← Msgx

Privacy policy

Effective October 8, 2026. Msgx is operated by Tomer Levi. This policy describes the Msgx beta on mobile and the web.

Information used to provide Msgx

We process your phone number to sign you in, your account identifier, and the profile name and photo you choose. We store messages, attachments, voice messages, chat membership, saved contacts, call history, and settings to provide messaging and sync your devices. Other chat participants can see information you share with them and may retain their own copies.

With your permission, and after explaining it once in the app, Msgx sends the phone numbers in your address book to the server to find which of your contacts use Msgx. Before you agree, the app looks up only the numbers of a contact you open or share yourself. Names and other contact details stay on your device. The server compares the numbers with registered accounts and does not store them or your address book; the answer says which numbers have an account, and shows that account's profile photo only if the person has you in their contacts or shares a chat with you. To limit how many numbers one account can look up, the server keeps, for 30 days after each check, a keyed one-way code of each number your account checked, which cannot be turned back into the number without a key kept apart from that data and differs for every account; it is deleted with your account. So that deleting an account and signing up again does not reset that limit, the server also keeps a keyed one-way code of your own phone number with the date of your first check and how many new numbers were checked in the last day; it is deleted 30 days after the last check, even if you delete your account sooner. The app then sends only numbers that are new or that it has not checked for one to two weeks. Camera, microphone, photo-library, notification, and location permissions support the corresponding features. You can change these permissions in your device settings.

Location sharing is optional

We process precise location when you send a location pin or start a live-location share. Live sharing can update while the app is backgrounded or closed, only during a share you start. Shares last 15 minutes, one hour, or eight hours, and you can stop them earlier. Chat members can view a share, and enabled arrival reminders use its location.

Live trail points are scheduled for deletion within an hour after sharing ends and are never intended to remain longer than 24 hours. The last position is cleared 24 hours after the share ends. A location pin sent as a message follows message retention.

Calls and service providers

Voice and video calls use WebRTC, connecting devices directly or through a relay when needed. Msgx processes call participants, timing, and outcomes. Call media is not recorded by Msgx. Twilio provides phone verification and call relays; AWS and Railway provide infrastructure; Apple and Google deliver device notifications. These services process the information needed for their role, including device push tokens and connection information.

AI features

Msgx uses an AI provider to understand chats: OpenAI today (the service can be configured to use Anthropic instead). It is on by default. What goes to the provider:

Two switches stop this. msgx AI in this chat (chat info) turns it off for one chat: nothing of that chat goes to the provider, and the notes the assistant kept about it are deleted. In a direct chat either person can turn it off, and only they can turn it on again; in a group, admins decide. Don’t process my messages with AI (Settings → Privacy & security) keeps everything you send, including your live location and the instructions of an assistant you made, out of every request to the provider, in every chat, even when someone else asks the assistant; an assistant you made stops answering.

Requests to OpenAI are sent with response storage off; OpenAI may still keep them for up to 30 days to monitor abuse, under its own terms. Msgx does not write the text of AI requests or answers to its logs. Providers process this information under their own terms and privacy policies. Connecting your own provider does not make its processing local to your device.

Security, diagnostics, and retention

We use encrypted network connections. Messages and attachments are processed on our servers; chats are not end-to-end encrypted. Operational logs and diagnostics may include account identifiers, IP addresses, request information, and errors to maintain reliability and prevent abuse. Service providers may process data outside your country.

Some working copies of message content are kept outside your chats for a short, fixed time. A notification waiting to be delivered is removed within two hours after it is sent, or after 7 days if it cannot be delivered; the record of a notification that could not be delivered keeps only identifiers and the error, never the message text, and is deleted after 7 days. When the AI assistant runs a task for you, the record of the steps it took keeps only identifiers, counts and status, not message text, names or places; it is deleted with your request or the reply, with the chat, and in any case after 30 days. The record of the assistant’s unrequested suggestions is deleted after 30 days, and the notes the assistant keeps about a chat are deleted with the chat.

Database backups are kept for at most 14 days so that we can recover from a failure. Something you or we delete can therefore remain in a backup for up to 14 days before the backup itself is deleted; backups are used only to restore the service.

Account and chat data remain available while needed to operate the service, subject to deletion requests and applicable legal or security needs. We do not sell personal information or use it for cross-app advertising tracking. Authentication state is stored on your device to keep you signed in.

Your choices and deletion

You can stop location sharing, revoke device permissions, and leave chats. You can delete your account yourself, at any time, from Settings in the mobile app (Account → Delete Account) or on the web (Settings → Delete account); the steps are at msgx.ai/delete-account. Deletion is immediate: it removes your profile name, phone number and photo, your saved contacts and your entry in other people’s contact lists, your devices and push tokens, passkeys, open sessions, live-location data, plans, reminders, settings and the agent replies only you could see, and it removes your account from every chat (a chat no one else can read is deleted with its messages). Messages and attachments you sent stay in the chats of the people you sent them to, no longer linked to your name, phone number or photo, until those people delete them; the other participants’ call history keeps its entries, and security and audit records that reference the account identifier are kept for a limited time for security and abuse prevention. Deletion cannot be undone, and signing in again with the same phone number creates a new, empty account. Data export is not available during the beta. For help with a privacy request, contact the developer privately through TestFlight feedback; do not include account details or other personal information in the public support tracker.

Contact and updates

During the beta, contact the developer through TestFlight feedback or the Msgx support tracker. Do not post private messages, phone numbers, credentials, or location information in the public tracker. We will update this page when our practices change and display the effective date above.