Mystiko

Privacy policy

Effective November 14, 2026

Mystiko is an encrypted messaging app for Android, published by Sigalion Labs ("we"). This policy covers the Mystiko app, the server that passes messages between phones (the "relay"), and this website.

What we cannot see

• The content of your messages.
• Who sent a message. The sender's identity is inside the encrypted message.
• How long the sender chose to keep a message.
• The names you give your contacts, your chat history, or your encryption level. These stay on your phone.

What our relay stores

• Your public keys and Mystiko ID. These are created on your phone when you first open the app. Other people's phones need them to encrypt messages to you. They are not secret, and the ID is derived from the keys. Your private keys never leave your phone.
• Encrypted messages waiting for delivery. A message addressed to you is held until your phone collects it, and then it is deleted from the relay. A message nobody collects is deleted after 30 days. While it waits, it exists only in encrypted form.

The relay keeps no record of who has talked to whom, and it does not log the requests it receives. The server's error log can include the IP address of a connection that failed, and that log is kept for no more than 14 days.

Network information

Any device that connects to a server on the internet reveals its IP address to that server's hosting and network providers. The relay runs on a server rented from DigitalOcean in the United States. We do not use IP addresses to identify you or to build a profile, and the relay does not attach them to your Mystiko ID.

What stays on your phone

• Your private keys, stored encrypted with a key held by the Android Keystore.
• Your contacts' names as you typed them, your messages, and your settings, all stored encrypted on the device.

The app turns off Android's cloud backup for this data, because a backup could not be decrypted on another device. If you uninstall the app or lose your phone, this data is gone and we cannot recover it.

How long messages last

The sender of each message chooses how long it is kept: until it has been read, for 5 days, for 30 days, or with no limit. The sender can also delete a message they sent. These choices are carried out by the app on each phone. They cannot stop a recipient from copying a message by other means, such as photographing the screen.

Inviting someone by text message

If you choose "Invite by text", Android's contact picker lets you select one person, and the app receives that one phone number so it can open your texting app with an invitation already written. You send the text yourself. Mystiko does not read your contact list and does not send the number to us.

Subscriptions and payments

Subscriptions are sold through Google Play. Google processes the payment, and we never receive your card details. Google tells the app which subscription is active so the app can apply your encryption level. Google's handling of your purchase is covered by Google's own privacy policy.

Notifications

The app checks for new messages in the background and can show a notification saying that a message has arrived. The notification never includes the sender or the content.

Permissions the app uses

• Internet: to reach the relay.
• Notifications: to tell you a message has arrived.

The app does not request access to your contacts, text messages, location, camera, microphone or files. It contains no advertising or analytics software.

Deleting your data

Uninstalling Mystiko deletes your keys, contacts and messages from your phone.

To have your public keys and any waiting messages removed from the relay, email support@sigalionlabs.com with your Mystiko ID, which is shown in the app under the person icon. We hold no name, email address or phone number for you, so the ID is the only way we can find your record. We will delete it and confirm.

This website

This site sets no cookies and includes no analytics, advertising or third-party scripts. It is hosted by GitHub, which, like any web host, processes the IP address of a device requesting a page.

Children

Mystiko is not directed at children under 13, and we do not knowingly collect information from them.

Requests from authorities

If we are legally required to hand over data, the only data we hold is what is listed under "What our relay stores": public keys, Mystiko IDs, and encrypted messages not yet delivered. We do not hold the keys that would decrypt those messages.

Changes to this policy

If this policy changes, we will post the new version at this address and update the effective date.

Contact