Privacy

Your conversations. Your control.

Minyma is designed so message and attachment contents are encrypted on sender devices and decrypted on recipient devices. The relay handles delivery, queueing, push, and attachment transfer while Minyma keeps the privacy boundary clear and practical. Voice and translation features are user-started, and private message content is only used for those features when the user explicitly asks or allows it. Weather requests use Apple WeatherKit only when requested.

Get Minyma Read Privacy Policy
Voice boundary

Helpful only when you ask

Minyma Voice can help with drafts, translation, and local navigation, including weather questions, but message content is not read for voice or translation unless you ask or approve it.

Minyma Voice is separate from your encrypted messaging and calls. Your contact list, your calls, voice notes, photos, videos, files and contact cards are never sent to the speech provider, and starting Voice does not upload your chats. While a Voice session is running, the provider processes your microphone audio, generates the assistant's replies, and receives a small amount of app context so it can act on what you say: your Minyma ID, the names and identifiers of up to ten of your chats, which screen and chat you have open, and your local date, time and language. Nothing from inside a chat is sent on its own. A feature you ask for may send what it needs: a draft you dictate, a poll's question and results, or the text of one message. Private message text is sent only with your permission, for one action or for the current Voice session, one message at a time.

Under the provider's default API policy, content processed by Minyma Voice may be retained in abuse-monitoring logs for up to 30 days, or longer where required by law or reasonably necessary to protect the service or others from harm. Approved retention controls may change this handling. API content is not used to train the provider's models by default.

  • Sensitive actions are staged for review
  • Current location is requested only for local weather
  • Voice notes are encrypted as attachments
  • Turning voice off hides product voice controls
  • Local pickers do not send media until you choose it
Protected

What Minyma is built to protect

  • Message text
  • Attachment contents
  • Encrypted voice-note audio sent as an attachment
  • Attachment keys shared inside encrypted messages
  • Receipts, edits, and deletes carried in encrypted flows
  • Voice and video call setup, protected end to end like messages
  • Group conversations, with the same per-message protection as 1:1 chats
  • Your encryption keys, which never leave your device's secure storage
Metadata

What supports delivery

  • Which user or device is sending
  • Which user or device is receiving
  • Timing and frequency of messages
  • Encrypted attachment size and limited transfer metadata, such as upload/download timing and delivery state
  • The relay routes encrypted messages and call setup data, not plaintext message bodies
  • The database stores account, device, queue, and delivery state needed to operate the service
  • Encrypted-media storage holds ciphertext attachments for delivery, not long-term content archives
  • One exception to the delivery window: a group's photo is kept as an encrypted attachment without the short expiry, so members and newly added devices can always fetch the group's current photo; it is removed under account-deletion flows
Link previews

Previews are built by your device

When you type or paste a link while composing, your device can fetch that page to build a preview card - so the linked site sees a normal web request from your connection, before you send. The fetch is cookie-free and HTTPS-only; the first attempt identifies nothing, and if a site refuses anonymous visitors, one retry identifies itself as a Minyma preview fetcher. For a few large video sites whose pages hide their titles from non-browsers, your device also asks that same site's own public preview endpoint for the title and thumbnail - still only the site you linked, never a third party. The finished preview travels end-to-end encrypted inside the message: the relay never sees the URL, and the recipient's device shows the card without making any network request. A link you receive is never fetched automatically. Turn generation off any time in Settings → Privacy → Generate Link Previews.

Where it lives

EU-based infrastructure

Minyma's production relay, database, and encrypted-media storage run on infrastructure based in the European Union, operated under the EU's data-protection framework (GDPR). Attachments are held only as ciphertext, kept just long enough to be delivered, and removed under the normal retention window and on account deletion. One exception: a group's photo is kept as an encrypted attachment without the short delivery-window expiry, so members and newly added devices can always fetch the group's current photo - like other uploads, it is removed under account-deletion flows. Media downloads are accelerated at the network edge, but what travels there is ciphertext only - the keys stay inside your encrypted conversation.

