Who we are and our role
Messages.org operates this website, the Console and the iMessage API. We are responsible for data used for this website, for Console accounts, for security and for running the service.
For conversations a customer runs through its lines, that customer generally decides why and how the conversation data is processed, and we process it on the customer’s behalf. Apple, LoopMessage and the other providers named below process data under their own terms.
What we process
Depending on how a project is used, the service may process: account and sign-in data; organization, project, line and webhook configuration; message content and delivery records; the phone numbers and iMessage addresses of lines and of the people who message them; attachments; opt-out decisions; authentication and audit events; and security telemetry.
When you use our contact form, we process your email address, any name you provide, your message and its delivery status to handle your request.
This website sets no cookies and uses no analytics or advertising scripts. It does load fonts: see “Fonts on this website” below.
Why we process it
To provide and secure the messaging service; to authenticate Console users; to route and deliver conversations; to send events to the webhook endpoints a project configures; to honour opt-outs; to prevent abuse; to recover failed operations; to keep audit records; and to measure reliability without reading message content.
Who receives it
Only those who need it to run the service: the customer that operates the line and its authorized users; Amazon Web Services, which hosts the service, its database and storage, and Console sign-in (Amazon Cognito); Apple, for iMessage delivery; LoopMessage, for lines hosted on it; Cloudflare, which serves this website and our DNS; Adobe, for website fonts as described below; and the webhook endpoints a project configures.
TidyAnswer processes contact form submissions and delivers them to our support team.
We do not sell personal data, and we do not use message content for advertising.
Fonts on this website
Outside the European Economic Area, the United Kingdom and Switzerland, this website loads the Proxima Nova typeface from Adobe Fonts (use.typekit.net). Your browser then sends Adobe your IP address and browser details, as with any web request. Inside those regions, and whenever Adobe Fonts is unavailable, the website uses a typeface served from messages.org itself and contacts no font provider. We use the country Cloudflare reports for each request to choose, and do not store it.
How long we keep it
We keep data only as long as the service and our legal obligations require. Inbound attachments are kept for up to 30 days. Secrets and API keys are never written to message logs.
Where it is processed
The service runs in Amazon Web Services’ United States (us-east-1) region. Providers may process data in other countries.
How we protect it
Message content, provider identifiers and attachment records are encrypted at the application layer before they are stored. Projects are isolated from one another, keys and roles are scoped to an organization or project, and changes are audited. No system is free of risk; if an incident affects your data we will follow the notification duties that apply.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict or port your data, to object to processing, and to complain to a regulator. Use our privacy contact form to exercise your rights. We verify every request. Where a customer controls the conversation data, we pass your request to that customer and tell you we have done so.
Anyone who receives messages from a Messages.org line can reply STOP to stop further messages from that customer’s project.
Changes
We will update this policy when the service, its providers or the law change, and change the date at the top when we do.
Contact
For privacy questions, use our privacy contact form.