Marsa: terms of use and privacy

Last updated 21 October 2026. Marsa is in beta. Anyone 18 or older may create an account; an invite or a member's code is no longer needed, though one still connects you to the person who gave it.

What we store

• Your account: a username, a salted hash of your passphrase, your role, and session tokens for your devices. To stop mass sign-ups, the address a new account was created from is used for one day to count sign-ups, then deleted.
• Marsa data (trips, guide, travel log, preferences): stored on your devices and, when you sign in, on our server so it can sync between your devices. It is private to you and readable by the server.
• Marsa messages, voice notes, photos, videos, Marsad posts and backups: end-to-end encrypted on your device. The server stores and routes ciphertext it cannot read. It does keep: your public keys, who you have accepted as a contact and which reach code they used, group membership, encrypted blobs, and the times messages were sent. Media is kept for up to 30 days; view-once media is removed after it is opened.
• Marsad while Marsa is being tested: Marsa's owner may open Marsad to everyone for a while. When it is open, a Marsad post is seen by everyone who has Marsa, together with your card's name and picture, and it is not end-to-end encrypted: our server keeps it, and the key to its picture or video, until it expires after 24 hours, you delete it, or Marsad is closed again (which deletes every open post). The app tells you before your first open post. Messages are never affected.
• Profile picture and card: part of your encrypted card; only the people you let in (whoever you hand a code to, or accept through an introduction) receive it.
• Getting back into your account: if you make a recovery key, the server keeps only a one-way hash of it (it cannot show it to anyone, us included). If you have no key, Marsa's team can make a one-time reset code for your username, good for 24 hours, after making sure it is you; that is recorded in the moderation log. If you are locked out with no key, you can ask for that help from the sign-in screen: the request holds only your username and how to reach you, and is closed once you are back in. Using either sets a new passphrase and signs out your other devices. Your messages are not touched: their keys stay on your phones.
• Online status: off unless you turn it on. Never a last-seen time.
• Kept on your phone only, never sent to us: your location (prayer times, the qibla, which country you are in, and the home you may set for the traveller's prayer notes are all worked out on the phone, and prayer reminders are set on the phone from those times); files you attach or share to a trip (tickets, bookings, boarding passes); your audio files in Listen and what you listened to.
• Nearby and the emergency network (Android app): with no internet, phones with Marsa close by pass messages directly over Bluetooth and Wi-Fi. With the emergency network switched on, your phone also carries other people's messages and hands them to the next phone or to our server. Every message stays end-to-end encrypted and carries the sender's signature; a carrying phone sees only who it is for, its size and when it was sent, never its content. Nothing is broadcast about you: each phone announces a random name and says who it is only inside a connection.

What we do not do

• No advertising, no tracking, no analytics, no selling or sharing of data.
• Nobody can search for you; a reach code you hand out is the only way to be found.
• We cannot recover an encrypted backup without the passphrase you set. If you turn on the backup kept with Marsa, your phone keeps a key made from that passphrase and sends a fresh encrypted copy at most once a day; the copy holds your Marsa keys and chats, so the passphrase alone brings them back on a new phone. We cannot open it.

Who can use Marsa

During the beta, Marsa is for people aged 18 or older. Creating an account confirms that you are. Accounts for younger family members will come later, with their own safeguards.

Community rules

The full rules, how we enforce them, reporting and appeals are on the community rules and policies page. In short, Marsad posts, messages and everything else you share must not contain or do any of the following. Before your first Marsad post you are asked to agree to these rules.

• Anything that sexualises, exploits or endangers a child. We remove it, close the account and report it to the authorities (in the United States, to the National Center for Missing & Exploited Children).
• Nudity or sexual content.
• Harassment, bullying or threats.
• Hate against people for who they are.
• Violence, or encouraging anyone to harm themselves.
• Scams, spam, or pretending to be someone else.
• Sharing someone's pictures or private details without their permission, or anything against the law.

Reporting and blocking

You can report a Marsad post (⋯ on the post), a message (hold it) or a person (their card), and block anyone. Because posts and messages are end-to-end encrypted, our server cannot read them: a report carries what your phone shows you (the text, and the picture or video) to Marsa's team, together with the reason you chose. The person you report is not told who reported them. Reports are read by the owner and admins only; the attached picture or video is deleted once the report is handled. Breaking the rules can close an account; reports about a child's safety are handled first. Every decision is written to a moderation record (who decided, when, about whom, a fingerprint of any picture). When an account is closed, its Marsad posts are taken back from everyone's phones. Each person can post up to 100 Marsad posts a day. To keep the review list workable, reports and contact requests are limited per day, more tightly in an account's first week.

Child safety standards

Marsa has zero tolerance for child sexual abuse and exploitation (CSAE) and child sexual abuse material (CSAM). Marsa is for adults (18 or older). Anyone can report content or a person inside the app; such reports are reviewed first, the content's account is closed, and we report it to the relevant authorities as the law requires. To reach us about child safety, use Feedback in the app.

Your responsibilities

• Keep your passphrase and backup passphrase safe.
• Hand your codes only to people you want on Marsa: a code lets them in at once; block or remove anyone at any time.
• Do not use the service for anything unlawful.

Deleting your account

In the app: Marsa › Delete my account. If you no longer have the app, open marsa.chat/#delete-account in any browser, sign in, and confirm with your passphrase.

This deletes at once your account and everything kept for it on our server: synced data, Marsa keys and devices, contacts, reach codes, handles, tokens, uploaded media and backups. Your contacts' phones are told the account was deleted. The app then erases Marsa from that phone and offers to erase the rest.

What is kept, for everyone's safety: reports other people made about the account and the moderation record of what was decided (reports you made stay, without your name). The picture or video attached to a report about a child's safety is kept for one year in case the authorities need it, then deleted. To wipe a device without deleting the account, sign out and use Erase all data.

Ownership

Marsa, its names, emblem, design and code are © 2026 Mohamed Alromaithi, all rights reserved. Fonts are under the SIL Open Font License; map data from Natural Earth (public domain); place search uses OpenStreetMap data (© OpenStreetMap contributors, ODbL); visa requirements are read by the phone from the English Wikipedia (“Visa requirements for … citizens”, Wikipedia contributors, CC BY-SA 4.0), which sees that request like any visit to its site. They are a guide only: always confirm with the embassy or airline before travelling.

Changes

This page may change as the beta grows. The date at the top says when.

Back to Marsa