Privacy, in plain words.

Private beta policy · 21 October 2026

What the app handles

The iMessage extension lets you choose media through Apple's picker. It encrypts selected media on your device with AES-256-GCM before upload. The service receives ciphertext, random message identifiers, access credentials, a random sender account identifier and timestamps. The decryption key travels in the iMessage invitation and is never sent to the media API.

Without a private recipient code, anyone holding the full invitation can open it while available. In version 0.4, senders can require a separate random private code. The code is used to derive the media encryption key and is sent over HTTPS for access checks; the service stores only a message-specific hash and failed-attempt counters. Share it through a separate trusted channel. Anyone with both the invitation and code can open the moment: this checks possession, not a person's identity. Optional watermark text is inside the encrypted media envelope and is displayed over the media; it can be cropped or removed by a modified client.

Timers and retention

The first explicit open starts one 10, 30 or 60-second window shared by all recipients. Unopened uploads expire after 24 hours. Future downloads stop at expiry or sender revocation. The service removes ciphertext from active storage during cleanup, normally within 15 seconds of expiry. Capability hashes and timing metadata are removed after seven days. Expiry does not promise forensic erasure from hardware.

The app closes the viewer when its countdown ends, when it goes into the background, or when it detects recording. Screenshot detection happens after capture. Your original in Photos and any copies others capture remain outside this timer's control.

Capture reports and optional alerts

Version 0.4 viewers attempt to report detected screenshots and active recording or mirroring while a moment is displayed. The report contains its identifier, read credential and private recipient code if required, but no photo, video or encryption key. The service stores the event kind and receipt time with the sender account for up to seven days after upload. It also records creation, first opening and revocation in sender activity history. Reports are claims from the viewer, not verified proof of who captured media; they can be missed, delayed or falsified by modified clients. No report does not mean no capture happened.

Offline reports are queued in the device-only Keychain for up to seven days after detection and retried while the extension runs. If the sender enables revoke after capture, the service blocks future downloads when it receives a report. Existing copies cannot be erased.

Push alerts are optional. The companion app asks for notification permission and registers an Expo push token against your sender account. Apple and Expo process push delivery. Notification payloads contain generic alert text with no media, keys, codes or recipient details. Tokens expire from our active storage after 30 days without renewed registration; queued delivery records expire within 24 hours. Disable alerts or disconnect in Activity & alerts to remove this device registration. Deleting or suspending sender access removes its registrations and queued alerts. Delivery is not guaranteed.

Device and hosting data

Each invited sender receives a personal access code. The service stores its hash and a random account identifier, plus upload counts for quota enforcement. Account records remain while beta access is active or suspended. Delete sender access in the app removes the sender credential and revokes its media. Message metadata still follows the seven-day limit and report records the 30-day limit. Contact support for other deletion requests. Sender access codes, blocked sender identifiers, private recipient codes, pending capture reports and revocation credentials are stored in the device-only Keychain. The companion saves its separate sender connection and push registration there too. Uninstalling the app is not a guaranteed Keychain reset. Apple handles iMessage delivery and app distribution. The company uses its hosting infrastructure and Cloudflare to serve HTTPS traffic; those services process network information such as IP addresses. The media API does not log request bodies, authorization headers or decryption keys. There are no ads, analytics SDKs or tracking pixels in this app.

Reports and blocking

Report this moment sends its identifier and a selected reason to the beta operator. The service associates the report with the sender account. Reports contain no photo, video or encryption key and are retained for up to 30 days, including after review. A report does not automatically suspend anyone. Operators can disable an abusive sender and revoke future access to their media.

Blocking stores the sender account identifier on this device and prevents the app from opening that account's moments. It does not stop iMessages, sync to your other devices or recall downloaded copies. Use Apple's Messages controls to block communications too.

Your choices

Choose Recent moments and private codes in the extension to stop future access to a sent item. To request help or deletion, contact hello@misterbusinessenterprises.com. Include the message identifier if available, rather than the complete invitation or encryption key. We cannot erase copies held by recipients.