Mahvo Privacy Policy
Effective November 13, 2026
Mahvo is made by Kinu Technologies LLC (“Kinu”, “we”), a company in Texas. This policy explains what Mahvo processes, why, and for how long.
The short version
- We can’t read your messages, photos, files or calls. They are end-to-end encrypted.
- We don’t ask for your phone number, email address or contacts.
- No ads, no trackers, no analytics. We don’t sell your data or share it for advertising.
- Things disappear on the schedule you choose, and we tell you plainly where the limits are.
What we process to run Mahvo
- Account: a random account identifier and your Share Code. They aren’t linked to your name, number or email.
- Encrypted content: messages, media, Drops and settings, stored encrypted until they expire. We don’t hold keys that can decrypt them.
- Delivery metadata: which accounts are in a conversation, and when messages are sent and delivered. The server needs this to deliver messages. It never includes what the messages say.
- Push token: if you turn on notifications, a device token so Apple can deliver them. Notifications carry no message content.
- Network data: IP addresses in server logs, used for security and abuse prevention and kept for up to 7 days. Logs never contain message content.
What we don’t collect
Phone number, email address, contact book, location, advertising identifiers, analytics or diagnostics data.
How long things stay
- Messages expire on the timer chosen for them. Each message has its own expiry.
- Kept messages stay for 90 days at most.
- View Once and Drops are removed once they are opened or expire.
- Undelivered files are deleted from the server after 30 days at most.
- Encrypted backups: deleted data can remain in encrypted server backups for up to 7 days.
- Deleting your account removes it and its data from our servers. Backup copies age out within 7 days.
Limits we want you to know: expiry is carried out by the sender’s device. If that device is offline, deletion happens when it reconnects, and the server removes the item no later than the chat’s limit. Anyone you message can still take a screenshot or a photo of their screen.
Recovery words
Your 12 recovery words restore your account, contacts and settings, not past messages. We never see them and can’t recover them for you. Never share them with anyone, including us.
Who helps us run Mahvo
- The hosting provider that runs our servers.
- Cloudflare, for network security and delivery.
- Apple Push Notification service, for notifications.
They process only what they need to provide their service. We don’t sell personal data.
Requests from authorities
We respond to valid legal requests as the law requires. Because content is end-to-end encrypted, we can’t provide it. We can only provide the limited data described above, if it still exists.
Children
Mahvo is not meant for children under 13, and we don’t knowingly collect data from them.
Your choices and rights
In the app you can change timers, turn off notifications, change or remove your Share Code, and delete your account (Settings → Delete account). Depending on where you live, you may have rights to access or delete your data. Because we hold very little, the in-app controls cover most requests. For anything else, email privacy@mahvo.app. Never include recovery words or message content.
Security
Messages and media use the open-source Matrix end-to-end encryption protocols. Data is encrypted in transit and at rest on our servers.
Changes
If we change this policy, we’ll post the new version here with a new effective date. For significant changes, we’ll also tell you in the app.
Contact
Kinu Technologies LLC, 5900 Balcones Drive, Suite 100, Austin, TX 78731, USA. Email: privacy@mahvo.app