Effective as of October 20, 2026. Replaces the version of September 26, 2019.
IMMUNE (“IMMUNE”, “we”) is a messenger with end-to-end encrypted messaging and calls and a built-in non-custodial cryptocurrency wallet (the “Services”). This policy explains what data we process, why, and what choices you have.
You create an account by choosing a username (nickname). A phone number is not required. Your encryption keys and wallet keys are generated on your device and never leave it unencrypted. Access to your account on a new device is restored with your recovery phrase.
We store on our servers: your username, user ID, public key, and optionally a profile name, profile photo and phone number if you add them in Settings. A phone number, if added, lets people who have it in their address book find you.
Messages, photos, videos, voice messages, files and calls between IMMUNE users are end-to-end encrypted. We cannot read them. Encrypted messages are queued on our servers (Google Firebase) until the recipient's device receives them; encrypted files are stored in Google Firebase Storage. Your message history is stored on your device. Calls are established peer-to-peer or relayed through our servers in encrypted form.
Messages you send to IMMUNE bots, and messages in Mattermost or other external chat servers that you connect to IMMUNE, are not end-to-end encrypted with respect to that bot or server: they are processed by our bot servers and by the external server you connected, to deliver the service. If you connect an external account, we store the sign-in data needed to access it on your behalf.
If you allow access to your address book, phone numbers from your contacts are sent to our servers to check which of your contacts use IMMUNE. They are used only for this lookup. Contact access is optional; you can use IMMUNE without it.
The wallet is non-custodial: private keys and the recovery phrase are kept only on your device. We never have access to your funds and cannot restore your keys.
To show balances and history and to prepare and broadcast transactions, the app sends your public wallet addresses or extended public keys and transaction data to our servers, which query blockchain data providers. To notify you about incoming transfers, we keep your public addresses linked to your device. Exchange rates are loaded from public rate services without any personal data. Blockchain transactions are public by nature and cannot be deleted.
If you enable backup, your data is encrypted on your device with your key before it is uploaded to Google Firebase Storage. We cannot decrypt it.
We store a record for each of your devices: a device identifier, push notification token, device model, operating system and app version. It is needed to deliver messages, calls and notifications through Google Firebase Cloud Messaging and Apple Push Notification service.
We use Google Firebase Crashlytics to receive crash reports and technical diagnostics (device model, OS version, app state at the time of an error). The app may also send error reports with your user ID to our own monitoring service. For troubleshooting, we may temporarily enable detailed technical logs of calls or media playback; these do not contain message content.
We do not use advertising identifiers, do not show ads and do not sell your data.
| Recipient | Purpose |
|---|---|
| Google (Firebase Realtime Database, Storage, Cloud Messaging, Crashlytics) | Hosting, message queue, encrypted files and backups, push notifications, crash reports |
| Apple (Push Notification service) | Notifications on iOS |
| Blockchain data providers | Balances, history and broadcasting transactions (public addresses only) |
| External chat servers you connect (e.g. Mattermost) | Delivering your messages in those chats |
These providers act on our behalf or at your request and are bound by their own privacy terms. We may also disclose data where required by law, to enforce our Terms, or to protect against fraud, security issues or harm to users or the public.
We keep your account data until you delete your account. You can delete it in the app: Settings → Delete account. This removes your profile, device records, encrypted backups, profile photo, wallet addresses registered for notifications, bot subscriptions, bots you created and the data bots keep about you from our servers, and the data on your device. You can also request deletion by email at info@immune.im from the account's username. See how to delete your account.
Encrypted messages not yet delivered are removed from the queue after delivery or account deletion. Public blockchain records cannot be deleted by anyone.
The Services are intended for users aged 18 and over.
You can view and update your profile in Settings, object to processing or request deletion of your data. If you believe your rights are violated, you can complain to your data protection supervisory authority.
We will update this policy when the Services change and show the effective date at the top.
info@immune.im
IMM MONEY MESSENGER LIMITED, The Black Church, St. Mary's Place, Dublin 7, D07 P4AX, Ireland.