MT Business is built to collect as little as possible. This page states exactly what the application handles, what leaves your device, who sees it and for how long it is kept.
Identity
Your identity is a 24-word phrase generated on your device; your Montana address is derived from it. We never see the phrase or the keys, and nobody, including us, can restore them for you. You can sign in with the 24 words alone; a phone number and an e-mail address are optional.
Phone number
If you sign in with a phone number, a third-party messaging service confirms it: you share the number with our bot inside that service, or confirm it on that service's sign-in page. The confirmation screen names the service; its own privacy policy applies to what you do there.
From that service we receive your number and your public profile: name, username, short bio and photo. The bio and the photo are handed to your device once, to fill in your profile, and are not kept by us.
Our confirmation service (id.montana.xxx) keeps one directory entry for each confirmed number: the number, the address of your Montana identity, a hash of the latest confirmation and the card you publish — name, username and the link that opens a conversation with you. A confirmation in progress is kept in memory for at most 13 minutes.
Who can find you
Anyone who has your number in their address book and uses MT Business sees that you are here, with your name, username and number, as in the usual messengers. A search by username shows your card without the number.
Your contacts
If you allow access to Contacts, the application reads the phone numbers in your address book and sends them to the directory as SHA-256 hashes, at most 500 in one question, to learn which of your contacts are here. A phone number has few digits, so its hash can be reversed by trying numbers; we treat the hashes as the numbers themselves. The directory answers only with the entries that match, does not keep or log the questions, and takes at most 30 questions a minute from one network address.
If you sign in with an e-mail address, a six-digit code is sent to it from the montana.quest mail server. The request is kept in memory for at most 13 minutes, and the address is not placed in the directory. The mail server's log records each delivery — the recipient address and the time — and is kept for up to five weeks.
Messages, calls and media
Every message, call, photo, video, voice message and file is end-to-end encrypted with post-quantum cryptography: ML-KEM-768 for the session, ML-DSA-65 for signatures, ChaCha20-Poly1305 for content. The keys live only on the devices of the people in the conversation.
When both phones are reachable, a message travels directly between them. Otherwise it waits on a Montana node as a sealed envelope, and media as sealed chunks, that the node cannot open. Undelivered material is kept for at most 7 days and then deleted.
Voice and video calls are encrypted end to end; a node only forwards the call set-up inside the encrypted session and never holds a key to the audio or the picture.
Your history
Your conversations live on your device and are never sent to our servers. If you turn on the iCloud copy in Settings, once a day a copy sealed with the key your 24 words open goes to the iCloud storage of your own Apple Account; the words are not in it, and without them nobody can read it. Deleting the application erases the history on that device.
Diagnostics
The application sends anonymous diagnostic logs to help us find and fix defects: event records, timings and error codes, together with the device model, operating-system version and application build.
The logs never contain message content, names, phrases or addresses. The diagnostic identifier is a random value unrelated to your identity, and the identifiers of your correspondents are replaced with irreversible salted hashes on your device before anything is sent. Logs are kept on a Montana node for at most 7 days and then deleted. They are not linked to you and are not used for tracking.
Permissions
Each permission serves one feature. Camera and microphone: photos, videos, voice messages and calls. Photo library: choosing and saving media. Contacts: finding which of your contacts are here, as described above, and sharing a contact in a chat when you choose to send one. Location: sharing a place in a chat, only when you choose to send one. Speech recognition: turning a voice message into text on the device; the sound is never sent. Bluetooth and local network: finding your correspondent's phone nearby for direct delivery. Face ID: locking the application.
Notifications
To wake a sleeping device we send a notification through Apple's service. It carries no content: the message is fetched and decrypted on your device after the wake-up.
No tracking
MT Business contains no advertising, no third-party trackers, no third-party analytics and no third-party software development kits that report to anyone. Nothing is sold, and nothing is shared beyond what this page describes. No data is used to track you across other applications or websites.
What we never have
Your recovery phrase. Your keys. The content of your messages and calls. Who you talk to. Where you are.
Children
MT Business is not directed to children; you must be 18 or older to use it.
Your choices
You can sign in with the 24 words alone and give no number and no address. Deleting the application removes everything it stored on the device. To remove your number and card from the directory, write to contact@montana.quest; we delete the entry.
Changes and contact
Changes to this policy are published on this page with a new effective date. Questions: contact@montana.quest.