Privacy Policy

Mist · Effective 23 October 2026

1. Who we are

The Mist app, a private space for communication and teamwork (the "Service", "Mist", "we") is operated by Dale Technologies Limited, a company incorporated in the Republic of Seychelles, registered address: 306 Victoria House, Victoria, Mahé, Seychelles. The Service is available at mist-app.com and as iOS and Android apps. Questions about this Policy: support@mist-app.com.

2. The short version

• Private and group conversations, the attachments in them, personal calls and voice chats are end-to-end encrypted. Encryption keys are created and kept only on your devices. We store ciphertext we cannot read.
• Signing up requires neither a phone number nor an email address. Your account is accessed with a 12-word secret phrase that we do not store and cannot recover.
• We do not sell data and do not embed tracking SDKs.
• Not everything in the Service is end-to-end encrypted. Section 4 says exactly what is not, and why.
• AI features (the AI tab, the assistant, workspace AI agents) send data to the third-party services named in section 4, chiefly Google (Gemini). In the iOS and Android apps nothing is sent to them until you allow it.

3. What data we process

3.1. Account

Account identifier, username, display name, avatar (if you upload one) and public encryption keys. Your secret phrase, phone number and email address are not collected.

3.2. Messages and files in chats

The content of private and group messages, including photos, videos, voice messages and files, is encrypted on your device before it is sent. The server stores it encrypted and delivers it to recipients as is. We have no technical means to read it.

What we do see unencrypted is metadata: who sent a message to whom and when, its type (text, photo, voice, etc.) and size. This is needed to deliver messages and show your chat list.

A message can be deleted for everyone, and a chat can be set to disappearing messages. Deleted messages and their files are removed from the server.

3.3. Calls

Personal calls (audio and video) and group voice chats are end-to-end encrypted: media passes through our server in encrypted form. We keep a record that a call took place: participants, start and end time, duration. Call content is never recorded or stored.

3.4. Notifications

To deliver push notifications we store a device token issued by Apple (iOS), Google (Android, Firebase Cloud Messaging) or by your browser (web). The text of an encrypted message reaches a notification only in encrypted form: your device decrypts it, and neither we, Apple nor Google can read it. You can turn off message text in notifications in settings ("Message content"); a notification then carries only the event type ("new message", "photo") and the sender's name. On iOS we also store a separate VoIP push token so that incoming calls ring on the call screen (CallKit); such a notification is delivered by Apple and carries the caller's name and avatar and whether it is a video call.

3.5. Technical data

Server logs record the IP address, device and browser type, and time of each request. Logs exist for security and troubleshooting and are deleted automatically after 14 days.

3.6. Analytics

The web version uses an analytics system hosted on our own server. It counts visits, sets no cookies, does not identify you, and shares nothing with third parties. The iOS and Android apps contain no third-party analytics SDKs.

3.7. Subscriptions

Pro and Ultra subscriptions are purchased through the App Store in the iOS app, and through third-party payment providers on the website. The Android app has no in-app purchases; your account's plan applies on all devices. The provider processes the payment; we never receive or store payment details. We store only your subscription status, its expiry date and a payment identifier. In the iOS app, App Store purchases are verified through RevenueCat, which receives a pseudonymous app user ID derived from your account (not your account ID, username or name) and the App Store purchase history for Mist.

4. What is not end-to-end encrypted

The parts of the Service listed below are, by their nature, readable by the server. By using them you accept this.

• Public channels. Posts and comments are visible to every subscriber, stored on the server in plain form, and may be reviewed for moderation.
• Team workspaces. Chats, tasks and notes marked as visible to the whole team are stored on the server in plain form so that every member and the workspace's AI agents can access them. Personal workspaces and items with private visibility stay encrypted.
• AI tab. To produce a reply, your question and any attached photos or documents are sent through our server to the model provider, Google (Gemini), whose processing terms apply. Prompts for image generation are sent to Google's Gemini image model. The AI tab's conversation history is kept only on your device (in the app or in your browser); our server does not store it and keeps only a record of requests (time, request type, network address) for plan limits. The iOS and Android apps send AI tab requests only to Google.
• Web search. When a reply from the AI tab or the assistant needs current information, Google (Gemini) turns your question into a short search query, which is sent without your name or account data to the search service Serper (serper.dev); our server then fetches the pages found.
• AI assistant. The assistant is a chat in Mist. Its messages are stored on our server encrypted with a key the server holds, so they are not end-to-end encrypted and the server can read them; like other bot messages, they are deleted after 30 days. To answer, your message and the last five questions and answers, which we keep in your assistant settings for context, are sent to Google (Gemini). To write your morning and evening briefings, reports and price-move alerts, Google (Gemini) receives the topics, companies, coins and keywords you follow, and your language; report pages are kept on our server for 30 days.
• Reminders. When you ask the assistant to remind you of something, the reminder text and your local time are sent to Google (Gemini) to work out when to remind you. The reminder text, its time and repeat schedule are stored on our server in plain form (otherwise the server could not deliver it on time) and remain there after delivery.
• Workspace AI agents. The owner of a team workspace can connect an external AI tool of their choice, for example Claude Code, Cursor or Codex, as an agent member with an access token (via MCP). The agent can read the tasks delegated to it and their comments, messages that @mention it, and the workspace's shared tasks, notes and team chat; it can reply, and create and update tasks and notes. The owner chooses the service, and that service's own terms and privacy policy apply to the data it receives. Encrypted items (personal workspaces and items with private visibility) are not available to agents.
• Messages to official Mist accounts (such as support) are not end-to-end encrypted; otherwise we could not reply.
• Bots. A bot is an account operated by its creator through our server: everything a bot sends you arrives at the server over HTTP from the bot's creator, and everything you write to a bot is passed by the server to the creator. A conversation with a bot is therefore not private from the server or from the bot's creator, although it is stored encrypted. A bot can message you only after you have started it yourself, receives only an opaque chat identifier and the start parameter, and has no access to your contacts, chats or profile. You can stop a bot at any time. Bot messages are kept for 30 days.
• Mist Meet conferences are protected by transport encryption (DTLS/SRTP). Because participants without an account may join, end-to-end encryption is not applied.

