1. Data We Collect
We collect only the data necessary to provide and secure the Service:
- Account information — email address, a securely hashed password, and an optional display name.
- Device pairings and public keys — paired device identifiers and public cryptographic keys. Private keys never leave your device and are never stored on our servers.
- SMS / contact / calendar data — read on-device, encrypted end-to-end, and never stored server-side (see Zero-Persistence Architecture below).
- Connection metadata — IP address, timestamps, device model/OS, and push-notification tokens. This is pseudonymous information used for authentication, security, and diagnostics.
- Telemetry — opt-in, anonymized aggregate usage data used to improve the Service.
- Payment information — handled by our payment processor; we never store full card details.
2. How We Use Data
We use the data we collect to:
- Operate, authenticate, and secure your account (including multi-factor authentication).
- Provide the Service's core features, including SMS management, AI assistance, webhooks, and the web portal.
- Process payments and manage subscriptions.
- Comply with legal obligations and enforce our Terms of Service.
- Improve the Service, only with your consent where required (e.g., opt-in telemetry).
3. Zero-Persistence Architecture
MessageClaw uses a zero-persistence architecture for your most sensitive data. SMS message bodies, thread content, contacts, and calendar events are read on your paired device, encrypted end-to-end (including post-quantum cryptography), relayed to your portal session, and are never stored on our servers. We retain only non-PII, encrypted, or hashed metadata needed to make the Service function — such as SHA-256 phone hashes and device public keys.
4. Encryption (Post-Quantum Cryptography)
MessageClaw protects data in transit and at rest with modern, post-quantum-ready cryptography. All traffic is protected with hybrid post-quantum TLS (ML-KEM-768 + ML-DSA-65). Sensitive data is encrypted with AES-256-GCM, and device keys are protected by the Android Keystore. This means your data remains protected even against future quantum-capable adversaries.
5. Data Sharing
We never sell your personal data. We share data only with service providers who help us operate the Service (such as our payment processor and push-notification service), and only to the extent necessary to provide those services. We may disclose data where required by law or a valid legal request. We do not share your message content with any third party.
6. Your Rights (GDPR & Australian Privacy Act)
You have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data and delete your account.
- Data portability — receive your data in a structured, machine-readable format.
- Object to or restrict certain processing.
These rights reflect the GDPR (Articles 15–20) and the Australian Privacy Principles under the Privacy Act 1988 (Cth). To exercise any of these rights, contact us using the details below. We will respond within the timeframes required by applicable law.
7. Data Retention
- Message content: never stored server-side.
- Account data: retained until you delete your account, then purged within 30 days.
- Multi-factor authentication challenges: deleted shortly after expiry or use.
- Consent records: retained while your account is active and for any legally required period.
8. Cookies
We use essential cookies for authentication and security. Non-essential cookies (analytics and functional) are used only with your explicit opt-in consent. You can manage your preferences at any time from the "Cookie Preferences" link in the footer of the portal and website. We do not use third-party advertising cookies.
9. AU Data Residency
MessageClaw stores all data in Australian data centres (the service is pinned to an AU-region host). Your personal data is not transferred outside Australia without appropriate safeguards, such as standard contractual clauses, where such transfer is necessary to provide the Service.
10. Contact
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us:
- Email: [email protected]
- MessageClaw, Sydney, New South Wales, Australia
Please also review our Terms of Service.