Signal.
Signal is the rare app whose privacy policy is short because they actually don't collect the data — not because they're hiding it. Messages and calls are end-to-end encrypted §1, and the server is engineered so it cannot see who you message, who's in your groups, or your contact list §2. The only data tied to your account is a phone number, account-creation date, and last-connection date §3 — and that's exactly what they hand over to grand juries, because it's all they have §6. Run by a nonprofit, funded by donations, source code public. Real flaws: the policy is from 2018 and silent on modern issues (AI training, CCPA, GDPR), phone number is still required to register, and a 2022 breach at their SMS-verification vendor exposed ~1,900 users' phone numbers §5.
TL;DR — 8 answers.
The eight things you actually want to know, at a glance.
The questions, answered.
No legalese. Every answer the way your most cynical friend would put it.
Do they sell your data?
No. The Terms say it plainly: "Signal does not sell, rent or monetize your personal data or content in any way — ever." Signal is a nonprofit funded by donations. There is no ad business to feed.
Are they tracking you on other sites?
No third-party trackers. No ad network. No analytics tied to your identity. The Signal client and website are both engineered to avoid the surveillance graph entirely.
Can your data train their AI?
Signal cannot read your messages, and the policy describes no AI features. There is no Signal-trained model fed by your data — there is no data to feed it with.
Who can see what you do?
Message content, sender, recipient, group membership, and contact list are all opaque to Signal's servers. Even Signal can't tell you who you message. Subpoenas return two timestamps and nothing else [[S6]].
Can you delete everything?
Account deletion is a single tap in Settings → Account → Delete Account. There is little else to delete — Signal didn't keep it in the first place.
Do they honor your opt-out?
There is nothing meaningful to opt out of — no ads, no sale, no profile. But the policy doesn't explicitly mention GPC, CCPA, or GDPR either. Opt-outs aren't honored because they aren't relevant, which is the unusual case where that's actually fine.
Special handling for minors?
Terms set a minimum age of 13 (or higher where local law requires). The policy doesn't elaborate on enhanced minor protections — but it also doesn't profile, target, or track anyone, minor or not.
Been fined for this before?
Zero regulatory fines for privacy. The closest thing to an incident: in August 2022, a breach at Signal's SMS-verification vendor Twilio exposed phone numbers for ~1,900 users [[S5]] — Signal disclosed it publicly within days and re-registered affected users.
At a glance, honestly.
Eight signals, color-coded. Like a model card for a machine — except the machine is reading your data.
The Privacy Label, honestly.
An Apple-style label for what's collected and a Cranor-style back-of-pack for what they do with it. Every cell links to the exact line in their policy.
The receipts, translated.
Five of the worst clauses, lifted verbatim. Strikethroughs are theirs. Marginalia is ours.
Dark patterns spotted.
Tricks the policy and surrounding UX use to make you "consent" without really consenting.
Your rights, by where you live.
Same company, wildly different rights depending on your jurisdiction. Direct links to the specific opt-out / delete / access flows.
- ✓ Right of access (trivially satisfied — there is almost nothing to disclose)
- ✓ Right to erasure (in-app account deletion)
- ✓ Right to data portability (limited — your data lives on your device already)
Source: §8
The actual sources.
Every claim above is anchored to a line in the policy we analyzed. Click any section ID to view it in context.
SOURCE: https://signal.org/legal/ · POLICY VERSION: 2018-05-25 · SNAPSHOT HASH:
- §1Information You Provide · end-to-end encryption"Signal cannot decrypt or otherwise access the content of your messages or calls."
- §2Signal Terms & Privacy Policy · no ads, no trackers, no kidding"Signal does not sell, rent or monetize your personal data or content in any way – ever."
- §3Information You Provide · phone number and profile"You register a phone number when you create a Signal account. Phone numbers are used to provide our Services to you and other Signal users. You may optionally add other information to your account, such as a profile name and profile picture."
- §4Information You Provide · contact discovery"Additional technical information is stored on our servers, including randomly generated authentication tokens, keys, push tokens, and other material that is necessary to establish calls and transmit messages."
- §5Third-party providers · 2022 Twilio incident"We work with third parties to provide some of our Services. For example, our Third-Party Providers send a verification code to your phone number when you register."
- §6EFF / ACLU grand jury subpoena response (2016, 2021)"...the only Signal user data we have, and the only data the U.S. government obtained as a result, was Unix timestamps for when each account was created and the date that each account last connected to the Signal service."
- §7Information We May Share · safety and fraud"To detect, prevent, or otherwise address fraud, security, or technical issues."
- §8Account deletion · in-app"Settings → Account → Delete Account permanently deletes your Signal account and all data associated with it."
- §9Signal Terms of Service · age"You must be at least 13 years old to use our Services. The minimum age may be higher in your jurisdiction."
- §10Privacy Policy · effective date"Effective as of May 25, 2018."