Scope and publisher
This policy applies to the Connect mobile application and to the publisher-controlled services specifically identified here. Connect is a client application: it lets you connect to a Matrix homeserver, but the publisher does not automatically operate or control the homeserver you choose.
Connect is published by MHD inc. Ltd (the “Publisher”). Mohamad Dabbas is the designated product and privacy contact.
MHD inc. Ltd handles publisher-controlled information only for the purposes described in this policy and in accordance with applicable law. The legal basis, where one is required, depends on the processing activity and the user’s jurisdiction.
How Connect and Matrix work
Connect starts with matrix.org as its default homeserver and currently allows you to enter another secure Matrix homeserver before signing in. Your chosen homeserver normally manages your Matrix account, authentication, profile, devices and sessions, rooms, messages, media, and server logs under that operator’s own terms and privacy policy.
Matrix is federated. When a room contains people from different homeservers, relevant room events and metadata may be sent to and retained by the participating homeservers. Those independent operators may be located in different countries and apply different retention, access, moderation, and deletion rules.
Information involved
Depending on the features you use and the services selected by you or your homeserver, processing may include:
- your Matrix user ID, display name, avatar, account and authentication information;
- device and session identifiers, access tokens, cryptographic keys, verification and key-backup information;
- messages, reactions, room names and topics, membership, read state, typing state, and other room events;
- photos, videos, files, voice recordings, location messages, and other content you choose to share;
- call signaling, call timing and participant information, network addresses, and media connection data;
- push notification tokens, application identifiers, and event or room identifiers needed for delivery;
- IP addresses, device/operating-system information, network and security logs generated by remote services;
- local preferences, cached content, encrypted local database records, and app-lock settings; and
- information you voluntarily provide when requesting support or reporting abuse.
Access to information on your device is not necessarily the same as collection by the publisher. Information sent off the device may instead be controlled by your homeserver operator or another service described below.
Why information is used
Information may be processed to create and authenticate an account; connect your device to a homeserver; deliver messages, rooms, media, calls, and notifications; synchronize your devices; provide encryption and verification; prevent abuse and protect service integrity; respond to reports and support requests; remember local preferences; and meet legal obligations that apply to the responsible operator.
MHD inc. Ltd does not use personal information for a materially different purpose without an appropriate basis and notice. Connect does not include advertising or behavioral-tracking functionality.
Messages, rooms, and shared media
Your content is sent to your chosen homeserver and, depending on room membership and configuration, to other users, devices, federated homeservers, bridges, bots, or integrations. Room membership, sender and recipient identifiers, timestamps, event relationships, and other operational metadata may remain visible to servers even when message content is encrypted.
Unencrypted room content can be readable by the homeservers and services through which it passes. In encrypted rooms, supported clients encrypt message and attachment content before upload, but recipients’ devices can decrypt it and may copy, forward, capture, or retain it. Room administrators and homeserver operators may apply their own moderation and retention rules.
Encryption and device verification
Connect includes Matrix end-to-end encryption capabilities for supported encrypted rooms, along with device verification, cross-signing, and key-recovery or backup capabilities supported by the selected homeserver and client configuration. End-to-end encryption is not the same as anonymity and does not hide all metadata.
Not every Matrix room is necessarily encrypted. Encryption also cannot protect content after it is displayed on a recipient’s device, and its effectiveness depends on device security, correct verification, key handling, supported clients, and room configuration. Do not assume a conversation or call is end-to-end encrypted unless the application clearly indicates that protection for that context.
Voice messages and calls
Voice messages are recorded on your device after you grant microphone access, then handled like other shared media. In encrypted rooms, the uploaded recording may be encrypted as an attachment; in unencrypted rooms it may be readable by involved servers.
Connect contains Matrix/WebRTC calling capabilities. Call signaling can be exchanged through Matrix, while audio/video transport may connect directly or through STUN/TURN relay infrastructure selected by the homeserver or calling service. These systems may process participant identifiers, call timing, IP addresses, network diagnostics, and encrypted media packets. A direct peer connection can expose network-address information to the other participant. A relay can observe connection metadata, while its access to media depends on the calling configuration and encryption in use.
Call behavior can vary with the selected homeserver, network path, and available relay infrastructure. This policy will be updated if Connect’s provider arrangements materially change.
Notifications
When you enable push notifications, your device obtains a push token from the platform notification service. Connect registers push delivery through your homeserver and a Matrix push gateway. The current Connect configuration requests an event-ID-only pusher format, but actual payload content and production behavior remain subject to the homeserver, gateway, platform, and final build configuration.
Push delivery may involve your homeserver, the configured Matrix push gateway, Google Firebase Cloud Messaging, and Apple Push Notification service on Apple devices. These services may receive a push token, app or device identifiers, network information, and notification routing data. Notification previews shown on a locked device can disclose content to anyone with access to that device; use system and app notification controls to limit previews where available.
