Privacy Policy

Effective date: October 3, 2026 (previous version: September 22, 2026)

Morse (hereinafter "Morse") complies with the relevant laws, including the Personal Information Protection Act of the Republic of Korea and the EU General Data Protection Regulation (GDPR). This Policy explains what information Morse handles and why, how long it keeps it, and how it deletes it. Please read it together with the Terms of Service.

1. Operator

• Operator: Yeong-Won Kim (individual, Republic of Korea)
• Data protection officer: Yeong-Won Kim
• Contact: bryan910508@gmail.com

2. Information Morse handles

Morse does not collect phone numbers, real names or address books. Below is the information the service actually uses to work.

2.1 Account

• Morse ID (8 random characters), display name, profile photo and bio (if you add them), sign-up time.
• Public key (a Curve25519 public key for secret chat encryption).
• A hash of your recovery code. We do not store the code itself. When you change the code, we also keep the hash of the previous code.
• The app lock PIN is stored only on your device. It is not sent to the server.

2.2 Sign-in methods

• All apps: a new account (random Morse ID) and a recovery code.
• On iOS and Desktop you can choose Sign in with Apple. On Android you can choose Google Sign-In.
• If you use Apple or Google sign-in, the identifier and email address that company provides are kept only in the Firebase Authentication record. They are not shown to other users and are not used for ads or analytics. If you use Apple's "Hide My Email", it is a relay address.

2.3 Chats and how the service works

• Messages: text, photos, videos, voice messages and files in regular chats. Stored on the server (Google Firebase).
• Contacts: the list of users you added in Morse. We do not read your device address book.
• Names and notes you give contacts: stored on the server so they look the same on all your devices. Only you can see them.
• Sync between devices: drafts you were typing, notes in "Saved Messages", folders, pinned chats, per-chat settings, installed stickers.
• Channels and groups: channels and groups you subscribe to or join, and the posts and comments you write.
• Stories: stories you post, who viewed them, and reactions. After the period you set, they are deleted from the server.
• Online status: whether you are online, your last-seen time, and the typing indicator (valid for only a few seconds).
• Login sessions: device model, OS version, app version, sign-in method, sign-in time and last-active time. They are shown on the "Active sessions" screen and do not include IP address or location.
• Push notifications: the notification token and device language of the phone apps. Desktop uses only computer notifications and has no token.
• Scheduled messages and "Send when online": kept in a server queue until they are sent.

2.4 Information other users can see

• To anyone: display name, Morse ID, profile photo, bio and public key ("public profile").
• To users who added you as a contact: in addition to the above, the other fields of your main account document — sign-up time, type of sign-in method (whether Apple or Google is linked), privacy and notification setting values, the auto-delete account period, and whether you are temporarily limited from sending because of flooding, and the reason. We plan to narrow this so that only the public profile remains.
• Last-seen time, profile photo and the like follow your privacy settings.

2.5 Information Morse does not handle

• Phone numbers, real names, device address books, location (there is no location message feature).
• Advertising identifiers (IDFA, AAID). We have not added any advertising, analytics or tracking tools, and we do not ask for app tracking permission (Firebase Analytics is off).

2.6 Screen capture and screenshots

• The app's "Screenshot" feature saves the screen to the photos app on your device only when you choose it. It is not sent to the server. Permission to save photos is asked only at that time.
• While you capture or record the screen, the other person's original name is shown instead of the name you gave them (to prevent impersonating others with fake screens, iOS). Secret chats and protected channels are hidden in screen recordings.
• When you take a screenshot, we do not notify the other person. Secret chat screens appear black in screenshots and screen recordings (Android, iOS).

2.7 Translation and voice transcription (only when you tap)

• Translation: done only on the device, and the result is stored only on that device. Message text is not sent to Morse servers or to cloud translation. iOS 26 and later and macOS use Apple Translation. Android uses Google ML Kit on-device translation (language models are downloaded from Google the first time you use it). Windows has no translation. Secret chats are not translated.
• Voice message to text: iOS uses Apple speech recognition, and the audio may then go to Apple servers. Android processes it on the device.

2.8 Error diagnostics

• If the iOS app crashes, the device model, OS version, error location and your internal Morse account number are sent to Google Firebase Crashlytics. They are used only to find the cause of the crash. The Android and Desktop apps do not send them.

2.9 Reports and restrictions

• When you report, we store the reporter, the target of the report (the ID of the user, message, comment, story, channel, etc.), the category, and the description you wrote.
• The operator does not normally look at messages. When a report comes in, the operator checks only the reported content and the messages just before and after it that are needed to decide. Secret chats cannot be viewed, so the decision is based on what the reporter shows.
• We review reports within 24 hours of receiving them (Terms of Service §5). If we restrict an account (a restriction for a period or a permanent ban), we record that fact and the period on the account.

2.10 Payments

• If you buy a channel post promotion on iOS, Apple processes the payment. Morse keeps the transaction ID, the product, the target channel and post, and the value that links the purchase to your account. We do not receive card information.

3. Purposes of use

The information above is used only to create and protect accounts, deliver messages and notifications, sync between devices, prevent abuse and handle reports, and fix crashes. It is not used for advertising, marketing or sale.

4. Encryption

4.1 Secret chats

• Encrypted from device to device with X25519 key exchange + AES-256-GCM. Private keys are only in the device's secure storage (iOS Keychain, Android Keystore).
• Messages and media pass through the server only in encrypted form. They are kept until the other device receives them (up to 30 days) and then deleted. The server cannot see the content, but it knows who sent how much and when.
• A secret chat opens only on the device where it was started. Desktop does not support secret chats.

