A code, or a password
A code sent to your email always works. A password is optional and is stored as a PBKDF2-SHA512 hash, never as the password itself. Sign-in attempts are rate-limited, so a password cannot simply be guessed.
Security & privacy
Your chats stay yours.
Direct messages are encrypted before they are stored, the servers are in the Netherlands, there are no ads, and an AI tool only gets in when you let it. This is how mssgs protects your account, your messages and your data.
- Encrypted DMs Every direct message is encrypted with its own key before it is stored.
- Hosted in the Netherlands The servers mssgs runs on are hosted with BIT in Ede.
- No ads, no tracking Your data is not sold, and nobody profiles you for advertisers.
- Never used to train AI Not your messages, not your photos, not your files.
Your account & sign-in
Only you get in.
No phone number and no real name needed. Sign in with a code by email, add a password if you like, and put a second step in front of both.
Two-factor, your way
A passkey (Face ID, Touch ID, Windows Hello or a security key), an authenticator app, a hardware key or SMS, with ten single-use backup codes. Removing a method asks you to prove it is you first.
Passkeys in your own browser
On a computer, the passkey step opens in your own browser. The app hands it a single-use code, never your session, and the passkey stays where your browser keeps it.
Every device in one list
Settings → Devices shows where you are signed in, with the city and when it was last active. Remove one and it is signed out at once. Sign-ins that got your password right but failed the second step are listed too.
An email when it matters
mssgs emails you when your account signs in from a new IP address, when a two-factor method is added or removed, and when your password changes. Not you? You know straight away.
Your messages
Private chats, kept private.
Direct messages are encrypted before they are stored. On top of that you decide which chats need a code to open and which messages should not stick around.
Encrypted DMs
Every direct message, group DMs included, is encrypted with AES-256-GCM before it is stored, with a key of its own for each conversation that is kept apart from the messages. The apps reach our servers over encrypted connections (TLS).
A lock on any chat
Put a 4-digit pincode on a DM, and unlock it with Touch ID on a Mac. A locked chat stays blurred until you unlock it, locks again when you step away, and stays locked on your other devices too.
Messages that do not stay
Ghost messages disappear once you have both read them and left the chat, or on a timer of 1 hour, 24 hours or 7 days. A one-time photo or video opens once: you see when it was opened, and when it was saved.
Nobody out of the blue
A new conversation starts as a request that you accept or decline. Nobody lands in your chats just because they know your username.
Your data, in the EU
Stored in the Netherlands. Never sold.
mssgs is made by a Dutch company and falls under Dutch law and the GDPR. Your data is not what we sell: mssgs is paid for by Premium and credits.
Servers in the Netherlands
The servers mssgs runs on are hosted with BIT, a Dutch provider with its own data centre in Ede. Not with an American cloud.
Backups the servers cannot touch
Every night a backup is pulled from the data centre to a second location. The servers hold no key to it, so even a server that was broken into cannot reach the backups.
No ads, no tracking
There are no ads in the app and nothing that tracks you for an advertiser. Your data is not sold.
Not used to train AI
Your messages, photos and files are never used to train AI. An AI tool only reaches your account if you connect one yourself, on your own computer.
Delete it, or ask about it
Delete your account in Settings with a code sent to your email. For 30 days it can still be restored through support, then it is gone for good. To use your other rights under the GDPR, write to privacy@mss.gs.
Safety & moderation
You decide who reaches you.
Block someone without a word, report what crosses a line, and see what came of it. Reports are judged by people.
Blocking is quiet
Block someone from their profile, a message or a DM. They are not told, and blocking does not file a report, so you can do both.
Reports you can follow
Report a message, a DM, a person, a story or a community, with the messages around it. Settings → Reports shows whether each one is in review, removed or left as it was. Who reported you is never shown.
People decide, not the owner
Reports go to volunteer mssgs community moderators, who vote. mssgs staff decide alone only when it is urgent or the law requires it, and a report never goes to the community’s own owner.
