Privacy Policy

Last updated: October 19, 2026

MURMURLINE is built to know as little about you as possible. There are no accounts, no sign-up, and no persistent profile. This page explains exactly what little data passes through the service, and what we do (and don't do) with it.

Messages

Chat messages are end-to-end encrypted in your browser before they're sent. A fresh encryption key is generated for every conversation and exists only in your browser — in memory, and (so a refresh doesn't end the chat) in this tab's session storage until you hang up or close the tab — and it's never sent to our server. The server relays ciphertext between you and your partner and cannot read your messages. By default nothing about your conversation content is logged or stored, encrypted or otherwise. The one exception is a chat that you and your partner both choose to keep (see "Kept chats" below).

What the server does process

To make matchmaking and abuse-prevention work at all, the server briefly handles the following, in memory, for the duration of your connection:

• Your IP address — used to (a) resolve an approximate country, shown to your chat partner as a flag, via an offline local database (never sent to a third-party geo-IP service), and (b) apply basic rate limits so one source can't flood the matchmaking queue or spin up bot accounts.
• The alias and gender/preference you select — used only to display your chosen name to your partner and to match you with someone whose preference is compatible. These are self-reported, not verified, and not tied to any real identity. We also add your gender and preference selection to anonymous daily totals (for example, how many people who joined today chose each option) — only the counts are kept, never linked to you. If you have Plus, your partner sees a ✦ badge next to your alias, so they can tell you have Plus; nothing else about your wallet is shown.
• Your location, only if you switch on "nearby" — your device's position is sent to the server so it can match you with people within range and tell your partner roughly how far away you are (for example "~12 km away"; never the position itself). It is used in memory for the search and the chat, and is never stored or written to disk. With "nearby" off, no location is sent.
• Basic connection logs (timestamps, connection/disconnection events) — kept briefly on the server for debugging and abuse investigation, then rotated out. These logs are not a database of user activity and are not used for tracking or profiling.
• Reports and violations — if you or your chat partner uses the "Report" button, or your own browser detects your outgoing message matches a policy pattern, we record that a flag occurred against that IP address and a rough timestamp. Enough flags within an hour puts that IP in a temporary timeout with an exact expiry time — 5 minutes, then 30, then 24 hours for further repeats. Nothing is ever an indefinite or permanent block. A record of each report or violation — the time, the IP addresses and aliases involved, the country, whether the app or the website was used, and whether a timeout followed — is kept on our server for 180 days for abuse investigation and lawful requests from authorities, then deleted. We never see, and this never includes, the content of any message — that check happens entirely in your browser, and only a "this happened" signal reaches our server.

If your connection drops or you refresh, the server holds your pairing for up to 90 seconds, and keeps up to 100 messages your partner sends meanwhile (still end-to-end encrypted, so unreadable to us), so you can rejoin the same chat. On the website nothing is written to disk; if you don't return in time, the chat ends as usual and the held messages are discarded.

Apart from what the Android app needs (next section), none of the above is written to a persistent database. It lives in server memory and clears on its own after a short window (an hour, for report counts) or when your connection ends.

Chats that stay open (Android app)

A phone drops its connection whenever you leave an app, so for people using the Murmurline Android app the server holds a chat for up to 24 hours instead of 90 seconds (72 hours with Plus, and up to 7 days in all if a chat extension is bought with coins), and holds your place in the search for up to 15 minutes if notifications are on. So that a server restart doesn't end those chats, they are saved in a database on our server until they end:

• a random chat id and a one-way hash of each person's return token;
• what was already shown to your partner at match time — alias, gender selection, bio, country — and the public half of that chat's encryption key;
• the messages waiting for whoever is away (up to 100), still end-to-end encrypted and unreadable to us;
• the phone's notification address, if notifications are on.

Your location is never saved there. Everything is deleted when the chat ends, when either of you leaves, or when its hold time above runs out: 24 hours, 72 hours with Plus, at most 7 days with a chat extension (15 minutes for a place in the search).

