Privacy policy

The short version

Inner Messages is a small app made by one person. It keeps the least it can get away with: enough to sign you in and to carry your messages to the people you chose. Nothing is sold, nothing is shared with advertisers, and you can delete all of it yourself in about thirty seconds.

What is collected

What you give the app

• Email address and password — to create your account and sign you in. The password is handled by Google Firebase Authentication; it is stored hashed and is never visible to me.
• Your name — shown to the people you connect with, so they know who wrote to them.
• Messages you write — stored so they can be delivered to the person you wrote them for.
• Photos you upload — your profile picture and any pictures you add to your circles or achievements.
• Your contacts inside the app — who you are connected to, their pending requests, and which circle (Family, In love, Friends) you put them in. This is built only from Inner IDs that people share with each other. The app never reads your phone's address book.

What the app collects on its own

• A notification token — an anonymous identifier from Firebase Cloud Messaging that lets a message reach your phone. It is deleted when you sign out.
• Basic usage analytics — Firebase Analytics records events such as app opens and screen views, together with a device model, a language and a country. This is used to see whether the app works, not to profile you.
• Crash information — if the app fails, technical details about the failure may be recorded.

The app does not collect your location, your contacts list, your call history, your messages in other apps, or anything from your photo gallery beyond the pictures you pick yourself.

Why it is collected, and who sees it

Your data is used for one thing: running the app. Signing you in, delivering your messages, showing your pictures, and sending the notification that tells you a message arrived.

Your messages and pictures are visible to the people you connected with and to nobody else. Inner Messages does not sell data, does not share it with advertisers, and does not use it to train anything.

The app runs on Google Firebase (Authentication, Realtime Database, Storage, Cloud Messaging, Analytics and Cloud Functions), which stores the data on Google's servers as a processor on my behalf. Google's own handling of that data is described in the Firebase privacy documentation. No other company receives your data.

How long it is kept

• Your account data is kept for as long as your account exists.
• When you delete your account, it is removed straight away.
• Database backups are kept for up to 30 days and then overwritten.
• A message you sent to someone else stays in their inbox after you leave, because it is theirs now. Only they can delete it.

Analytics events are retained by Firebase according to its own retention settings and are not linked to your account.

Your choices

• Delete everything — use the account deletion page. It removes your login, your messages, your contacts and your photos.
• Get a copy, or have something corrected — email me and I will send you what is stored about you, or fix it.
• Turn off notifications — in your phone's system settings for Inner Messages. The app keeps working without them.

If you are in the EU or the UK, the GDPR gives you the rights to access, correct, delete, restrict and object to the processing of your data, and to complain to your national data protection authority. Email me and I will help you with any of them.

Security

Traffic between the app and the servers is encrypted in transit, passwords are hashed by Firebase Authentication, and database rules limit every account to its own data and the data of people who connected with it. No system is perfect — if you ever spot a hole, please tell me rather than anyone else.

Children

Inner Messages is not intended for children under 13 (or under the minimum age in your country). I do not knowingly collect data from them. If you believe a child has created an account, write to me and I will delete it.

Changes and contact

If this policy changes in a way that matters, the date at the top changes with it and the app will tell you.

Questions about any of this go to the support address. I read everything myself.