Privacy Policy
Last updated 16 October 2026
mymomo is built so that we cannot read what you send. This page says exactly what our servers can and cannot see, in plain language. The encryption uses standard, published algorithms (X25519, XChaCha20-Poly1305), and you can verify your connection with your partner in the app: Settings → Safety number shows a code on both phones that matches only if nobody is in between.
What is end-to-end encrypted
Everything you and your partner send each other — messages, captions, photos, voice notes, stickers, status text, profile pictures, the countdown date — is encrypted on your phone with a key that only your two phones hold. Our servers relay the encrypted data and delete it as soon as your partner's phone confirms receipt. We cannot read it, and neither can anyone who compels us to hand it over: there is nothing readable to hand over.
What our servers do see
| Data | Why | Kept |
|---|---|---|
| Your sign-in identifier (Apple or Google) | To recognise your account. On iPhone you sign in with Apple; on Android you sign in with Google. From Apple we ask for nothing but an account identifier — no email, no name. Google's sign-in always includes your Google email address and name in the sign-in token your phone sends us; our server checks that token, keeps only Google's account identifier, and throws the rest away — it is never stored or logged. Signing in with Google also shares the usual sign-in information with Google, under Google's privacy policy. For Apple sign-in we also keep a token Apple gives us, used only to revoke your sign-in when you delete your account. | Until you delete your account |
| Your public key | So your partner's phone can derive the shared key. It cannot decrypt anything. | Until you delete your account |
| Push notification token | To notify your partner's phone. Notifications say things like "Momo sent you a sticker" — never the content. | Until you sign out, delete, or it stops working |
| Timezone, working hours, a city you type in, a mute-until time if you set one, and the notification sound you pick | To show your partner your local time and whether you're probably at work, and so that a message from them plays the chime you chose on your phone. All self-declared; never read from your device's location or calendar. Notifications are never held back: a message from your person arrives the moment it's sent. | Until changed or deleted |
| The nicknames you give each other | So notifications can say "Momo" instead of your account name. | Until changed or unpaired |
| Which momo you picked | So your partner's phone can show your momo beside theirs, and so a notification can carry the right one. Before you pair, whoever holds your invite code can also see which momo you picked, so they can choose theirs to match. It is one of two characters, stored as "boy" or "girl" (the names of the two momos), and nothing else about you. | Until you change it, or delete your account |
| Message metadata: sender, type (text / photo / sticker / voice note / game…), timestamps and size, and which message types your app version can open | To deliver messages, and so we never send your phone a kind of message it can't read yet (we keep only the latest list for your app). Never the content: we cannot read it. | Until delivered (max 30 days); the app-version list until it changes, you unpair, or you delete your account |
| Daily numbers for the two of you, only if you both choose to share usage counts | Per day, per pair, as numbers only: how many things each of you sent and of what kind, whether each of you was active, whether you both sent something, whether you both added today's photo, whether your two phones were connected at once, and how long replies took (we keep the gaps between sends for up to 30 days and reduce them to a daily median); and a simple weekly activity score worked out from these numbers. It tells us whether mymomo helps. Never the content, never used for ads or to decide anything about you. Off unless you both turn on Settings → Privacy & data → Share usage counts; either of you can turn it off. | While you're paired and sharing; deleted when you unpair. Reply-time detail: 30 days, then only the daily median. |
| A blurred colour preview of the daily photo | A tiny, heavily blurred colour preview (a "blurhash") rides in the plaintext header of a daily photo so your partner's phone can show the locked tile before it downloads the photo. It is a handful of averaged colours, not a recognisable image — never the photo itself, which stays end-to-end encrypted. | With the message, until delivered (max 30 days) |
| Encrypted media files | Held only until your partner's phone downloads them. | Deleted on download; at most 30 days. |
| App usage counters, only if you choose to share them | Once a day the app can send counts — sessions, screens opened, stickers sent, whether notifications are allowed, how often it reconnected — so we can see what works. Counts only; nothing you wrote or sent. Off until you say yes when the app asks; change it any time in Settings → Privacy & data → Share usage counts. Until you do, our server keeps nothing it receives. | 90 days |
| Optional profile answers | If you choose to tell us an age bracket, when your relationship started, how far apart you are, or how often you meet, we use it to understand who the app is for. Every question has "prefer not to say". Your partner never sees these. | Until you change or clear them, or delete your account |
| Whether notifications and the connection work | Per day, per pair: how many notifications we sent, how many we held back because the app was already open, and how many failed (for example on a phone that uninstalled the app); how many times the app connected; and how many bytes of encrypted media passed through. It tells us when delivery is broken, which is the one thing we cannot learn from encrypted traffic. Counts only: never who sent what, never the content. A receipt id from the push service is kept for a few minutes to check a notification was accepted, then dropped. | Counts: while paired; deleted when you unpair. Receipt ids: minutes. |
| Reports and blocks you file | To keep you safe: a report holds only the reason you pick and any note you write; a block stops that person pairing with you. | Reports: 12 months. Blocks: until you delete your account. |
| Technical logs | To run and secure the service: hashed account and pair ids, which feature was used, and timings. Never message content, never request bodies. | Up to 7 days |
That table is the whole list. We also keep day-by-day totals across all couples, in which no pair or person appears. If we start keeping something new, it appears here before it ships.