On your phone, the app saves the chat in progress — its messages in the app's private storage and its encryption key in the phone's secure key store — so the chat is still there if Android closes the app. It is erased from the phone the moment the chat ends.

Kept chats

A chat is only kept if both people agree to it; otherwise everything above applies and the chat is gone when you leave. If you both agree:

• On each of your devices, the chat's encryption key (stored so that the browser will use it but never reveal it to a script) and the message history are saved in your browser's IndexedDB. They stay there until you or your partner end the chat, or you clear your site data. To save space, only the newest 40 images (your own stickers) of each chat are kept on your device; older ones are replaced by a note, and text is never removed this way. Anyone who can use your browser profile could read the history, and if your browser data is cleared the chat is lost — we cannot restore it.
• On our server we keep a random chat id, a one-way hash of each person's secret token, and timestamps. While one person is offline we hold the other's messages, still end-to-end encrypted and unreadable to us, until the offline device confirms it has them; then we delete them. We can see which connections belong to a kept chat and when they are active, never what is said.
• Ending or expiring: when either person ends a kept chat it is deleted from our server and from both devices (if the other person is offline, a small marker with no messages waits up to 30 days so their device can delete its copy when it next connects). A kept chat with no activity for 30 days is deleted from our server.
• Kept chats use a key that lasts for the life of the chat, unlike normal chats, which use a fresh key each time. That means the strong per-conversation forward secrecy of a normal chat does not apply to a kept one.

Notifications (Android app)

If you allow notifications in the Murmurline Android app, the app gives our server your phone's notification address (a random token from Google's Firebase Cloud Messaging) and which of its two switches are on. With Chats on, we can tell you, while the app is closed or in the background, that there's something new in your chat, that your chat partner would like to keep the chat, that someone was found for you, or that a chat ended — in those fixed words only, never who it is or what was said. (For the keep request the app marks that one message as such, so our server knows a keep request was sent; the message itself stays end-to-end encrypted.) For a kept chat we store the address alongside that chat and delete it when the chat is deleted; for a normal chat it is held only in memory while the chat lasts. With News from Murmurline on, the address is also kept on a list (just the address and the date the app last connected) so we can send the occasional announcement such as planned maintenance; it is removed when you switch News off, when the address stops working, or after 60 days without the app connecting. Google delivers the notifications, so they pass through Google's servers under Firebase's privacy terms. You can switch either kind off in the app (Me → Notifications) or turn notifications off in your phone's settings.

Usage statistics and crash reports (Android app)

The Android app uses Google's Firebase Analytics and Crashlytics to learn which features get used and why the app crashes. They receive event names with a few coarse details — for example that a search started (and whether Nearby or a filter was on), how long a wait or a chat lasted in broad ranges such as "under 30 seconds", whether a chat was kept or reported, and that a sticker was sent — plus the app version, your phone model, Android version, approximate country and a random app-installation identifier. They never receive your messages, alias, bio, stickers or location. We switch off Google's advertising ID and ad personalization for these tools. You can turn both off in the app under Me → Privacy → Share anonymous usage stats; collection stops immediately. Google processes this data under Firebase's privacy terms. The website does not use Firebase. The app may also ask Google Play to show its rating dialog or to offer an app update; those are handled by Google Play and tell us nothing about you.

Each time the app opens it also sends our own server one small ping, which we use to count opens per day, by country (worked out from the connection's address, which we do not store), and how long the app has been installed in broad ranges such as "first day" or "7–29 days". Like the website's counters, only daily totals are kept: no address, no identifier, nothing that points back to you. It follows the same Share anonymous usage stats switch.

In the Android app, screenshots and screen recording are blocked and the app shows a blank card in the recent-apps view, to protect what you talk about. It is always on in the app. It only affects your own phone; nothing is sent anywhere. It cannot stop someone else from saving a chat with their own device.

