Privacy policy
Last updated: October 10, 2026
NextMsg is a one-way messenger: programs you control send short text messages to your NextMsg inbox, and the NextMsg apps show them on your devices. We collect only what is needed to deliver those messages. There are no accounts, no ads, no trackers and no analytics.
What we store
- Your inbox: a random inbox ID and the public half of your recovery key. Your 12-word recovery phrase never leaves your phone; we can't see it or recover it for you.
- Your devices: a random device ID, the platform (Android or iOS), the push token issued by Google or Apple, and when the device was created and last seen.
- Keys: your send keys and device secrets are stored only as one-way hashes, plus the first characters of each send key so it can be recognized.
- Messages: the text and channel of each message, kept on our server for up to 7 days so offline devices can catch up, then deleted automatically.
- Usage counters: how many messages an inbox received per day or month, used for the free plan's limit, deleted after about two months.
- Purchases: if you buy Pro, the store transaction ID and platform, so the purchase stays linked to your inbox. Payment details are handled entirely by Apple or Google.
- Short-lived records: single-use pairing and recovery codes, deleted when used or after a few minutes.
What stays on your phone
Your message history, your archive, which messages you have read, and your display settings are stored only on your device. Deleting the app deletes them.
Who processes data for us
- Cloudflare hosts the NextMsg service and this website. Like any web host it processes IP addresses to serve requests and stop abuse (for example rate limiting); short-lived request logs may contain them.
- Google Firebase Cloud Messaging and Apple Push Notification service deliver push notifications. To do that they receive your device's push token and the message being delivered.
- Apple App Store and Google Play process purchases.
We don't sell or share your data with anyone else, and we don't use it for advertising.
Your choices
- Delete messages on your phone at any time; on the server they expire after 7 days anyway.
- Rotate your send key in Settings to cut off a leaked key immediately.
- Uninstalling the app stops all notifications; its push token becomes invalid and is removed from our records the next time a message is sent.
Children
NextMsg is a developer tool and is not directed at children.
Contact
Questions about privacy or your data: hello@nextmsg.app.
Changes
If this policy changes, we'll update the date above and, for significant changes, mention it in the app.