Privacy

Last updated 23 October 2026. Marsa is in beta, so this page changes as Marsa does; the date says when.

Marsa (“we”, “us”) is responsible for the personal data described here. This page says what Marsa keeps, why, and for how long. The terms of use and the community rules go with it.

What our server keeps

Your account

A username, your role, and a one-way hash of a sign-in proof that your phone makes from your passphrase: the passphrase itself never leaves your phone. (Accounts made before 23 October 2026 also keep, for a while, the older one-way hash of the passphrase, so that older copies of the app can still sign in.) For each phone or browser you sign in on: a session, the kind of device and browser, when it was last used, and which version of Marsa it runs. To stop abuse, sign-ups and requests for help getting back in are counted per connection for one day; we keep only a one-way code made from the internet address and the day, never the address itself, and it means nothing the next day. Our hosting keeps a record of errors for a few days, not a log of each visit.

Messages and posts

End-to-end encrypted. The server keeps your public keys, who you have accepted as a contact and the code they used, the groups you are in, and the encrypted messages until your devices fetch them (unfetched ones go after 30 days). It also sees when a message was sent and how large it is, never what it says. Photos, videos and voice notes are encrypted on your phone and kept for up to 30 days; view-once media goes when it has been opened.

Your keys and chats in your account

Unless you turn it off (Chat settings › Keys and message history), your chat keys and a copy of your chats are kept in your account, locked with a key your phone makes from your passphrase, and with your recovery key if you make one. That is how signing in on a new phone brings everything back. We cannot open them. If Marsa's team resets your passphrase, they stay locked with your earlier passphrase or your recovery key.

Things you choose to keep in your account

Your family tree in Lafifa, trips, places, the travel log, the guide and your settings are kept so they stay the same on all your devices. They are encrypted on your phone before they leave it, with a key that travels with your chat keys, so our server cannot read them: it sees only when each was last changed and how large it is, and the names of your settings (not their values). Saved Marsad, if you keep a copy in your account, and the names in your address book are encrypted the same way. If you turn off keeping your keys in your account, a new phone gets them only by linking it from one you already have.

What is not end-to-end encrypted

• The assistant. What you ask it, and the chat text or receipt picture you hand it, goes to our server and to Cloudflare's AI service to be answered. We do not keep it; we count how often you use it each day.
• Marsad open to everyone (a test the owner may switch on): an open post, your card's name and picture, are seen by everyone on Marsa and kept on our server until the post ends after 24 hours. The app tells you before your first open post.
• Screenshots of Marsad posts: on Marsa's Android app on Android 14 or later, the phone tells the app when a screenshot is taken while someone's post is on screen (never the picture), and the person who posted it is told. For an open post this is kept with its views on our server until the post ends.
• Reports. When you report a post, message or person, your phone sends us what it shows you, so our team can see it. The person reported is not told who reported them.
• Bots (a test). Accounts whose names end in 🤖 are run by our server, not by people. Their keys are on our server, so what you send a bot, or a group a bot is in, is read there to answer you, and, when their replies are written by AI, goes to Cloudflare's AI service too. We keep a short note of the last few things said to each bot so its replies follow on, and delete it with the bot. The app says so in every chat with a bot.
• Feedback you send, with the app's version, your kind of device and its last few error messages.

Other records

Your Marsa tokens and handles; the reach codes you make and when they were used (shown to you as “How we met”); requests for help getting back in; appeals; and a moderation record of what our team decided about reports and accounts.

Kept only on your phone

Your location: prayer times, the qibla, the country you are in and the home you set are all worked out on the phone. Files you attach to a trip, your audio in Listen, and Saved Marsad (unless you keep a copy in your account). Your chat history is kept on your phone too, sealed with a key that stays on the device.

Services your phone or our server use

• Cloudflare hosts Marsa: our server, database, file storage and the assistant's AI run on its network, which may be in other countries.
• Google Firebase wakes the Android app when a message arrives. It gets a token for your phone; the notice carries no names and no message text. In a browser, your browser maker's push service plays the same part.
• Google's Block Store (Android app): a small record of your sign-in and your Marsa identity key, kept in your Google backup and encrypted end to end when your phone has a screen lock, so a reinstall can bring you back. Signing out clears it.
• From your phone directly: place search (Photon and OpenStreetMap), visa requirements (Wikipedia), and maps or messaging apps you open from a link. They see that request as they see any visit.

We report child sexual abuse material to the authorities.

Requests for information

We give information to an authority only when the law that applies to us requires it. What our server holds is listed on this page: an account's username and role, when it was made and last used, its devices' kinds and app versions, who it is connected to and in which groups, when messages were sent and how large they were, its tokens, handles and codes, and what is not end-to-end encrypted (open Marsad posts while they last, reports, feedback, what was sent to the assistant or a bot). Messages, photos, videos, voice notes, chat keys, your family tree, trips, travel log and settings are encrypted so that we cannot open them, so we cannot give them to anyone.

Your choices

• See and change your details in the app; export your chats (an encrypted backup) and your family tree.
• Turn off keeping your keys and chats in your account, or the account copy of Saved Marsad.
• Online status is off unless you turn it on, and read receipts can be turned off. Nobody can search for you.

Deleting your account

In the app: Marsa › Delete my account. Without the app: open marsa.chat/#delete-account, sign in and confirm with your passphrase. Everything kept for your account is deleted at once: synced data, keys and devices, contacts, codes, handles, tokens, media, backups and Saved Marsad. Your contacts' phones are told the account was deleted.

Kept for everyone's safety: reports other people made about the account and the moderation record (reports you made stay, without your name). A picture or video attached to a report about a child's safety is kept for one year in case the authorities need it, then deleted.

Children

Marsa is for people aged 18 or older. If we learn that an account belongs to someone younger, we close it. Lafifa lets you record relatives, children among them: those records are private to you, and the app asks before anything leaves your phone.

Security

Messages, and the data your phone keeps in your account, use end-to-end encryption; passphrases and recovery keys are kept only as one-way hashes; sign-in attempts are limited. No system is perfectly safe: keep your passphrase and recovery key to yourself.

Questions

Use Feedback in the app (Marsa › Feedback). For a question about your data, or to ask us to correct or delete something, write there and we will answer.