Private by design. Minimal by default.

1 · Operator and privacy contact

Company operator and data controller.

Snooptsz Group Ltd is incorporated in England and Wales, company number 17468359, incorporated on 18 September 2026. m3lytsz is a trading name of Snooptsz Group Ltd, the company operator and data controller for the processing described in the m3lytsz Privacy Policy. ICO registration reference: ZC265345. Privacy correspondence: 66 Paul Street, London EC2A 4NA, United Kingdom.

The current Managing Director role-holder is assigned the Privacy & Compliance Officer function. Data protection contact: snooptsz@m3ly.me.

A statutory UK DPO is not presently assessed as mandatory for the current processing model. That assessment is reviewed if the scale or nature of processing changes.

2 · What the Android app processes

Only data required to authenticate, connect, secure and operate m3lytsz.

Depending on the identity and features used, m3lytsz may process a pseudonymous handle/principal, actor class, findability setting, public passkey credential material, protected compatibility/recovery verifiers, session references, m3lytsz-generated device references, pairing state, temporary/guest expiry state, machine-ownership state, encrypted-message routing metadata, abuse/security events and infrastructure connection metadata.

m3lytsz does not require a real-world name, phone number or email address as the native account identity. Required pseudonymous account/device/session references are service-security identifiers, not advertising or cross-service tracking IDs.

3 · Passkeys, secrets and recovery

Private authentication secrets remain private.

For passkeys, m3lytsz stores the public WebAuthn material required for verification. The private passkey key remains with the user's authenticator. Optional recovery values are processed only through their defined protected verification paths and are not intended to be retained as plaintext.

m3lytsz may be unable to recover an account when all valid passkeys, recovery methods and authorised devices are lost. m3lytsz does not weaken another user's security to recover an account.

4 · Android permissions

Nearby, QR and NFC permissions are optional and explicit.

The Android hardware-test candidate includes Internet/network-state access, Bluetooth discovery/advertising/connection, Wi-Fi Direct, Camera and NFC. Android 12 and later use Bluetooth Nearby-device permissions; Android 13 and later use Nearby Wi-Fi Devices. On Android 12 and earlier, nearby discovery may require Location permission and the system Location setting. Fine and coarse Location permissions are capped at Android 12 (API 32). Bluetooth scan and Nearby Wi-Fi permissions are declared neverForLocation.

Camera is used only when the user deliberately starts the offline peer-card QR scanner. NFC is used only when the user deliberately chooses the peer-card/Reach NFC read or write flow. NFC is bootstrap/share plumbing: it carries a bounded public peer-card or approved capability record, not private chat content, MLS private state, passkeys, recovery secrets or a plaintext message transport. Camera and NFC hardware are declared optional so devices without them can continue using supported routes.

Nearby/radio use requires an explicit user action and any required runtime permission grant. Denying Camera, NFC or a nearby permission must not prevent ordinary Internet messaging. m3lytsz does not use these permissions to build location history or advertising profiles. Contacts, SMS and Call Log permissions are not requested. Microphone permission is requested only for user-initiated encrypted voice messages and audio-only m3lytsz calls; denying it keeps ordinary text messaging available. Android offline calls use bilateral call consent, Bluetooth peer discovery and Wi‑Fi Direct private/local media candidates; they do not silently fall back to an Internet call. Voice audio is not used for advertising profiles or behavioural tracking. General radio/accessory voice transports remain unavailable.

m3lytsz-72 does not put a paid entitlement in front of these implemented core transports. Availability still depends on the exact installed Android build, device hardware, runtime permissions and bilateral consent. Google Play permission/Data Safety disclosures must match the signed build actually distributed. Unsupported hardware fails closed rather than being simulated.

5 · Local storage and Android security

Device state stays constrained.

Android backup is disabled. Device credentials use protected no-backup application storage and Android Keystore-backed protection. Packaged Web assets are local to the app, external WebView resource access is constrained and there is no JavaScript bridge used to expose native secrets.

m3lytsz does not include an advertising or behavioural-analytics SDK in the qualified Android source.

6 · Private messages and Message Links

Release-gated encrypted messaging. No plaintext fallback.

Private messaging currently uses release-gated m3ly-mls-v1 encrypted envelopes with no plaintext fallback. It is not presently claimed as qualified end-to-end encryption; qualification requires executable evidence for the exact accepted Android and service deployment.

Recipient-issued Message Links can create a short-lived recipient-bound guest session. The private proof remains after the URL fragment marker during bootstrap, the server uses verifier/hash material, guest sessions are limited to a maximum of one hour and cannot expand themselves into general directory/settings access.

