Privacy policy
The short version: we built Pigeon so that we can't read your messages, don't need to know who you are, and keep as little as the service needs to work.
Version 1.1, 24 October 2026. This policy covers the Pigeon app, Pigeon's servers and this website, run by [LEGAL ENTITY NAME]. It describes how Pigeon currently works, and marks what is planned rather than built. Version 1.1 corrects version 1.0 where it was less exact than the software; it doesn't collect or keep anything new.
What we don't have
These are ruled out by how Pigeon is built, not by a promise to look away.
- Your messages, photos and files. They're encrypted on your device, and only the people in the conversation hold the keys. Our servers store and pass on sealed envelopes they can't open.
- Who you're talking to, from the envelope. A stored envelope carries no account, sender, recipient or group. The mailbox addresses it's stored under change over time and aren't derived from your keys.
- Your contacts. Your contact list stays on your device.
- Your phone number, email address or real name. We don't ask for them.
- Your seed phrase and keys. They're made on your device and aren't sent to us.
What our servers do learn
- Encrypted envelopes and files, while they're stored (see below).
- Your IP address and the time, while your device is connected. Pigeon's server software doesn't write your IP address to disk or to its logs. To limit abuse, the handle directory keeps a keyed fingerprint of it in memory, which can't be turned back into the address and is thrown away every day. The hosting network in front of our servers also handles your IP address, to deliver the traffic.
- Update checks (Windows app): each time it starts, the app asks this website whether there's a new version. That request shows your IP address and your app version to our website hosting (see this website).
- The size and timing of envelopes, and which mailbox addresses a device checks together.
- For files: the size band of each stored piece, how many pieces there are, and the day it expires. Sizes are rounded up to a few fixed sizes so the exact size isn't revealed.
- For handles: the handle directory holds each handle you claim and the public key it points to. That's public: anyone can look a handle up. When you claim or change a handle, the directory sees your network address and the time. When you look someone up, it sees which handle was asked for and from which network address; it keeps no log of lookups. It records times only to the day.
- For invite codes: that your account is registered for the alpha, as its public key and your device's public key. We keep no record of who invited whom. While the alpha runs, the server that checks invite codes could guess who invited whom from network addresses and timing.
A known gap. Someone who can watch a lot of internet traffic, or a server made to record, could use IP addresses and timing to guess who is talking to whom. Pigeon doesn't hide that yet. An option that hides your IP address from our servers is planned.
Planned: link previews. When link previews are built, your device, not our servers, fetches a link you send to make its preview, so the site you link to sees your IP address, as it would if you opened the link.
Planned: a public key log. So that you can check that the keys the directory gives out are the real ones, we plan to publish, regularly and permanently on a public blockchain, a short fingerprint (a hash) of the directory's keys and how many changes each covers. It holds no handle, key, message or IP address that anyone could read out of it. Because it is permanent and public, we'll give the 14 days' notice below before it starts.
What is kept, and for how long
| What | Where | How long |
|---|---|---|
| Message envelopes (sealed) | Several of our servers, for reliability | Until your device confirms it has them, then deleted. A marker that an envelope was delivered is then kept for 7 days on our servers, so it isn't delivered twice: it holds the mailbox address, a fingerprint of the envelope and the time of delivery. Currently there's no time limit for an envelope that is never collected; each mailbox is capped at 10,000 envelopes or 64 MiB, and we plan to add a time limit. |
| Group changes (sealed) | Our servers | Encrypted records of changes to a group's membership or keys are kept while the group still uses them, with no time limit yet. When the group moves on, a marker is kept for 30 days so an old change can't be replayed. |
| Files and photos (sealed) | Our file servers | Until they expire, at most 30 days after they're sent; the app currently always uses 30. A server that runs out of space may delete a file sooner, but not in its first 24 hours. If a valid removal order covers a file, a fingerprint of it is kept for 30 days after the order, so it isn't stored again. |
| Handles | The handle directory | While your account keeps renewing the handle. After 365 days without a renewal, the handle is marked for release; at 395 days it's released, held for 30 more days, when only you can take it back, then freed. After that, the directory keeps only a small internal entry for the handle, with no key or record in it, so a later owner can't be mistaken for you. |
| Alpha registration | The server that checks invite codes | While the alpha runs. There's no way yet to remove one registration; we're adding it. |
| Abuse reports you send | Pigeon's safety team | Our aim is 90 days, 1 year for the most serious categories, and longer where the law requires. Until in-app reporting is built, reports arrive by email and nothing deletes them automatically, so treat these as targets, not a guarantee. |
| Server counters | Our servers' monitoring | Totals of operations and their results, per server. They contain no IP address, account or mailbox address. |
| Your messages and keys | Your devices only, in an encrypted database | Until you delete them. |
What we don't do
- No ads. There's no advertising in Pigeon.
