Privacy Policy

SecureMsg for Android and iOS · Diviners Solution, Chennai, India · Effective 6 September 2026

SecureMsg is built so that we cannot read your messages, and so that we hold as little as possible about you. This page says exactly what the app does with data, what our server stores, and for how long.

What stays on your phone

Messages, photos, voice notes, videos and files you send or receive. They are encrypted on your phone before anything leaves it, and decrypted only on the receiving phone.
Your contacts. When you pick a WhatsApp contact, the app reads that one contact's name and number to address the message. It does not upload, copy or scan your address book.
Your name and WhatsApp number, if you enter them in Settings. They travel only inside your encrypted messages so the receiving phone can file your messages under your name and reply to you.
Connection secrets shared between your phone and each friend's phone, and the app lock (a salted hash of your PIN or pattern, stored in the phone's secure keystore). Fingerprint and face data never leave the phone's own biometric hardware; the app only receives a yes or no.

The app does not back this data up to any cloud service, and we hold no copy. Messages exist only on the phone that received them. Removing a contact, clearing a chat, using "Remove all contacts and messages", uninstalling the app, or entering the lock wrongly five times deletes them permanently. There is no way for you or for us to recover them afterwards; that is by design.

What our server (the key vault) stores

To let a message open on your friend's phone, the app parks the message's key on our server at secure.divinersgroup.com, wrapped so that only the two connected phones can unwrap it. The vault stores, per message:

Data	Purpose	Kept for
A random message id	lets the receiving phone ask for the right key	until the key is used, then at most 48 hours
The wrapped key	unlocks that one message; unreadable without the phones' shared secret	deleted the moment it is handed out, or after 7 days (30 at most)
A hash of the unlock verifier, wrong-attempt count, timestamps	hands the key out once, locks it after 5 wrong tries	same as the message id

The vault never receives the message content, the unwrapped key, your name, your number, your contacts or your friend's identity. The encrypted message itself travels through WhatsApp (or whichever app you share it with), not through us.

Like any web server, ours keeps short-lived access logs that include the connecting IP address and time. They are used only to keep the service running and are rotated automatically.

What we do not do

No accounts, no sign-up, no email or phone number required by us.
No analytics, advertising or crash-reporting SDKs in the app.
No selling, sharing or profiling of any data. Nothing is transferred to third parties.

Permissions the app asks for

Permission	Why
Contacts	to pick the WhatsApp contact a message is addressed to
Camera	to take a photo or record a video to send, only when you tap the camera button
Microphone	to record a voice note, only while you hold the record button
Biometrics	to unlock the app with the fingerprint or face already enrolled on the phone
Internet	to park and collect message keys at the vault

Your choices

Revoke a sent message before it is opened: its key is deleted from the vault at once.
Unlink or remove a contact: the connection secret is deleted from your phone.
Remove all contacts and messages in Settings, or uninstall the app: everything on the phone is deleted. Nothing about you remains on our server beyond keys that expire on their own within 30 days.

Children

SecureMsg is not directed at children under 13 and does not knowingly collect information from them.

Changes and contact

If this policy changes, the new version is published here with a new effective date. Questions: hello@divinersgroup.com.