Enigram
Enigram Privacy Policy
Effective date: 10 November 2026
Enigram is a messaging app built so that we can't read what you say. This policy explains what little information we handle, why, and what you can do about it.
Enigram is provided by Ngomma Value Added Services Limited, Nairobi, Kenya ("we", "us"). We are the data controller for the information described here. Contact: luche@ngomma.com
The short version
- Your messages are end-to-end encrypted. They're encrypted on your phone before they leave it, and only the person you're talking to can decrypt them. We can't read them, and neither can our hosting provider.
- No phone number, no email. You sign up with a username. We don't ask for your real name, phone number, email address, contacts or location.
- Your name is encrypted too. Only people you chat with can see your display name and "about" text.
- No ads, no tracking, no analytics. We don't sell data, show ads, or track you across apps or websites.
- Some things never leave your phone: your buckets and your app settings. Your encryption keys stay on your phone too, unless you keep iCloud backup on: then a copy is kept in your own iCloud Keychain, which Apple encrypts end to end. We never see it.
1. What we store, and why
Your account
| What | Why | Who can see it |
|---|---|---|
| A random account ID (created when you first open the app) | To identify your account | Our systems; people you chat with see it as part of the chat |
| Your username | So people can find you to start a chat | Anyone signed in to Enigram who searches for that exact username |
A recovery login, if iCloud backup is on: an address like 3f9a…@recovery.enigram.invalid and a password, both worked out from your encryption key | So a new iPhone with your iCloud Keychain backup can sign back in to your account. The address can't receive email and isn't linked to you | Our systems (the password is stored only as a hash by Google Firebase) |
| Your public encryption key | So others can encrypt messages to you | Anyone signed in to Enigram |
| Your display name and "about" text, encrypted | To show your name to people you chat with | Only people you've accepted a chat with (we see only scrambled data) |
| When your account was created | Basic account record | Our systems |
Your chats
| What | Why |
|---|---|
| Which two accounts are in each chat | To deliver messages to the right person |
| For group chats: who is in the group, who manages it (admins) and who added whom | To deliver messages to every member and let admins add or remove people. The group's name is encrypted, like messages |
| For group chats: the group's key, wrapped separately for each member | So each member's phone can unlock it. We only store wrapped copies we can't open. A new key is made whenever someone joins or leaves |
| Messages, encrypted | To deliver them; we can't read them |
| Photos, videos and voice messages you send, encrypted, only until delivered | To pass them on. Each one is encrypted on your phone with its own key, which travels only inside the encrypted message, so we can't see it. Our servers only relay them: they're deleted as soon as the other person's phone has them (in a group, once every member's phone has them), and after 30 days if that never happens |
| Whether a message was sent to a bucket ("Send to bucket") | To keep it out of the normal chat on both phones and count unseen ones. Which message is private is only inside the encryption, but we can see that a private message was sent, and when |
| Emoji reactions to messages, encrypted | To show them to both of you. We can see that someone reacted to a message, but not which emoji |
| Calls: who called whom, whether it was a voice or video call, when it started and ended, and whether it was answered | To ring the other person and connect the call. The connection details the phones exchange are encrypted, and the call record is deleted when the call ends. Audio and video go phone to phone, end-to-end encrypted; we never receive them |
| The time each message was sent, and which message it replies to | To show conversations in order |
| Delivery and read times, typing indicators, unread counts | To show ticks, "typing…" and badges |
| Whether you've accepted a chat (message requests) | So strangers can't see your name, read receipts or typing until you accept |
| The disappearing-messages setting for a chat | To delete messages when their timer runs out |
Who you talk to and when is visible to our systems even though the content isn't. We use it only to run the service.
Safety
| What | Why |
|---|---|
| The accounts you've blocked | So the blocked person can't message you. Only you can see your block list |
| Reports you send | So we can investigate abuse (see section 4) |
Technical information
When your phone talks to our servers, our hosting provider processes technical data such as your IP address, device and app version, and an app integrity check from Apple (App Attest). This is used to deliver the service and to stop fake or modified apps from accessing it. We don't use it to profile you.
2. What we don't collect
We don't collect your phone number, email address, real name, contacts or address book, location, browsing activity, or advertising identifiers. Before a photo is sent, Enigram redraws it, and before a video is sent, Enigram re-encodes it; both remove hidden details such as where and when it was taken and which camera took it. Enigram never gets access to your photo library: you pick photos and videos in Apple's own picker, and the app receives only the ones you choose. Enigram uses the microphone only while you record a voice message or a video with the camera; it doesn't use it for anything else. We don't use analytics or crash-reporting tools that track you.
GIFs. If you search for a GIF, your phone sends the search straight to GIPHY, which also sees your phone's IP address. GIPHY's terms don't allow searches to go through our servers, so we never see them. GIPHY gets nothing else: not your account, your chats or who you're writing to. The GIF you choose is downloaded to your phone and sent like a photo, encrypted and only relayed by us, so the person you send it to never contacts GIPHY. If you don't use GIF search, nothing is sent to GIPHY. See GIPHY's privacy policy.
