with a PIN code and/or biometric authentication (Face ID / Touch ID). When locked, no message content is accessible even if someone has physical access to your unlocked phone.
3. Third-Party Services
Mishkat uses the following third-party services to function:
| Service | Purpose | Data shared |
|---|---|---|
| Apple Push Notification Service (APNs) | Delivers push notifications when you receive a message or call | Device push token only. Apple does not receive message content (notifications contain a generic "New encrypted message" body). |
| Expo (expo.dev) | Push notification infrastructure & OTA updates | Expo push token. No message content is shared with Expo. |
| Render (render.com) | Hosts our relay server | Encrypted message payloads traverse Render's infrastructure. Render has no access to message content as it is end-to-end encrypted. |
We do not use any advertising SDKs, analytics services, crash reporters, or social media trackers.
4. Voice & Video Calls
Calls use WebRTC for peer-to-peer encrypted audio and video. The relay server only forwards the initial signaling data (SDP offers/answers and ICE candidates) needed to establish the connection; once connected, media flows directly between devices. Call content is never processed or stored by our server.
On iOS, incoming calls use CallKit and PushKit VoIP to display native call UI. This is required by Apple for VoIP applications and does not expose call audio to Apple.
5. Data Deletion
You are in full control of your data:
- Delete your data: Go to Settings → Clear All Data in the app. This permanently deletes all local data (messages, contacts, keys, call history) and removes your public key and push tokens from our relay server.
- Delete the app: Uninstalling Mishkat deletes all locally stored data. Your public key and tokens on the relay server will become orphaned and will be cleaned up automatically.
There is no "account" to deactivate — once your data is cleared, there is no trace of your identity on our server.
6. Children's Privacy
Mishkat is not directed at children under 13. We do not knowingly collect any information from children. Since Mishkat collects no personal information at all, there is no children's data to protect or delete.
7. Data Transfers
Our relay server is hosted on Render in the United States. The only data that reaches the server is your public key, push tokens, and encrypted message payloads. Since message content is end-to-end encrypted and we have no ability to decrypt it, the privacy risk of this transfer is minimal.
8. Law Enforcement Requests
If we receive a valid legal request, we can only provide what we have: your public key and push notification tokens. We cannot provide message content, contact lists, call history, or any decrypted data — we simply do not have it.
9. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.
10. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, reach out and we'll get back to you.