Read receipts
Read receipts (blue ✓✓) are on and can't be turned off — mymomo is a two-person app, so 'seen' is reassurance, not pressure. A read marker is sent only while the thread is open and the app is active, and it is end-to-end encrypted: the relay sees that an encrypted marker passed, never which messages it covers.
Crash and diagnostic data
mymomo never sends crash or diagnostic data automatically. If you choose 'Share diagnostics', the app creates a content-free technical log — error types, code locations, timings, app/OS version, and non-reversible hashed identifiers only. It never contains messages, photos, voice notes, contacts, or encryption keys. Nothing is shared unless you tap Share.
Links you send
When you paste a link, your phone fetches that page to build a preview, so that website sees your phone's IP address, as with any visit from a browser. Our servers never see the link.
What we never collect
- Your location. Never — not in the background, not as a feature.
- A record of when you type or when you were last active. Your person sees “…typing” while you type in an open chat; our server passes that along live and never keeps it.
- Your contacts, your photo library, or anything outside what you explicitly send.
- Advertising identifiers. There are no ads and no trackers.
Where your history lives
Your conversation is stored on your phone, in the app's protected storage. On iPhone it is included in your iCloud Backup if you have that turned on, and is then protected the way Apple protects your backup (end-to-end only if you have enabled Advanced Data Protection). On Android, mymomo turns off system backup, so your history is never copied off your phone. We do not keep a copy.
When you unpair or delete your account
Either partner can end the pairing alone, immediately. When that happens, everything the server holds for the pair is deleted at once, and each of you keeps only what you yourself sent: what the other person sent is removed from each phone. Deleting your account (Settings → Delete account) removes your account and everything we hold about you at once, including the blocks you made. If you signed in with Apple, it also revokes mymomo's access to your Apple ID; if you signed in with Google, it removes mymomo's access to your Google account. Only reports you filed are kept, for 12 months. If someone else blocked or reported you, their record keeps your sign-in identifier so it can keep protecting them: a block for as long as their account exists, a report for 12 months.
Safety
You can block and report from the pairing screen without pairing first. Reports contain only the reason you choose and any note you write; we cannot include message content because we cannot read it.
Our website and the Android waitlist
mymomo.love has no ads, no analytics and no tracking cookies. If you join the Android waitlist, we keep your email address and the date you signed up, for one reason only: to email you when mymomo is on Android. We send that one email and nothing else, and we never share or sell the list. It is stored with Cloudflare, which runs the website. We delete the list once that email has gone out. To be removed sooner, email manas@mymomo.love and we'll delete your address.
There's no tracking on our site or app, so we treat every visitor as if Do Not Track were on.
Who we share data with
Nobody, except the infrastructure needed to run the service: Cloudflare (servers, storage and logs; for your messages, only encrypted data), Expo, Apple and Google (push notification delivery — token and notification text only: Apple's APNs on iPhone, Google's Firebase Cloud Messaging (FCM) on Android), and Apple (sign-in on iPhone) and Google (sign-in on Android). Like any server, Cloudflare sees your IP address when your phone connects; we don't store it. We do not sell or share data with anyone else.
Children
mymomo is not for children under 13. It is rated for ages 13 and up; people aged 13 to 17 may use it. We do not knowingly collect data from anyone under 13, and if we learn we have, we delete it.
Changes
If this policy changes in a way that matters, the app will tell you before the change takes effect, and ask you before anything retroactive. If a breach ever affects you, we'll tell you without delay.
Contact
Questions about privacy: email manas@mymomo.love. You can also send feedback straight from the app.