- No selling or renting your data, and no sharing it for anyone's marketing.
- No trackers or analytics of ours in the app or on this website. On Windows, the app draws its screens with Microsoft's WebView2, which is part of Windows. Microsoft's diagnostic data from it follows your Windows settings, and if it crashes it can send Microsoft a crash report, which may include what was on screen. We're working to switch those crash reports off.
- No scanning of your messages, and nothing is reported automatically.
If you report a message
If you report a message, you send us only what you choose to include: the message you report and up to 10 other messages from the same person, the category you pick, and any note you write (up to 500 characters). We learn what's in them, the sender's account key and device, a code for the conversation (not its name or members) and a counter of its key changes, a one-time address to send you our answer, and your IP address when the report arrives. By default we don't learn who you are. In-app reporting is Planned; until then, reports come by email, and an email tells us your address. Copyright and Take It Down Act requests need your contact details, because the law requires them. See the acceptable use policy.
When we share anything
We share data only:
- with the companies that host our servers and this website, which handle network traffic to deliver it (this website's host is named below);
- when the law requires it, as set out in our law enforcement guidelines, and only what we hold. We count every request in our transparency report;
- with NCMEC, when we're required to report child sexual abuse material, or with the police in an emergency that threatens someone's life (see the acceptable use policy).
Children
Pigeon isn't for children under 13 (16 in the European Economic Area, see the terms). We don't collect anyone's age, so we can't tell who is a child. If you're a parent or guardian and your child under 13 has a Pigeon account, contact us. What we hold about it is its handle and its alpha registration. We can't yet remove a handle or a registration ourselves; we're adding that, and until then we'll keep your request and act on it once we can. Messages are on devices, so delete the app on your child's device too.
This website
The site is static files with no cookies, scripts, analytics or content from anyone else; your browser makes no request to any other company. We don't switch on request logging. The site is hosted by Amazon Web Services (AWS) in the United States. AWS handles your IP address to deliver the pages and to protect the site from attacks, under its own terms, and we don't control that.
Who is responsible, and why we handle data
[LEGAL ENTITY NAME] is responsible for the data described here (in European terms, the controller). We handle it:
- to provide the service you asked for: delivering envelopes and files, handles, invite codes and update checks;
- for our legitimate interest in keeping the service secure and limiting abuse: the in-memory fingerprints, the counters, and acting on reports;
- to meet legal obligations: answering valid legal process and making the reports the law requires.
Our servers and this website may be in the United States. If you use Pigeon from elsewhere, what they handle is transferred there.
Your choices and rights
Most of your data is on your own devices, where you can see and delete it. For what our servers hold, you can ask us what we have about you. For most people that's only a handle and an alpha registration. We can't yet delete a handle or a registration on request ourselves; we're adding that, and until then we'll keep your request and act on it once we can. Depending on where you live, you may have other rights under local law, and you can complain to your data-protection authority.
Changes
We'll post any change here with a new version and date. For a change that lets us collect or keep more, we'll tell you in the app or on this website at least 14 days before it takes effect.
Contact
[LEGAL ENTITY NAME], [POSTAL ADDRESS]. Email privacy@pigeonmessage.io.