Privacy policy

Your texts are encrypted on your phone before they leave it (end-to-end, AES-GCM) and are not decrypted until they reach a computer you paired. The key travels in the pairing code you type, never through the relay. The relay stores only the encrypted texts. A copy of the relay's storage shows no readable texts.

The same server also sends the MorseHub web app to your browser, so you are trusting the page it sends. That is the honest limit today.

• Your texts, contact names and call alerts, encrypted on the phone. The relay cannot read them.
• Pictures, encrypted the same way, for 15 days.
• Your email address, and your name if you gave one. They are used for the setup guide, billing emails and the warning before anything is deleted.
• Your Stripe customer and subscription ids, and your plan, its status and its dates. No card details.
• Your list of devices: each computer's name (like "Chrome on Windows"), when it was added and when it was last used.
• Push subscriptions: the address your browser gives for notifications, if you turn them on. What is sent there is encrypted too.
• A keyed hash (HMAC-SHA256) of your phone number, not the number itself. It is kept forever so each number gets one free trial.
• A short keyed hash of your internet address, used only to limit repeated tries.
• Setup reports: what you type into the report form, plus the phone you picked, the step, and your browser type. Kept for support and deleted after 12 months.
• When your phone is ringing or on a call, MorseHub's server sees that it is, so your computers can show it. Never who with.
• Page counts: when a MorseHub page loads, it adds one to that page's count for the day. No cookies, no IP address, nothing that identifies you.

Server logs record counts and error codes. They never hold texts, phone numbers or names.

The words in your texts, your contacts' names and numbers, your pictures and your card number.

• Twilio gets your phone number to text you the free trial code and to check that it is a mobile line.
• Stripe, the merchant of record, runs the checkout and your subscription. They handle your card and billing details. The relay never sees card data.
• Cloudflare hosts the relay and sends MorseHub's email.
• Cloudflare Turnstile checks the free trial, checkout and setup report forms for bots. Cloudflare looks at your browser and internet address for that check. MorseHub gets only a pass or a fail.
• Your browser's push service (Google, Mozilla, Apple or Microsoft) delivers notifications if you turn them on. They are encrypted before they leave the relay, so the push service cannot read them.

We do not sell your data and do not use it for ads.

• While your account is active, until you delete it.
• After a pause because a free trial ended, a subscription ended or a payment was refunded: your saved texts are deleted 30 days after the pause. We email you 7 days before.
• Pictures: 15 days.
• The keyed hash of your phone number: forever, so the number cannot start a second free trial.
• Stripe keeps its own payment records for as long as the law requires.

Email support@morsehub.net from the address on your account and we delete the account and everything the relay holds for it.

Forget this computer, in MorseHub's Settings, deletes everything that one browser stored.