Stories for the right people
Share a story with everyone, with friends only or with a private group whose members you pick. Someone who leaves the group or is removed loses access straight away.
Kids & parents
Parents look out, without reading along.
mssgs is for ages 13 and up, and until 16 a parent or guardian is involved. The Parent Center links the two accounts.
The child asks, the parent accepts
The child types the connect code from a parent’s Parent Center. Nothing is shared until the parent accepts.
Who and how long, never what
A parent can see who the child talks to and how long they are connected. Never the contents of a message, and never where the child is.
An age range, not a birthday
mssgs uses the age range the phone’s platform provides, such as Apple’s declared age range, and stores only that range, never a date of birth.
Zero tolerance for abuse
Child sexual abuse material is never allowed. Confirmed material is reported to NCMEC or the relevant authority, and mssgs can step in without waiting for a community’s moderators.
The desktop app, AI tools & File Drop
An AI tool gets what you hand it. Nothing more.
The desktop app can let an AI tool on your computer work in mssgs through a built-in MCP server, show games what you allow, and hand files to someone nearby. Nothing gets in without your say.
Only on your computer
The MCP server listens on 127.0.0.1 only and turns web pages away, so nothing on the network can reach it. Every request needs a token: give each AI tool its own, and revoke one without touching the others.
Off until you allow it
Switched off to start, read-only once you turn it on, and limited to the channels you pick. Sending, your DMs, managing a community and File Drop each have their own switch, and a message always goes out as you.
Games have to ask
A game on your computer asks before it learns anything about you, gets only what you approve, and is bound to the account that said yes. Settings → Game Activity lists every game you allowed.
File Drop, with a code
A first drop shows a code on the receiver’s screen that the sender types in; five wrong codes end it. The receiver accepts every drop, and when files cannot go directly they pass through our relay, which stores nothing.
Apps you can check
The Mac app is signed with an Apple Developer ID and notarized by Apple, and the Windows app is signed by Deverence Group B.V. Updates download over HTTPS.
Responsible Disclosure
Found a security problem?
Tell us first. Write to security@mss.gs with what you found and how to reproduce it, and give us time to fix it before you share it. Please only test against your own accounts and data.
Questions
Frequently asked questions about security
Are my messages encrypted?
Direct messages, group DMs included, are encrypted with AES-256-GCM before they are stored, with a separate key for each conversation that is kept apart from the messages. Messages in community channels do not get this extra layer, so they can be searched and moderated. Every connection between the apps and our servers is encrypted with TLS.
Where exactly is my data stored?
On servers in the Netherlands: the servers mssgs runs on are hosted with BIT, a Dutch provider with its own data centre in Ede. Every night a backup is pulled to a second location.
Is my data sold?
No, never. We make money from the product, not from your data.
Are my messages used for AI?
Your messages, photos and files are never used to train AI. An AI tool can only work in your account if you connect one yourself in the desktop app, and then only in the channels you pick.
Is there 2FA?
Yes, two-factor authentication is available for all accounts.
What if someone else gets into my account?
Open Settings → Devices and remove every device you do not recognise: it is signed out at once. Then change your password and check your two-factor methods. mssgs emails you when your account signs in from a new IP address, so you can act quickly.
How do I delete my account?
Choose Delete Account in Settings and confirm with the code mssgs emails you. For 30 days the account can still be restored through support; after that it is gone for good.
Is mssgs GDPR compliant?
mssgs is a Dutch company and falls under the GDPR. The privacy policy explains what is collected and why. To use your rights, write to privacy@mss.gs; business customers can ask there for a data processing agreement.
How do I report a security issue?
Write to security@mss.gs with what you found and how to reproduce it. Please give us time to fix it before you share it.
Want to know more about our security?
The privacy policy has the details, and the help desk explains every setting. Questions about your data go to privacy@mss.gs.