Montana is built so that there is almost nothing to collect. This page states exactly what the application handles, what leaves your device, and for how long anything is kept.
Identity
Montana has no accounts. There is no phone number, no e-mail address and no registration. Your identity is a 24-word phrase generated on your device; your Montana address is derived from it. We never see the phrase or the keys, and nobody, including us, can restore them for you.
Messages, calls and media
Every message, call, photo, video, voice message and file is end-to-end encrypted with post-quantum cryptography: ML-KEM-768 for the session, ML-DSA-65 for signatures, ChaCha20-Poly1305 for content. The keys live only on the two devices.
When both phones are reachable, a message travels directly between them. Otherwise it waits on a Montana node as a sealed envelope, and media as sealed chunks, that the node cannot open. Undelivered material is kept for at most 7 days and then deleted.
Voice and video calls are encrypted end-to-end; a node only forwards the call set-up inside the encrypted session and never holds a key to the audio or the picture.
Your history
Your conversations live on your device only. They are never sent to a server and never included in a platform backup. Deleting the application erases the history on that device; the 24 words bring back your identity and address, not the conversations.
Diagnostics
The application sends anonymous diagnostic logs to help us find and fix defects: event records, timings and error codes, together with the device model, operating-system version and application build.
The logs never contain message content, names, phrases or addresses. The diagnostic identifier is a random value unrelated to your identity, and the identifiers of your correspondents are replaced with irreversible salted hashes on your device before anything is sent. Logs are kept on a Montana node for at most 7 days and then deleted. They are not linked to you and are not used for tracking.
Permissions
Each permission is used on the device for one feature and nothing else. Camera and microphone: photos, videos, voice messages and calls. Photo library: choosing and saving media. Contacts and location: sharing a contact or a place in a chat, only when you choose to send one. Bluetooth and local network: finding your correspondent's phone nearby for direct delivery. Face ID: locking the application. Nothing from these sources is uploaded; a contact or a location leaves your device only as an encrypted message to the person you send it to.
Notifications
To wake a sleeping device we send a notification through Apple's service. It carries no content: the message is fetched and decrypted on your device after the wake-up.
No tracking
Montana contains no advertising, no third-party trackers, no third-party analytics and no third-party software development kits that report to anyone. Nothing is sold and nothing is shared with anyone. No data is used to track you across other applications or websites.
What we never have
Your recovery phrase. Your keys. The content of your messages and calls. Your contact list. Who you talk to. Where you are.
Children
Montana is not directed to children under 13 and knowingly collects no personal data from anyone.
Your choices
Deleting the application removes everything it stored on the device. Because Montana holds no account and no personal data about you, there is nothing to request, correct or delete on our side.
Changes and contact
Changes to this policy are published on this page with a new effective date. Questions: contact@montana.quest.