3. What stays only on your phone
- Your private encryption key. We never receive it. With iCloud backup on (the default, in Settings → Backup), a copy is kept in your own iCloud Keychain, end-to-end encrypted by Apple, so a new iPhone signed in to your Apple account can restore your account and read your messages again. With it off, the key never leaves this phone: if you lose the phone, your account and messages can't be recovered.
- Buckets (hidden groups of chats), including their names and which chats are in them. They're encrypted with keys that only open with your Face ID on this phone, and never uploaded.
- Photos, videos and voice messages you send or receive, stored on your phone still encrypted with their own keys, excluded from backups, and protected while your phone is locked. They're deleted from your phone when the message is deleted, disappears, or you delete your account.
- Your phone contacts. If you allow it, Enigram reads names and phone numbers to show your contacts and send invites. They're never uploaded. Which contact is which Enigram user is remembered only on this phone, after you link them yourself, and isn't backed up. Invites are sent by your own Messages app or share sheet, so we never see who you invite.
- App settings such as App lock, pinned, muted and cleared chats.
4. Reports
If you report someone, we receive your account ID, theirs, the reason and any details you write. Because chats are end-to-end encrypted, we can't see the conversation. Only if you choose, the reported person's last 5 messages are decrypted on your phone and sent with the report. We use reports only to investigate abuse and enforce our rules, and we keep them for up to 12 months unless we need them longer to deal with a legal claim.
5. How long we keep data
- Photos, videos and voice messages are deleted from our servers as soon as the recipient's phone has downloaded them, and automatically after 30 days if it never does. Deleted files can't be recovered. After that they exist only on your phones.
- Messages stay on our servers until the sender deletes them ("delete for everyone"). In chats with disappearing messages on, each message is deleted from both phones and our servers once its timer runs out: by the app as soon as either of you uses Enigram, and otherwise automatically by our servers, usually within 24 hours. Photos and videos in those messages are deleted from both phones too.
- Your account (username, public key, encrypted profile, block list) is kept until you delete it.
- Chats you were part of stay available to the other person after you delete your account, still encrypted. This is how they keep their copy of the conversation.
- Server logs kept by our hosting provider are kept for a limited period under their policies.
6. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Google Cloud / Firebase (Cloud Firestore, App Check) | Hosting accounts, encrypted messages and chat records | Database in the European Union (Belgium and the Netherlands, "eur3") |
| Google Cloud Storage for Firebase | Hosting encrypted photos, videos and voice messages | European Union (Belgium, "europe-west1") |
| Google Firebase Authentication | Creating your anonymous account and keeping you signed in (account ID, sign-in times, technical data) | May be stored in the United States, under Google's data-transfer safeguards |
| Cloudflare | Relaying calls when two phones can't connect directly: it passes on encrypted call traffic it can't decode, and sees both phones' IP addresses | Global network, nearest location to each phone |
| GIPHY | GIF search, only when you use it: receives your search and your phone's IP address directly from your phone | Under GIPHY's privacy policy |
| Apple (App Attest, App Store) | Confirming requests come from the genuine app; distributing the app | Under Apple's privacy policy |
We don't sell or share your information with anyone else, except where the law requires it (see section 8).
7. Your rights
Depending on where you live (including under Kenya's Data Protection Act 2019 and the EU/UK GDPR), you can:
- Access the information we hold about you. Most of it is visible in the app; for the rest, contact us.
- Correct it. You can edit your name and "about" text in Settings at any time.
- Delete it. Use Settings → Delete my account. This deletes your profile, username, block list and encryption key straight away.
- Object to or restrict processing, and move your data to another service, where the law allows.
- Complain to a regulator, such as Kenya's Office of the Data Protection Commissioner, or the data protection authority where you live.
To use these rights, email luche@ngomma.com. Because accounts have no email or phone number, we may ask you to confirm the request from within the app.
Our legal basis for processing is providing the service you asked for (contract), keeping it safe and free of abuse (legitimate interests), and complying with the law.
8. Requests from authorities
If we receive a valid legal request, we can only provide what we have: account IDs, usernames, public keys, creation dates, who is in a chat with whom and when messages were sent. We cannot provide the content of messages, photos, videos or anyone's display name, because they're encrypted with keys we don't have.
9. Security
Messages are encrypted on the sender's phone using X25519 key agreement and ChaCha20-Poly1305 encryption, and can only be decrypted by the recipient. Each photo or video is encrypted with its own random key, and stays encrypted on your phone. Videos are kept as small encrypted pieces that are decrypted in the app's memory as they play, so a decrypted video is never written to your phone's storage. Decrypted photos are also kept only in memory. If you choose to save or share a video, it's assembled into a temporary file that's protected while your phone is locked and deleted when you're done. Server access is limited by security rules that let people read only their own chats, and by App Check so that only the genuine app can connect. No system is perfectly secure, and the person you message can always screenshot or share what you send. You can compare a chat's security code in person to confirm nobody is intercepting it.
10. Children
Enigram is not intended for children under 13. If you believe a child has created an account, contact us and we'll delete it.
11. Changes to this policy
If we change this policy, we'll update the date above and, for significant changes, tell you in the app before they take effect.
12. Contact
Ngomma Value Added Services Limited Nairobi, Kenya luche@ngomma.com