Montana is built so that there is almost nothing to collect. This page states exactly what the application handles, what leaves your device, and for how long anything is kept.
Identity
Your identity is a 24-word phrase generated on your device. We never see the phrase or the keys, and nobody, including us, can restore them for you. There is no registration and no e-mail address. Two things are optional and leave your device only if you choose them: a public @name and a confirmed phone number, described below.
Public name
If you take a public @name, Montana's keeper of names holds it beside the public key it points to, so that anyone who knows the name can start a chat with you; your link is montana.quest/n/ followed by the name. The name stays yours while the application renews it and is released when you delete your account.
Phone number
If you confirm a phone number, the confirmation runs through a bot in another messaging service, which already knows your number from your account there. Montana's confirmation service holds the number in memory only while the confirmation runs, at most thirteen minutes, signs the confirmation, hands it to your device and keeps nothing: no number, no name, no username, nothing on disk and nothing in its logs. The confirmation stays on your device and, sealed with your 24 words, in your own copies of the history. Confirming a number is optional, and your profile, Edit, Phone number, Remove Number takes it off your device at any time.
With the confirmation the service also passes your device the name, bio, photo and username of your account in that messaging service. The application offers them for your Montana profile: it fills only what your profile still lacks and only what you leave on, and forgets the rest. What you take becomes part of your profile, which the people you write to and whoever holds your card link can see; the username becomes your public @name only if you turn that on.
Messages, calls and media
Every message, photo, video, voice message and file is end-to-end encrypted with post-quantum cryptography: ML-KEM-768 for the session, ML-DSA-65 for signatures, ChaCha20-Poly1305 for content. Voice and video calls are encrypted end to end by DTLS-SRTP, the standard of calls on the internet, which is not post-quantum; each call's DTLS fingerprint is authenticated inside the post-quantum channel. The keys live only on the devices of the people in the conversation.
When both phones are reachable, a message travels directly between them. Otherwise it waits on a Montana node as a sealed envelope, and media as sealed chunks, that the node cannot open. Undelivered material is kept for at most 7 days and then deleted.
Every phone running Montana is also a small node. While the application runs, it accepts connections from other Montana devices and may carry other people's sealed envelopes on toward their recipients; it cannot open them and reads nothing in them. A device connected to yours sees your phone's network address while the connection lasts, as with any connection between two devices.
Voice and video calls are encrypted end-to-end; a node only forwards the call set-up inside the encrypted session and never holds a key to the audio or the picture.
Two features reach beyond Montana, and only when you use them. A search for moving pictures goes to a Montana node, which asks a picture service and brings the pictures back: that service sees the node and the word searched, never you, and the node writes neither the word nor your address into its journal. A link you send gets its card from your own device, which reads that page once, so the site sees your device's address; whoever receives the link reads nothing until they open it. Settings › Privacy › Link previews turns this off.
Your history
Your conversations live on your device. So that your 24 words can bring them back on a new phone, copies of your history leave the device only sealed with your 24 words, and whoever holds them cannot open them. The people you write to keep sealed parts of your copy, each part with two of them; they see only its size and when it changes. Once a day a sealed copy of your letters, profile and list of conversations, without attachments, is laid on Montana nodes and kept there for a week. Your phone in turn keeps sealed parts for the people who write to you, and cannot open them. Both are on by default and are turned off in Settings › Data and Storage (Keep my copy with my contacts, Keep parts for my contacts). If you turn on the copy in your own iCloud, or name a server of your own, the copy goes there too, sealed the same way. Deleting the application erases the history on that device; it opens again only from the same 24 words.
Diagnostics
Diagnostics leave your device only if you turn on Settings › Privacy › Share diagnostics; it is off until you do. They then carry event records, timings and error codes, the system's crash and hang reports and its daily count of processor time and data used, together with the device model, operating-system version and application build. With sharing on, the app also tells a network that lets through only permitted destinations from one that is down: about once an hour, and once a minute while a Montana node does not answer, it asks a few public websites for the header of a small file; those sites see your device's address, as with any visit, and no mark of Montana.
The logs never contain message content, names, phrases or addresses. The diagnostic identifier is a random value of this installation, unrelated to your identity, and it is forgotten when you turn sharing off. The identifiers of your correspondents are replaced with irreversible salted hashes on your device before anything is sent. Logs are kept on a Montana node for at most 7 days and then deleted. They are not linked to you and are not used for tracking.
Permissions
Each permission is used on the device for one feature and nothing else. Camera and microphone: photos, videos, voice messages and calls. Photo library: choosing and saving media. Contacts: sharing a contact in a chat, and saving the people you add in Montana to your contacts by their @name; turn this off in Settings › Privacy › Sync contacts. Location: sharing a place in a chat, only when you choose to send one. Face ID: showing your 24-word recovery phrase. Nothing from these sources is uploaded; a contact or a location leaves your device only as an encrypted message to the person you send it to.
Notifications
To wake a sleeping device we send a notification through Apple's service. It carries no content: the message is fetched and decrypted on your device after the wake-up.
To know which device to wake, the Montana nodes that send these notifications keep this installation's two Apple notification tokens, one for messages and one for calls, beside daily labels of your conversations. Each label is computed on the phones from the conversation's own secret and changes every day, so it names neither you nor the people you write to. A label the application stops renewing is deleted within 31 days, and a token as soon as Apple reports it no longer valid.
No tracking
Montana contains no advertising, no third-party trackers, no third-party analytics and no third-party software development kits that report to anyone. Nothing is sold, and nothing about you is shared beyond what this page names. No data is used to track you across other applications or websites.
Reports
When you report a letter or a person, the application prepares an e-mail to contact@montana.quest; it leaves only when you send it from your own mail account, so we also see that e-mail address. It carries the reason you chose, your Montana address, the reported person's address and the name you see for them, the reported letter's identifier and text, and the application's build number. We use it only to review the report, act on it and answer you. It is the one way the text of a letter can reach us.
What we never have
Your recovery phrase. Your keys. The content of your messages and calls. Your contact list. Who you talk to. Where you are. The one exception is a report you send us yourself, described above.
Children
Montana is for people 18 and older, as its terms require. It is not directed to children and does not knowingly collect personal data from anyone under 18.
Your choices
Settings › Privacy › Delete account erases your identity from the device and releases your public name at the keeper of names. Deleting the application removes everything it stored on the device. Questions and requests: contact@montana.quest.
Changes and contact
Changes to this policy are published on this page with a new effective date. Questions: contact@montana.quest.