Device permissions
Connect may ask for access when you use a related feature: microphone for voice messages and calls; camera and photo library for captured or selected media; location for location sharing; contacts or calendar data when you choose to share them; Bluetooth for audio routing; and Face ID or another supported method for app lock.
You can deny or later revoke permissions in your device settings. Some related features will then be unavailable. Connect requests permissions in context and uses them for the related feature.
Storage on your device
Connect stores information needed to keep you signed in and make conversations available, including session data, settings, a local message database, cached media, and encryption material. The codebase includes secure-storage and encrypted-database capabilities and an optional app lock. These safeguards are distinct from Matrix end-to-end encryption and from encryption used by remote services.
Shared or opened media may also be written to temporary locations or another application selected by you. Operating-system backups or recipient applications may keep additional copies. Signing out, clearing application data, or deleting the app can remove local information but does not delete information held by homeservers, federated servers, notification providers, recipients, or backups.
Other operators and service providers
Relevant independent operators or service providers may include:
- the Matrix homeserver you select and homeservers federated with your rooms;
- bridges, bots, identity, integration, media, or authentication services enabled by you, a room administrator, or the homeserver;
- the configured Matrix push gateway and its infrastructure;
- Apple Push Notification service and Google Firebase Cloud Messaging for platform push delivery; and
- STUN/TURN, Matrix calling, or other WebRTC infrastructure used for calls.
Each independent service may have its own privacy terms. The operator and applicable terms can vary by service and homeserver. For service providers selected and controlled by MHD inc. Ltd, the publisher requires appropriate data-protection safeguards and reviews those arrangements when they materially change. User-selected homeservers and federated operators remain independent and apply their own terms. The privacy website itself loads no analytics, advertising, remote fonts, or third-party scripts; its hosting provider may create ordinary access and security logs.
Retention, removal, and account deletion
Retention is not controlled by one party. Local information remains until removed by app controls, operating-system controls, sign-out, or app deletion, subject to backups and exported files. Homeserver, federated-server, push, call, bridge, and recipient retention is determined by those operators and users.
Connect currently exposes a settings flow that asks the selected homeserver to deactivate the Matrix account and request data erasure. The homeserver may require additional authentication and may reject or limit the request. Deactivation is generally irreversible, but it cannot guarantee removal of data already federated, delivered, quoted, copied, backed up, or retained for legal or security reasons.
No single retention period applies across independent Matrix services. Publisher-controlled records are retained only as necessary for their stated purpose, security, legal obligations, and request handling. Contact [email protected] with retention or deletion questions.
Your choices and privacy rights
You can choose a compatible homeserver, select which rooms to join, decide what content to share, manage device permissions and notification previews, verify devices, manage sessions and keys, block or ignore users, report users or content to the relevant server, and initiate account deactivation where the homeserver supports it.
Depending on applicable law and the responsible operator, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, and to withdraw consent where consent is the basis for processing. Contact the operator that controls the information: usually your homeserver for Matrix account/server data, the relevant federated operator for its copy, and the Connect publisher for publisher-controlled processing.
International processing
Matrix federation and supporting providers can process information in countries other than your own. The locations and transfer safeguards depend on your chosen homeserver, the homeservers of other room members, bridges and integrations, push services, call infrastructure, and the publisher’s provider arrangements. MHD inc. Ltd applies safeguards required by applicable law to publisher-controlled processing.
Children’s privacy
Connect is not directed to children below the minimum age permitted by applicable law. Users must also meet the age requirements of their chosen homeserver. If MHD inc. Ltd learns that publisher-controlled information was processed contrary to applicable child-privacy requirements, it will take appropriate steps.
Security measures and limitations
Connect uses platform and Matrix security capabilities that include encrypted transport, secure credential storage, an encrypted local database, optional app lock, end-to-end encryption for supported rooms, and device verification. No system is perfectly secure. Security also depends on your device, passcode, recovery secrets, chosen homeserver, room configuration, other participants, and external providers.
Keep your device and application updated, verify important conversations and devices, protect recovery material, review active sessions, and promptly remove unfamiliar sessions. Do not send highly sensitive information to an unencrypted room or an unverified recipient.
Changes to this policy
The policy may be updated when Connect’s features, providers, legal obligations, or data practices change. The revised page will show its effective date, last-updated date, and revision identifier. Where required, material changes will be communicated through an appropriate additional notice or consent flow.
Contact and requests
For data controlled by your chosen homeserver, use the contact and privacy-request channels provided by that homeserver operator. For content held by another federated service, you may also need to contact that service directly.
For questions about Connect itself or publisher-controlled processing, contact MHD inc. Ltd using the details below.