Privacy policy
Effective 25 September 2026.
Courier is a pilot secure messenger, operated by Johanna Leasiolagi. It is a research and demonstration build and is used with fictional information only. Questions about this policy go to support@courierapp.org.
What Courier collects
- Your email address, to check the invitation list and to send sign-in codes.
- Your name and role, shown in the directory and to your contacts.
- Account and device identifiers, including the notification token Apple issues for your phone so that Courier can notify you.
- Connection details. The service can see when your phone connects, who receives traffic, the size and timing of that traffic, and the first time one person looks up another in the directory.
- Security events. Courier reports a defined set of security events, such as a failed unlock. These do not include message text or the people in a conversation.
What Courier cannot read
Messages, files and calls are encrypted on the sender's phone and opened only on the recipient's phone. The public relay carries sealed envelopes until they are delivered. It does not hold your private keys and cannot read your messages, files or calls. Your profile picture, if you choose one, travels inside your encrypted contact card in the same way.
The records copy
Courier is built for official communication, so each message you send also creates a separate encrypted records copy. That copy is sealed so that only the pilot's records and security function can open it. It is not available to the public relay. Records copies are kept for the retention period shown in the app, which is seven years in the pilot.
Disappearing-message timers clear the copies on the phones. They do not delete the records copy. Calls are not recorded; Courier keeps only a note that a call happened and how long it lasted.
What stays on your phone
- Your encryption keys and your local message store, which is encrypted on the phone.
- Your PIN. Face ID is handled by iOS, and no image of your face reaches Courier.
- Speech captions for a call, which run on the phone only, and only when you turn them on.
- The optional busy hour Courier can add to your calendar. It has no title, attendees or joining details.
Permissions Courier asks for
- Camera, to scan a colleague's safety number or contact card in person, and for video calls.
- Microphone, for calls.
- Local network, to find a nearby phone when you swap contact cards.
- Photos, through the system picker, so you can choose one profile picture. Courier cannot see the rest of your library.
- Calendar, write-only, for the busy hour described above.
- Notifications, so that Courier can tell you something has arrived.
What we do not do
Courier has no advertising, no analytics and no third-party tracking code. We do not sell or share your data for marketing, and we do not track you across other apps or websites.
Service providers
- Amazon Web Services hosts the servers and, through Amazon SES, sends sign-in codes by email.
- Apple delivers push notifications and distributes the app through TestFlight or the App Store.
- Cloudflare manages the courierapp.org domain and forwards tester email addresses.
Your choices
To ask what is held about you, or to leave the pilot, email support@courierapp.org. Records copies are kept for the retention period described above and cannot be removed by a disappearing-message timer.
Children
Courier is for adult government officials and is not directed at children.
Changes
If this policy changes, we will update this page and its date.