Privacy Policy

Last updated 8 August 2026

2bytes is a messenger. This page describes what the service stores, why, for how long, and who else ever sees anything. It describes what the software does today — not what it is meant to do one day. Where the honest answer is uncomfortable, it is written down anyway.

1. Who is responsible

The 2bytes service is operated by the team that publishes the 2bytes apps (“we”, “us”). For anything in this policy, including any request about your data, write to hello@2bytes.app. We are the controller of the personal data described below.

2. Why we are allowed to process your data

• To provide the service you asked for. Delivering a message requires storing it until it arrives; running an account requires a phone number. This is the performance of our agreement with you, set out in the Terms of Service.
• Our legitimate interest in a service that works and is not abused: keeping the system up, finding faults, and stopping spam and attacks.
• Your consent, where the app asks for it explicitly — access to your address book, and permission to send notifications. Consent can be withdrawn at any time in your device settings, and withdrawing it stops that processing.

3. What we process

• Your phone number. Required: it is how an account is created and how other people find you. There is no way to use 2bytes without one.
• Your profile: name, username, photo — whatever you choose to put there.
• Your messages and the files you send: text, photos, videos, voice and video messages. They are stored on our servers so they reach your other devices and the person you wrote to.
• Your contacts, only with your permission. If you allow access to your address book, the phone numbers in it are sent to us so we can tell you who already uses 2bytes. Refuse the permission and nothing is sent. We do not use those numbers to contact anyone.
• How you connect: device model, app version, language, IP address, and when you were last active. This is what the list of active sessions in the app is built from, and it is how a stranger signing into your account becomes visible to you.
• A notification token issued by Apple or Google, so a message can reach your device while the app is closed.
• Server logs recording requests, including IP addresses and timestamps. While the service is young these are deliberately detailed, because they are how faults get found.

4. What we never do

• No advertising, and no profile of you assembled for anyone to target.
• No analytics and no crash telemetry. The app offers its usage log to the server; the server accepts it and discards it without reading it.
• No selling, renting or sharing your data with anyone for their own purposes.
• No scanning of your messages for any purpose of ours.

5. Encryption, stated plainly

If something you are about to send needs a guarantee rather than a promise, use an app built around end-to-end encryption. We would rather lose you there than be reassuring here.

6. Where your data is kept

The servers are operated by JSC Timeweb and located in Russia. Everything described in section 3 is stored there.

2bytes is not offered in the European Economic Area or the United Kingdom. We do not market it there and it is not available from the app stores of those countries — see section 2 of the Terms of Service. We would rather stay out of a market than pretend to protections we cannot give from where the servers stand.

Wherever you are, know what it means that the data sits in Russia: it is held under Russian law, and the safeguards and remedies of European data protection law are not available to you here.

7. Who else sees anything

• Apple and Google, which deliver notifications. They receive your device token and the fact that something arrived. The notification itself carries no message text and no sender — only the words “New message” and the number of unread ones. What you wrote stays between our server and your app.
• Our hosting provider, which operates the machines and therefore has physical access to them.
• Authorities, where we are compelled by a valid legal demand under the law that applies to us. We have not received one to date. If that ever changes in a way we are permitted to describe, this page will say so.

Nobody else. There are no advertising partners, data brokers or analytics providers, because there is no advertising, no data trade and no analytics.

8. How long we keep things

• Messages and files: until you or the person you wrote to delete them, or until the account is deleted.
• Profile and account data: for as long as the account exists.
• Session records: until you end that session or it expires.
• Server logs: 30 days, then discarded.

9. Your rights

Wherever you are, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything wrong;
• delete your data (see section 10);
• restrict or object to a particular use of it;
• hand it over in a portable form, or send it to someone else.

Write to hello@2bytes.app. We answer within 30 days and charge nothing. These are the rights European law gives people there; we give them to everyone, because they are the right rights to have and not because someone makes us. If you think we have handled your data badly, you may also complain to the data protection authority where you live.

10. Deleting your account

You can end your account yourself. The steps for each platform are at 2bytes.app/delete-account.

Deleting removes your profile and username, releases your phone number, and signs out every device: the account stops existing and nobody can reach you through it.

Your message history, the files you sent, the address book you uploaded, your settings and your device tokens are erased from our servers as part of the same request — in one transaction, so it either all goes or the account stays and you are told.

One honest caveat. Messages you already sent are copies that now live with the people you sent them to, and deleting your account does not reach into their apps — that is true of every messenger.

11. If something goes wrong

If personal data is lost or exposed, we will notify the competent supervisory authority within 72 hours of becoming aware of it — the deadline European law sets, which we hold ourselves to — and we will tell the people affected directly — in the app and by whatever contact we have — where the breach is likely to put them at risk. We will say what happened, what it means for you, and what we are doing about it, rather than the minimum we can get away with.

12. California

If you live in California: we do not and will not sell or share your personal information, and there is nothing to opt out of. In the past twelve months we have collected the categories described in section 3 — identifiers, your content, and internet activity — for the purposes stated there, and we have disclosed none of them for any commercial purpose. Your rights to know, delete, correct, and not be discriminated against for exercising them are the same rights set out in section 9; write to hello@2bytes.app and we will answer within 45 days.

13. Children

2bytes is not for people under 13, and in countries where the law sets a higher age for consenting to the processing of personal data — 16 across much of the European Economic Area — not for anyone below that age. We do not knowingly keep an account for a child. If you believe one exists, write to us and it will be removed.

14. Changes to this policy

When this policy changes, the new version appears here with a new date at the top. If a change alters what we collect or who sees it, the app will say so before it takes effect.

15. Getting in touch

Anything at all: hello@2bytes.app.