Translation

Translation only when requested

Draft translation is based on text the user is actively composing. Translating an existing message requires explicit permission before that message content is read for the translation request. Translation happens for the one draft or message you asked about - never in the background, and never across your history.

  • Translated drafts are staged before replacing or appending
  • Latest-message translation uses a clear consent step
  • One approved message means one approved message, not the whole chat history
  • Assistant voice language does not automatically translate private content
  • Sender names can be read without reading message text
  • Translated text is reviewed before it changes a draft
  • Opening a picker or tool does not share media or files until the user selects something
  • Voice notes are not automatically transcribed
  • Declining a translation prompt shares nothing at all
Voice

How voice stays bounded

Minyma Voice is optional and user-started. It can help compose, navigate, translate drafts, open New Message or New Group flows, read public Help, Terms, and Privacy pages aloud, answer WeatherKit weather and forecast questions, and open local tools, but sensitive actions like sending, calling, or reading private message content are gated by explicit intent or confirmation.

  • Turning voice off stops active voice sessions and hides Minyma Voice controls
  • Voice Language defaults to English, supports a broad user-selected language set, and does not auto-switch by default
  • Assistant language does not silently translate private messages or public legal/help text unless the user explicitly asks
  • WeatherKit, voice, and translation requests are separate user-started flows with their own boundaries
  • Local weather asks for current location only for that request; explicit city weather uses the requested place
  • Opening camera, files, photos, or contacts stays local until the user chooses what to send
  • Reading unread sender names can avoid reading private message contents
Deletion

What Delete Account does

Uploaded ciphertext attachments are deleted from the server under Minyma's normal retention and account-deletion flows. Delete Account is intended to remove relay-held devices, queued delivery data, profile information, push tokens, and uploaded ciphertext attachments.

  • It wipes the current device back to onboarding
  • It does not erase content already downloaded to other devices
Local

Reset and duress behavior

Local reset wipes the current device back to a fresh install. Duress mode does the same instantly - and when account deletion is enabled, the deletion request is signed and sent at the same moment, completing on any working connection.

  • The wipe is immediate and never waits on the network
  • A wiped device looks like a fresh install
  • These tools are strongest on the current device
  • They do not remove content from other users' devices
Device copies

What remains after delivery

End-to-end encryption protects content while it is delivered, but a message that has already reached another device is under that device's control. Minyma is careful to separate server deletion from content already downloaded elsewhere.

  • Deleting your account removes relay-held account data and queued server state
  • Messages already downloaded to another user's device are not pulled back from that device
  • Local app lock, reset, and duress tools protect the device where they are used
Notifications

What a banner can show

The service can never put your words in a notification: it only ever holds ciphertext, so the alert it sends says just “New message.” A rich preview - the sender's name and message text - is built on your device, after the sealed message is decrypted locally and the sender's identity is cryptographically verified. If that verification cannot complete, the banner stays generic.

  • You choose the level in Settings → Notifications: Off, “New message” only, or Show preview
  • Preview text is rendered from the decrypted message on your device, never sent by the server
  • After a restart, banners stay generic until the device is first unlocked
Capture safety

Useful signals, even after the moment passes

On iPhone and iPad, Minyma can detect screenshots after iOS reports them and can hide sensitive content during active screen recording or mirroring.

  • Screenshot detection helps user awareness when sensitive content may have just been copied
  • Local breadcrumbs can support audit visibility and follow-up safety flows
  • Active recording or mirroring can trigger a privacy veil while capture is in progress
Boundary

What capture safety cannot promise

iOS reports screenshots after they happen, so no app can guarantee that a screenshot was blocked. Minyma uses the signal for awareness and keeps stronger protection for active recording or mirroring, where sensitive content can be veiled while capture is in progress.

  • Screenshot detection is a notification signal, not a full screenshot blocker
  • Screen-recording and mirroring protection can hide content during active capture
  • Users should still treat sensitive screens as visible to anyone holding the device