What can we see?
Messages, photos, voice messages, videos, and parcels are end-to-end encrypted, so only you and the friends you send them to can read them. Our servers pass them along but can’t open them, and they don’t learn who sent a message, only who it’s for. Friend requests are the exception: our servers see who sent one and who it’s for.
Our servers do see your IP address when your phone or Mac connects. We use it to limit abuse, and we don’t store it.
What do we store?
- For your account, we store your username, the name you picked, your public keys, what’s needed to sign you in, and when your phone last connected. Your password never reaches us in a form we can read. If “Find me by username” is on, anyone who looks up your username can see your name. People you’ve already been in touch with, and anyone who opens your invite link, can see it either way.
- Messages and files waiting to be delivered are stored encrypted. Once your friend’s phone or Mac receives them, they’re deleted from our servers. Anything still undelivered after 60 days is deleted too.
- Backup is optional. If you have it on, your backup is encrypted on your phone before it’s sent to us, so we can’t read it. It holds your account, your friends list, and each chat’s settings, but not your messages. Your Vault is backed up to your own iCloud instead, encrypted so only you can open it. Turning backup off deletes the copy we keep.
- To send you notifications, we store the token Apple gives your phone. Apple only ever sees “New message”, and your phone adds who it’s from. Notifications never show what anyone wrote.
- We keep a public log of usernames and their keys, so anyone can check that a key hasn’t been swapped. Nothing is ever removed from it.
- If you email us, we keep your email address and messages for as long as we need them to help you.
No ads or tracking
Tempo has no ads or analytics, and nothing in it tracks you. If you share crash reports with app developers in your iPhone’s or Mac’s settings, Apple passes them to us without your name or account. We don’t sell your data. Tempo also never asks for your phone number, email, contacts, or location.
This website has no cookies or analytics. Every visitor is treated as if their browser asked not to be tracked (Do Not Track).
Apple and Amazon
Our servers run on Amazon Web Services. Apple delivers notifications and hosts our support email, and your backup key is kept in your iCloud Keychain. Neither company can read your messages, and both must keep what they handle for us private and secure.
Reports
We take reports seriously. If you report someone, the messages you choose to include are sent to us so we can review them. We keep reports as long as we need them to act on them, or longer if the law requires it.
Legal requests
We respond to valid legal requests from authorities, but we can only give them what we have, as this page describes. We can’t hand over messages we can’t read. If a report shows child sexual abuse material, we report it to the National Center for Missing & Exploited Children, as US law requires.
Deleting accounts
Your account stays as long as Tempo is on your phone. If your phone hasn’t connected to Tempo in a year, the account is deleted, and Tempo will remind you a month before, and again a week before. If you delete your account in Settings, it’s erased from our servers right away, except its entries in the public key log. Someone else can take your username 14 days later.
Age
You must be 16 or older to use Tempo. If we learn an account belongs to someone younger, we delete it.
EU and UK
Arepo Studios LLC is responsible for your data. Our servers are in the United States, so that’s where your data is stored. We use it on these legal grounds:
- To provide Tempo to you, we use your account, your messages and files on their way, your backup, your notification token, the public key log, and when your phone last connected.
- To keep Tempo safe, we use your IP address to limit abuse, and we review reports. This is our legitimate interest.
- To answer you, we keep the emails you send us. This is also our legitimate interest.
- To meet our legal obligations, we respond to legal requests and report child sexual abuse material.
You can ask to see, correct, delete, or get a copy of your data, or object to how we use it, by emailing us. You can also delete your account in Settings at any time. Entries in the public key log stay, since everyone’s encryption relies on it being complete. If you think we’ve mishandled your data, you can complain to your country’s data protection authority.
Changes
When we change this policy, we’ll update the date at the top. For bigger changes, we’ll also let you know in the app.
Contact
Questions or requests? Email support@tempomessenger.com