Reports do not include decrypted private message text by default. A reporting user may explicitly choose to disclose an excerpt for review.

7 · Network and security metadata

Minimum operational metadata, not behavioural history.

Internet communication necessarily exposes limited technical information such as IP address, connection timing, routing and security events to infrastructure required to deliver and protect the service. m3lytsz uses this for delivery, authentication, jurisdiction enforcement, rate limiting, abuse prevention, troubleshooting and security—not advertising profiling.

Normal Android API traffic in the new release source is routed through m3ly.me. Device/inbox selectors and directory search terms are kept out of request URLs where the current protocol supports a body/header alternative.

8 · Reports and abuse prevention

Security processing is purpose-limited and does not inspect private conversations by default.

m3lytsz may process limited pseudonymous references, rate/security signals, user-submitted abuse reports and known malicious indicators needed to prevent spam, scams, phishing, fraud, account compromise and service abuse. Private-message content is not opened or decrypted by m3lytsz for routine moderation. A reporting user may explicitly submit selected evidence for review.

Case-specific evidence may be retained only where necessary for an identified security, abuse or legal purpose and must have a review or closure trigger. Ordinary user activity is not retained indefinitely merely because it might later be useful.

9 · Retention

Short-lived data expires and is purged.

Current controls include WebAuthn challenges up to 5 minutes; Android pairing proofs up to 10 minutes; Machine claim proofs up to 10 minutes; ordinary Web sessions up to 30 days unless shorter/revoked; m3lytsz-72 temporary Human identities exactly 1, 24 or 72 hours according to the selected lifetime; temporary cloud material is not recoverable after expiry; recipient-bound guest sessions up to 1 hour and never beyond the link lifetime; and routine authentication-attempt telemetry up to 24 hours.

Automated purge/cleanup jobs remove eligible expired technical data. Account-linked data is removed following verified deletion, subject only to narrowly documented security, fraud, legal, accounting or statutory retention requirements.

10 · Account deletion and revocation

Deletion is distinct from a security freeze.

Users can start account deletion from m3lytsz Settings or at https://m3ly.me/account-deletion.html. m3lytsz verifies account control before destructive deletion. Session/device logout and revocation remain security controls and do not mean the account itself has been deleted.

Account-security rights such as logout, session/device revocation, deletion management and guest/link termination are designed to remain available even where normal interactive service is on jurisdictional legal hold.

11 · Service providers

Infrastructure is limited to m3lytsz operation and protection.

Supabase provides the dedicated m3lytsz backend/database and Edge Function infrastructure; the current project is configured in London eu-west-2. Cloudflare provides edge/security delivery and jurisdiction routing. Google Play distributes the existing Android package and may independently process Google-account/payment data under Google's terms.

No unverified backup/provider is authorised to receive unrestricted production personal data solely because it appears in a roadmap or planning document.

12 · Payments

No payment-card collection is required for core messaging.

Core security/privacy protections do not require m3lytsz to store payment-card credentials. If paid digital functionality is later enabled in the Play-distributed app, the exact billing route and resulting data categories must be reviewed against current Google Play rules before activation.

13 · Legal bases and rights

Service delivery, security and lawful operation.

Where UK GDPR applies, processing may rely on performance of the requested service or pre-contract steps, legitimate interests in security/abuse prevention, legal obligations and consent where an optional activity legally requires it. m3lytsz does not sell personal data and does not use personal data for behavioural advertising.

Depending on jurisdiction, users may have rights to access, correct or delete personal data; restrict/object to certain processing; withdraw consent where applicable; and complain to a competent regulator. Requests: snooptsz@m3ly.me. Proportionate proof of control of the relevant pseudonymous m3lytsz identity may be required.

14 · Children / UK online safety

18+ is product policy, not age assurance.

The private beta is intended for people aged 18 or over, but m3lytsz does not treat self-declaration, a checkbox or hold gesture as highly effective age assurance. For current UK compliance governance, m3lytsz conservatively treats the service as likely to be accessed by children and applies child-safety defaults rather than behavioural age profiling. Any feature/content that legally requires highly effective age assurance must fail closed until such a process is implemented and privacy-reviewed.

15 · Changes

The policy follows the actual Play build.

This policy is reviewed whenever m3lytsz changes Android permissions, SDKs, processors, transports, messaging, payments or material data flows. Google Play Data Safety answers must match the exact signed AAB distributed to users.