Coins and Plus

Your wallet. Coins and Plus have no account. The first time you use the app or the website a wallet is made for you with a random code that the app keeps in its secure storage (the website keeps it in your browser's localStorage). We keep a one-way hash of that code (for the Android app also the code itself, locked as described below), the wallet's current balance, Plus and passes, and a ledger, an append-only list with one line for each change to your wallet: what it was (for example "+2 coins, daily reward", "+1 coin, chat" or "−300 coins, Plus"), the amount, your balance before and after, and the time. It is not linked to your alias, your chats or your location, and we keep it for as long as the wallet exists so that your balance can always be explained. The code is sent to our server when you open the app or start a search so that your coins and Plus apply, on the app and the website alike. Getting your wallet back on the same phone. The Android app also sends your phone's Android ID, an identifier Android gives each app on a phone: it stays the same if you uninstall and reinstall the app, and changes after a factory reset. It is not your advertising ID and we do not use it for ads or tracking. We keep only a one-way hash of it, to find your wallet, and your wallet code locked with a key made from the Android ID; we don't keep the Android ID itself, so the code can only be unlocked when that phone asks. When you install the app again on the same phone, it gets the same wallet back. A wallet belongs to the last phone that used it. In the app you can't type in another wallet code; the code is for using your coins and Plus on the website, where Plus and passes work in one browser at a time. A factory reset or a new phone starts a new wallet. If you lose the code and your device, you may be able to recover access to purchased coins if you can provide your Google Play order number.

What counts for rewards. To pay a reward for a chat the server uses only what it can see without reading anything: that the chat lasted a few minutes, that each side sent several messages (it counts them, it cannot read them), that nobody reported it, and a one-way hash of each person's network, so that two devices on one network do not pay each other and the same two people are not paid again and again. The same hash also lets the server count the day's free filtered search once per network. It is kept with your wallet, with that count and with a daily count of paid chats for the site owner's fraud checks, and is deleted automatically after three days at most.

Buying coins. Coin packs are bought through Google Play, which handles the payment; we receive only a purchase token and order number that we check with Google, never your payment details, and we keep them with the ledger line. Plus is not bought with money: it is bought with coins. Invites. A friend's invite link carries a short code through Google Play's install referrer; it is used once to credit both of you after the friend's first real chat (the inviter is credited for at most ten friends in 30 days). Ads. The Android app has an optional "Watch an ad" button for earning coins with a rewarded ad from Google AdMob. An ad is shown only when you tap that button, never otherwise, and you never have to watch one; there is a daily limit. We ask Google for non-personalised ads only, and the app doesn't use your advertising ID. Before the first ad, the app runs Google's consent check, and in regions where the law requires consent (such as the EEA and the UK) Google's consent form is shown; you can say no and still use everything else. You can change your choice at any time in the app under Me → Privacy → Ad choices (shown where consent applies). To show an ad, Google receives what it needs from your device (such as its IP address and device and app details) and a short reference for your wallet (not your wallet code) so that the coins reach the right wallet; Google then tells our server that the ad was watched, and that line goes into your ledger. Google's use of this is covered by its own privacy policy. The website shows no ads.

Support Chat. From the Coins screen, once your wallet has bought something (a coin pack, or Plus, a pass or a chat extension with coins), you can open a private support ticket about a purchase issue (coins, payments, refunds, Plus or passes), and Plus members can also open one for general help with the app; before your first purchase, or without Plus for general help, you can email support@murmurline.chat. A ticket holds its category, its status (open, replied or resolved), the messages written by you and by us, the times they were sent and, for a purchase issue if you give them, the Google Play order number, roughly when you bought and which pack. It is linked to your wallet inside our database so that only that wallet and the site owner can read it; it is not linked to your alias, your chats or your IP address, and we do not save your wallet code or your address with it. We use it only to answer you and, where needed, to fix your coins, Plus or passes. A resolved ticket takes no more messages; you can open a new one. Please never write passwords, recovery phrases, Google purchase tokens, card details or your wallet code in a ticket; we never need them, and messages that look like them are refused. A resolved ticket is deleted automatically 90 days after it was resolved, and any other ticket 180 days after its last message; the deletion runs in the background, so it can happen a short while after that date. If Plus ends, you can still read your general-help tickets but cannot add to them or open new ones; purchase-issue tickets stay open to you. Tickets remain available until they are deleted under the retention schedule above.

