The facts

Signing up

• We ask for a username, an email, a password and your date of birth. You must be 13 or older.
• No phone number, no ID and no face scan to join, chat or call. Exactly what we ask for.
• No account at all to talk: start a room from the home page and send the link. A guest types a name and is in.
• Your date of birth is never shown to other people.

Where it is kept

• Accounts, messages and files: in the United States (Virginia), on Supabase’s database and file storage.
• Voice and video calls: on our own voice server in Frankfurt, Germany.
• A recorded call turned into text: on our own server in Frankfurt. The audio is not sent to another company for this.
• The app itself runs on Vercel, in the United States. Every company we use, and where: the full list.

Who can read your messages

• Messages are not end-to-end encrypted. They are encrypted on the way to our servers and stored there, so our system can read them.
• The people in the channel, group or direct message can read them.
• Our staff see a message when it is reported to us. There is no staff tool for reading anyone’s messages.
• Calls are encrypted on the way and pass through our voice server. A call is only recorded where the space allows it, by someone with the permission, and everyone in the call is told. Rooms without an account are never recorded.

IP addresses

• We do not save your IP address on your account, or when you chat, talk or sign in.
• We use it for a moment to slow down abuse, like too many sign-in tries. Those counters are deleted soon after.
• For a room without an account, the starter’s address is kept scrambled, so it cannot be read back, for 7 days in case the room is reported. Then it is deleted.
• Our hosting companies keep their own request logs, which include IP addresses.
• The one place an IP address is kept as a record: signing a contract in a workspace, where it is part of the proof of who signed.

Photos and files

• Up to 10 MB a file, 10 files a message.
• A photo loses its hidden data (the place it was taken, the phone that took it) before anyone else can download it. The picture itself is not touched.
• Files sent in a direct message are deleted after 30 days.

AI

• We do not train AI on your messages, and we do not sell them to anyone who does.
• We do not run AI on your messages with a key of ours. The AI buttons (sum up, write, pull out) only work with an AI key you add yourself, or one your workspace adds. What is sent then goes to that AI company, under that key.

Ads, tracking and money

• No ads and no ad trackers. We do not sell personal information.
• MySquare is free. Later, owners of big spaces will pay for extra capacity. Members never will.

Your account

• Download your data, or delete your account, yourself, in Settings. Deleting asks for your password.
• Deleting wipes your name, email and picture and closes the sign-in. Messages you sent stay where you sent them, under a deleted name.
• Passwords are stored scrambled (bcrypt). We cannot see them, only reset them.
• Two-step sign-in is there if you want it: a 6-digit code from an authenticator app after your password. No phone number needed. Switch it on in Settings.

The software

• MySquare is not open source. The code is ours and runs on our servers, so you cannot run your own copy.
• Not here yet: a phone app and a Mac app. Today it runs in your browser, or as an app on Windows.
• There is no public bot or developer API yet.
• A Discord server’s layout can be brought over: how.

Questions

Read next

• SecurityHow MySquare protects accounts and data, what is not done yet, and how to report a security problem to us.
• SafetyHow MySquare keeps people safe: who can message you, blocking, reports and where they go, what moderators can do, the age rule and the limits on rooms without an account.
• PrivacyWhat data MySquare collects, how it is used, who it is shared with and the rights you have over it. Personal information is not sold.