4.2 Regular chats

• Encrypted with TLS in transit, and stored on the server in a form the operator can technically read (the same way as regular chats in Telegram). The operator does not look at them except to handle reports (§2.9) and legal requests (§6.3).
• If you do not want the content kept on the server either, use a secret chat.

4.3 Other protections

• TLS for all communication. Firebase Authentication and security rules block access to other people's data. App and device attestation (Apple App Attest, Google Play Integrity, and Google reCAPTCHA for Desktop and web) blocks requests from fake apps.
• Desktop encrypts the data it stores on the device and keeps the key in the operating system's secure store.

5. Retention periods

5.1 Deleting your account

• Delete it in the app under "Settings → Account & Security → Delete account". If you do not have the app, you can do the same deletion with your recovery code on the account deletion page.
• Deleted right away: account, profile, contacts and contact names, settings, sessions, push tokens, sync data, your channels, your stories, export files, sign-in account.
• What remains:
  • Messages and media you already sent remain in the other person's chat as from a "Deleted account" (your name and Morse ID are removed).
  • Comments you wrote in other people's channels.
  • A deletion marker (internal number and time) that keeps the same account from coming back.
  • Report records (1 year after handling) and accounts-per-device records.
• This cannot be undone.

5.2 Automatic account deletion

• It is off by default. If you turn it on, your account is deleted when you do not connect from any device for the period you chose (1, 3, 6 or 12 months; one month = 30 days). What is deleted is the same as in §5.1.

6. Service providers and disclosure

6.1 Companies we entrust with processing

• By default, push notifications include the beginning of the message (up to 160 characters) and the sender's name, and they pass through Google and Apple. You can turn off previews in Settings. Secret chat notifications contain no message content.

6.2 Advertising and sale

• We do not give information to advertising or marketing companies, and we do not sell it in any form.

6.3 Legal requests

• We respond only to lawful requests under the laws of the Republic of Korea (such as warrants), and only to the minimum extent necessary. Requests are received at bryan910508@gmail.com.
• What we can provide: account information, contact and block lists, channel subscriptions, regular chat messages and media, login session records, server records (30 days).
• What we cannot provide: secret chat content (it is encrypted, and even the operator cannot decrypt it), information that exists only on devices (app lock PIN, private keys, translation results, screen captures).

7. IP addresses

• Morse does not store original IP addresses.
• To prevent abuse of recovery code sign-in, account switching, web account deletion and Morse ID search, we briefly keep (about 1–2 hours) only a value made by converting the IP address with a secret key.
• Service infrastructure may handle IP addresses: Google (Firebase Authentication) keeps IP addresses for a few weeks for sign-in security (Google policy). IP addresses may also remain in Google Cloud function logs and Railway's access logs (Morse's code does not record them).
• The operator does not normally look at these records. The operator looks at them only for security incidents or legal requests.

8. Countries where data is stored

• The account and message database and the server functions are in Seoul, Republic of Korea, online status is in Singapore, and photos, videos and files are in the United States (Google Cloud). The message relay server (Railway) is in Singapore. Push, sign-in, error diagnostics and updates may be processed at Google, Apple and GitHub facilities abroad.
• Whichever country you use Morse from, data is stored in the locations above. Data of users in Russia is also stored outside Russia (this differs from the local storage principle of Russian Federal Law 152-FZ). EU users have rights under the GDPR (§9).

9. Your rights

9.1 What you can do directly in the app

• View and edit your information: your name at the top of Settings.
• Download your data: Settings → Account & Security → Data management → Download my data (Desktop: Settings → Privacy → Data management). Account information, contacts, contact names, block list, channel subscriptions and settings are put in a JSON file. Messages are not included. The link is deleted after 24 hours, and the file after 2 days.
• Privacy, auto-delete account, active sessions, block list, account deletion: Settings → Account & Security.
• Delete messages: press and hold a message → Delete for everyone.
• Block and report: the other person's profile → More.

9.2 What you can ask the operator

• Access, correction, deletion, suspension of processing, export, withdrawal of consent. Send your request to bryan910508@gmail.com. We reply within 10 days of receiving it.
• A deleted account cannot be restored.

10. Children under 14

• Children under 14 cannot sign up. If we find such an account, we delete it (Terms of Service §2). If you are a parent or guardian and find one, please tell us at bryan910508@gmail.com.

11. Cookies and tracking

• The apps do not use advertising identifiers or tracking permission.
• The Desktop app and the web account deletion page use Google reCAPTCHA to block fake requests, and reCAPTCHA may set cookies (Google Privacy Policy and Terms).

12. Security incidents

• If a breach or other incident happens, we stop it right away and check its scope. Within 72 hours we announce it on this page and in the app (where possible), and as the law requires we report it to the Personal Information Protection Commission (개인정보보호위원회) (or to the competent supervisory authority if EU users are affected).

13. Changes to this Policy

• When we change this Policy, we announce it on this page with the effective date. Important changes that are against users' interests are announced 7 days before they take effect.

14. Contact

• Email: bryan910508@gmail.com
• We review reports within 24 hours of receiving them, and we reply to privacy requests within 10 days.
• Users in Korea can also ask these agencies for help: Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회) 1833-6972 (kopico.go.kr), Personal Information Infringement Report Center (개인정보침해신고센터) 118 (privacy.kisa.or.kr), Cyber Investigation Division of the Supreme Prosecutors' Office (대검찰청 사이버수사과) 02-3480-3573, Cyber Investigation Bureau of the Korean National Police Agency (경찰청 사이버수사국) 182.

Morse © 2026 Yeong-Won Kim. All rights reserved.