Email support. When you email support@murmurline.chat, your message is routed by Cloudflare Email Routing and handled through Google. We use it only to answer your question or resolve a purchase, refund, Coins, Plus, or pass issue. Do not send passwords, recovery phrases, Google purchase tokens, card details, or wallet codes.

What's stored on your device

Your chosen alias, "I am" selection, recently used stickers, the sticker packs you add and any custom stickers you make are saved in your browser's localStorage so you don't have to re-pick them every visit. This stays on your device — it's never transmitted anywhere except back to our server as part of joining a chat (the same information you already chose to send by using the app). You can clear it any time via your browser's site data settings. Custom stickers are sent to your chat partner inside the same end-to-end encrypted channel as messages; we never receive or store them.

The Android app keeps the same things in its own private storage on your phone; kept chats and their keys are stored there too, and all of it is removed when you uninstall the app. The app shows an ad only when you tap "Watch an ad" (see "Ads" above).

Cookies and advertising

We don't set analytics cookies or profile you. To see how the site is used we keep daily aggregate counts only — page views, where visits came from (e.g. a referring site or a campaign link), visitors' countries, phone-or-computer, time of day, how long people wait for a match, how long chats run, how many chats get kept or reported, and how many visitors from each source went on to start a chat. To avoid counting one person twice, a one-way hash of your IP address and browser is held in the server's memory for that day and then discarded; it is never written to disk, and the stored counts can't be tied back to you. The one exception is a single localStorage flag ("has this browser been here before?") used only to report a repeat-visit rate — no id, no cross-site tracking, nothing that identifies you. The website shows no ads and sets no advertising cookies; it does not load Google AdSense or any other ad network. The Android app shows only optional rewarded ads, when you tap "Watch an ad" (see "Ads" above); where consent is required, Google's consent form in the app asks for it. Reading this page is not a way of giving that consent.

Bug reports

If you send a bug report, we store what you typed, the optional contact you gave, and (only if you leave the box ticked) your browser, screen size and which screen you were on. We never attach your messages and don't save your IP address with it. Reports are read only by the site owner and deleted once dealt with.

Sticker packs you publish

If you submit a sticker pack to the library, the images, the pack name and the sticker names you typed are uploaded to our server and held privately until we review them. If approved they are shown to all users; if rejected they are deleted. We do not attach your IP address, alias or any identifier to a submission. To limit abuse we keep a temporary in-memory count of submissions per IP address, which is discarded when the server restarts. Reports about a library pack are counted per pack, without identifying who reported it.

Third parties

The website loads fonts from Google Fonts, subject to Google's privacy practices; it uses no ad network and no Firebase. The Android app's notifications, if you allow them, are delivered by Google's Firebase Cloud Messaging (see "Notifications" above), and its usage statistics and crash reports by Firebase Analytics and Crashlytics (see "Usage statistics and crash reports" above). Coin purchases, invite links (the install referrer) and the app's rating and update prompts go through Google Play (see "Coins and Plus" above). Email to support@murmurline.chat is routed by Cloudflare Email Routing and handled through Google (see "Email support" above). Google AdMob shows the app's optional rewarded ads and runs their consent check (see "Ads" above). None of them can see your chat messages — those stay end-to-end encrypted regardless of anything else on the page.

Who operates Murmurline and your privacy rights

Who operates Murmurline: SAVALIYA DEVAL MUKESHBHAI, India.
Privacy questions and requests to access, correct, or delete personal data: support@murmurline.chat.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Continuing to use the service after a change means you accept the update.

Contact

Questions about this policy: support@murmurline.chat