Your consent. Before the Mist app for iOS or Android first sends anything to an AI service, it asks for your permission and explains what is sent and to whom; until you allow it, nothing is sent. You can withdraw consent at any time in Settings → Privacy ("Allow AI requests"); this also turns the assistant off, so it stops sending briefings and alerts. AI requests are not end-to-end encrypted, so do not send passwords or payment details in them. We do not use your conversations to train models.

5. Why we use data

• to run the Service: message delivery, calls, notifications, sync between devices;
• for security: protection against spam and abuse, enforcing plan limits, investigating reported violations;
• to provide support;
• to comply with legal obligations.

We do not use the content of your conversations or your contacts for advertising or any other commercial purpose.

6. Who receives data

We use providers that process data on our behalf, limited to what their service requires:

• Apple: push notification delivery (including VoIP notifications for incoming calls) and App Store payment processing;
• RevenueCat: verification of App Store subscriptions in the iOS app; it receives a pseudonymous app user ID and your App Store purchase history for Mist, without your name or username;
• third-party payment providers: processing of subscription payments made on the website;
• Google: processing of requests from the AI tab, the assistant, briefings, alerts and reminders, and image generation (Gemini; see section 4), and Android push notification delivery (Firebase Cloud Messaging);
• Serper (serper.dev): short web-search queries for AI answers, without your name or account data;
• a cloud storage provider: storage of uploaded files (encrypted, for chats) and database backups;
• hosting providers for our servers in Europe.

Each of these third parties, including Google, Serper and RevenueCat, may use the data only to provide its service to us and is bound by its terms with us to give it the same or equal protection as set out in this Policy. An AI tool that a workspace owner connects as an agent (section 4) is not our provider: the owner chooses it, and its own terms apply.

We may disclose data we hold in response to a lawful and binding request from a competent authority. Note that we cannot disclose the content of encrypted conversations, because we do not have it.

7. How long we keep data

• account data, encrypted messages and files: until you delete them or delete your account;
• videos in chats: 30 days from the moment they are sent, after which the file is deleted automatically; the message stays with a note that it was removed;
• disappearing messages: until the timer you set expires;
• server logs: 14 days;
• messages in chats with bots, including the AI assistant, and the assistant's report pages: 30 days;
• database backups: up to 30 days. Deleted data leaves the backups as they rotate.

8. Your rights and controls

• You can delete your account at any time in the app's settings. All your data on our server is removed with it: profile, messages, files, call history. The AI tab's conversation history is kept on your device and can be deleted in the app.
• Individual messages, files and AI conversations can be deleted in the app.
• You edit your profile data yourself in settings.
• For access, correction or deletion requests, or complaints, contact support@mist-app.com. We respond within a reasonable time.

Where the law of your country grants additional rights over personal data, we respect them and will help you exercise them.

9. Children

The Service is intended for people aged 13 and over (or older where the law of your country requires). We do not knowingly collect data from children under that age. If you learn that a child is using the Service in breach of this rule, tell us and the account will be removed.

10. Security

End-to-end encryption keys are derived from your secret phrase and never leave your device. Connections to the server are protected by TLS. No system is perfectly secure; keep your secret phrase safe and never share it.

11. International transfers

We are incorporated in the Republic of Seychelles; the Service's servers are located in the European Union. Some providers listed in section 6 are in the United States. When we transfer data to them we limit it to the necessary minimum and rely on their contractual data-protection commitments.

12. Changes to this Policy

We may update this Policy. We will notify you of material changes through the Service. The current version is always available at mist-app.com/privacy; the effective date is shown at the top.

13. Contact

Dale Technologies Limited
306 Victoria House, Victoria, Mahé, Seychelles
Email: support@mist-app.com
Website: mist-app.com