Dead Drop Privacy Policy

Effective: 1 October 2026
Who we are: Critical Mass Labs LLC, Alliance, Ohio, USA ("we", "us")

Dead Drop is a private messaging app for iPhone. This page says, in plain words, what the app keeps on your phone, what our servers can see, and what we never collect. If anything here is unclear, write to chris.heffernan@criticalmassforge.com.

1. No account, no phone number, no name

Dead Drop has no sign-up. You never give us a phone number, an email address, a name or a password. When you open the app it creates an identity on your phone: a cryptographic key pair and a mailbox address. Both are made on the phone and stored in the iOS Keychain behind your Face ID or passcode. We never receive them.

Your contact code is a short string built from your public key and your mailbox address. You share it yourself, by QR code or by pasting it. Nothing about your contacts is ever sent to us: no address book upload, no list of who you talk to.

2. How a note travels

Every note is sealed on your phone before it leaves, using keys only you and the other person hold. The servers in the path carry sealed bytes and a mailbox address. None of them can read a note, and none of them learn your name because they never had it.

There are two roads. Which one a note takes depends on the other person's contact code, and the servers on either road see only what is listed here.

The relay (a server we run, hosted on Railway). It receives a sealed packet addressed to a mailbox address, holds it until the recipient's phone collects it, and hands it over. The relay sees: the mailbox address, the sealed packet, and the internet address your phone connected from at the time, as any web server does. It cannot open the packet.

What our hosting provider records. Our own server code keeps no record of who connected. Railway, the company that hosts the relay, the mixnet nodes and the mailboxes, keeps a standard access log for every request to any of them: the time, the result, how long it took, how many bytes moved, your phone's public internet address, and the app's name. It keeps these for 30 days. Those logs never contain the body of a request, so they never hold a mailbox address, a sealed packet or a note. The app is built so that every request looks the same in that log: one address path, one result code, one size, whether it sent a note, checked for one, or found nothing, and the checks are spaced irregularly rather than on a fixed beat. What the log still shows is that a phone at a given internet address used Dead Drop at a given time. This is the normal condition of any app with a server; we say it plainly rather than hide it, and removing the address itself from that log is on our list.

The mixnet (three routing hops operated with ASYMMETRY, reached through asymmetria.io). Your phone wraps the sealed packet in three layers of routing encryption and every packet is padded to the same fixed size. The first hop sees that a packet arrived from your connection; the middle hop sees only the hops on either side; the last hop sees the mailbox address it is for. No single machine sees both where a packet came from and where it is going, and none of them can read it.

The app also makes two small public requests: a health check to the relay and a directory fetch from asymmetria.io, so it can show you whether each road is open. These carry no identity and no message data.

3. What our servers store

• Sealed packets, addressed to a mailbox address, until the recipient's phone collects them. Each note carries a delivery window inside its sealed envelope (24 hours), and the receiving phone refuses to open a note past that window. A packet nobody collects is deleted by the relay, and by the mixnet mailboxes, after 24 hours (the servers’ default retention).
• A push token, only if you turn alerts on (see section 4). Deleted when you turn alerts off.
• Nothing else. No profile, no contact list, no message history, no plaintext of anything, ever.

4. Notifications, if you turn them on

Alerts are off by default. If you switch them on, the relay keeps an Apple push token for your mailbox. When a packet lands, the relay asks Apple to wake your phone with a blank "New message" alert. The alert carries no sender and no content, on either road; a note that travelled the mixnet triggers the same blank alert, because the mixnet's last stop tells the relay only which mailbox received something.

The cost, stated plainly: while alerts are on, the relay and Apple can together connect your mailbox address to your device. Turn alerts off in Settings and the relay deletes the token. Apple's handling of push notifications is covered by Apple's own privacy policy.

5. No telemetry

The app sends no crash reports, no usage metrics and no analytics to us or to anyone else. The only things that ever leave your phone are sealed packets, the public health checks described in section 2, and, if you turn alerts on, a push token. If a build is broken, we learn it from you or from Apple's own TestFlight and App Store crash reporting, which you control in your iPhone's Privacy settings.

6. Your recovery phrase

Every new identity is born from twelve words. The words are made on your phone, kept in the Keychain, shown only after Face ID, and never sent anywhere. Nobody, including us, can recover them if they are lost. Anyone who reads the words holds the identity, which is why the app never copies, shares or types them for you.

7. Disappearing notes

Each contact has a timer: off, an hour, a day (the default) or a week. It travels inside every sealed note you send them. Your copy is deleted when the time is up; theirs is deleted the same time after they first open the conversation. This is a promise between two copies of the app, not a law of physics: a screenshot, a phone running an older build, or a device backup made before the time is up keeps a copy.

8. Screenshots

A screenshot taken inside a conversation shows a notice on your own phone; nobody else is told. The app switcher always shows a cover, never a conversation. An optional setting blacks out screenshots and recordings inside the app; it relies on an iOS behaviour Apple has not promised to keep, and it never covers your code page or a safety number. Nothing on any phone can stop a second camera or a recording made by another device.

9. Delivery marks

When this feature is on, your phone sends the other person one sealed packet saying a note arrived or was opened. It goes only to that person, sealed like any note; the servers cannot read it. You choose in Settings whether your phone sends these marks at all. Out of the box, "arrived" marks are on and "opened" marks are off; both are switches in Settings.

10. What we do not do

• No analytics on who talks to whom, when, or how often.
• No contact list or address book upload.
• No advertising, no ad identifiers, no tracking across apps.
• No sale, rental or sharing of data with data brokers.
• No reading of your notes. We cannot; they are sealed before they reach us.

11. Permissions the app asks for

• Face ID, to unlock the app. Handled by iOS; the app learns only whether the unlock succeeded.
• Camera, to scan a contact's QR code, or to take a picture for your vault. A scanned code is never stored or sent; a vault picture is sealed on your phone and never leaves it.
• Photo library, only when you choose a picture for your vault. The app reads the one picture you pick, seals it into the vault, and never sends it anywhere.
• Notifications, only if you turn alerts on (section 4).

12. Subscriptions

Dead Drop Pro is a paid tier that adds room (more identities, the vault, screenshot black-out); Free keeps every security property. Billing goes through Apple's in-app purchase. Apple handles your payment details, receipts and refunds; we never see your card, your Apple ID or your receipt. Your phone checks its Pro status with Apple, not with us, so buying Pro creates no account and links nothing to your mailbox. The Terms of Use at https://asymmetria.io/dead-drop/terms set out the subscription itself.

13. Children

Dead Drop is for people aged 17 and over. We do not knowingly collect anything from anyone younger, and since the app collects no personal information there is nothing for a parent to ask us to delete from a server. Deleting the app removes the identity from the phone.

14. Your choices and your data

Everything personal lives on your phone. You can delete any message, a whole conversation, or the identity itself from Settings, and deleting the app removes it all. There is no server copy to request or erase, apart from a push token you can remove by turning alerts off and any sealed packets not yet collected, which nobody can read.

15. Changes to this policy

If we change what the app collects, we will change this page and the date at the top, and the in-app Disclosure will say the same thing. Material changes will be pointed out inside the app.

16. Contact