Effective July 2, 2026
Your keys stay on your device, your records are encrypted, and no model ever reads what you write.
Your identity is an Ed25519 keypair, and the private half lives on your device in secure storage. We never hold it, transmit it, or have access to it. When you sign a record, it is signed locally and verified by your public key. If you delete your account, the key is destroyed and your identity is mathematically unrecoverable.
Möbius uses a sync relay to deliver records between your devices and the people you connect with. The relay stores your signed records (encrypted per-Ring with XChaCha20-Poly1305) and delivers them to recognized members. The relay operator cannot read the content of encrypted records. The relay retains records permanently so new devices can pull full history.
Media you attach (voice recordings, images) is stored in Cloudflare R2 object storage, keyed to your identity. If you delete your account, your media is deleted.
We do not run analytics that follow you. We do not embed third-party trackers. We do not build a profile of you. Möbius is not trying to learn your behavior, because the model that needs that is the model we rejected.
Nothing you contribute is fed to a model for ranking, moderation, profiling, or training. Contributions are read by people. The Narrative Core's observations (when you subscribe to the depth tier) are generated from your participation patterns, not from reading your content — and they run on your device or through a privacy-preserving cloud endpoint, never stored by the relay.
If you subscribe to the depth tier, your subscription is managed by RevenueCat, a third-party subscription management service. RevenueCat receives your anonymous app user ID (your DID) and your purchase receipt from Apple. RevenueCat does not receive your name, email, or any content you create. Their privacy policy is available at revenuecat.com/privacy.
You can export your identity keyfile at any time from the Key storage screen. Your signed records are yours — they carry your signature and are cryptographically provably yours.
You can delete your account at any time from the Key storage screen. Deletion is irreversible: your keypair is destroyed, your records on the relay are purged, your media is deleted, and your shortcode is freed. No recoverable trace of your identity remains.
Möbius is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child under 13 is using Möbius, contact us.
Questions about this policy: hello@onesurface.org
If this policy changes, the updated version will be available in the app and at this URL, and the effective date will be updated.