Countersign.me Privacy Policy
Effective date: July 15, 2026 · Last updated: July 15, 2026
The short version. Countersign.me is built so there is almost nothing to collect. There are no accounts. We never ask for your name, email, or phone number. We never see, hear, record, or store your calls, video, or messages. We run no analytics, no advertising, and no tracking. Your contacts, verification history, and identity key stay on your device. Our server is a "blind relay": it holds only a short-lived, unreadable message queue and the push token needed to wake the app, in memory, with no database behind it.
1. Who we are
Countersign.me ("the app") is provided by FMJ Security, LLC ("we," "us," "our"). For any privacy question, contact us at privacy@countersign.me.
Countersign.me is a companion app for mutual human-verification: two people who have paired their devices can confirm, during a call or chat on any other app, that they are really talking to each other's paired device and a live person — as a defense against deepfake and voice-clone impersonation. The app hosts no calls or messaging of its own.
2. Information we do NOT collect
To be explicit, Countersign.me does not:
- Require or create an account, username, or password.
- Collect your name, email address, phone number, or physical address.
- Access, record, store, transmit, or analyze the content of your phone calls, video calls, or messages — Countersign.me runs alongside those apps and has no visibility into them.
- Read your device's address book / contact list.
- Collect your location.
- Contain any analytics, crash-reporting, advertising, or tracking SDKs.
- Track you across other apps or websites, or build an advertising profile.
- Sell or rent personal information. (We have essentially none to sell.)
3. Information stored only on your device
The following stays on your phone and is never uploaded to our server. You share any of it with another person only when you explicitly choose to (for example, sending a pairing invite):
- Your identity key. On first launch the app generates a cryptographic identity key inside your device's secure hardware (Apple Secure Enclave / Android Keystore). This key is non-exportable — it cannot be read, copied, backed up, or extracted, by us or by anyone else, and every use requires a live biometric check (Face ID / Touch ID / fingerprint). The device is the identity; there is no account to compromise.
- Your contacts. Display names you assign, each contact's public key and pairing/trust badge, and your verification history (timestamps and match/mismatch/declined outcomes) are stored locally. They are never uploaded to our server.
- App settings, such as your chosen relay server URL.
How this is stored. Your identity key is held in your device's dedicated secure hardware (Apple Secure Enclave / Android Keystore) and is non-exportable. Your contacts, verification history, invite tokens, and app settings are kept in the app's on-device storage; like most app data on your phone, they are protected by your operating system's device-level storage encryption when your device is locked, rather than by a separate app-specific encryption key. All of it remains on your device regardless.
If you delete a contact, or delete the app, the associated local data is removed from your device.
4. Information our relay server processes
To deliver a verification request from one paired device to another, both devices talk to a "blind relay" server. The relay is deliberately designed to know as little as possible. It operates entirely in volatile memory with no database and holds only:
- A device "keyhash" → push-token mapping. The keyhash is a one-way hash of your device's public identity key — it is not, and cannot be reversed into, your name or any real-world identity. The push token (see §6) is used solely to send a content-free "wake up" notification.
- A short-lived message queue. When one paired device sends a verification message to another, the relay holds the message only until the recipient fetches it, and in any case no longer than 5 minutes, after which it is discarded automatically. Messages are end-to-end signed and opaque to the relay — the relay verifies the sender's signature but cannot read the contents, and the messages contain no conversation content in the first place.
- Transient abuse-prevention counters. To prevent spam and denial-of-service abuse, the relay keeps short-lived, in-memory rate-limit counters keyed on sender keys and on source IP address. These counters expire within about a minute and are not stored, logged to a database, or linked to your identity. As with any internet service, our hosting provider's infrastructure may also process connection metadata (such as IP addresses) transiently to route and protect traffic.
The relay keeps no names, no contact graph (it never learns who your contacts are), no persistent message history, and no ability to forge or read verifications. Because the relay's state is in memory only, it is not backed by a persistent database of users.
You (or a future self-hoster) can point the app at a different relay server in Settings; the app treats the relay as an untrusted, replaceable component.
5. Device permissions
- Camera — used only to scan a contact's pairing QR code, on-device. Camera frames are processed locally for the QR code and are never recorded, stored, or transmitted.
- Biometrics (Face ID / Touch ID / fingerprint) — handled entirely by your operating system to authorize use of your identity key. The app receives only a yes/no result; it never receives your biometric data, which never leaves the OS's secure subsystem.
- Notifications — used to wake the app for an incoming verification request. These push notifications are content-free (they carry no message data).
6. Push notifications
To notify you of an incoming verification request, we use Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. Your device's push token is stored by our relay (in memory, per §4) and used only to send these content-free "wake up" pushes. The push token is a device identifier that is not linked to your name or any other personal information.
7. Purchases
Countersign.me is free for up to 3 paired contacts. Unlimited contacts are available through a one-time in-app purchase (no subscription). Purchases are processed by Apple App Store (StoreKit) or Google Play Billing, and purchase status is managed via RevenueCat. We never see or receive your name, card number, or other payment details — those are handled by the app store. To restore your purchase after reinstalling, the app stores validate your purchase receipt without requiring an account.
RevenueCat processes purchase-related data (such as an anonymous app-user identifier and transaction information) on our behalf to manage entitlements. Apple, Google, and RevenueCat each act as independent processors under their own privacy policies:
- Apple: apple.com/legal/privacy
- Google: policies.google.com/privacy
- RevenueCat: revenuecat.com/privacy
8. Third-party services
We rely on the following third parties strictly to operate the app's core function. We do not share personal information with them for their own marketing.
| Service | Purpose | Data involved |
|---|---|---|
| Apple Push Notification service (APNs) | Wake the app on iOS | Device push token; content-free pushes |
| Firebase Cloud Messaging (FCM) | Wake the app on Android | Device push token; content-free pushes |
| Apple App Store / Google Play / RevenueCat | Process and restore purchases | Purchase receipt / anonymous purchase identifiers; no payment details reach us |
| Cloud hosting provider (relay server) | Run the blind relay | Transient connection metadata (e.g. IP), keyhash, opaque queued messages — all in memory, per §4 |
9. Data retention and deletion
- On our relay: queued messages are deleted on fetch or within 5 minutes, whichever comes first. The keyhash → push-token mapping and abuse-prevention counters live in volatile memory, do not persist across server restarts, and the mapping itself expires automatically after about 30 days without a refresh. We operate no user database, so there is no long-term server-side record of you to retain. Our hosting platform may keep short-lived operational logs (for example, error diagnostics) under its own retention policy; these contain at most a truncated, non-identifying key reference and never message contents or push tokens.
- On your device: your identity key, contacts, and verification history remain until you delete the relevant contact or uninstall the app.
- To delete your data: delete a contact to remove it locally; uninstall the app to remove all local data; your relay push-token registration is refreshed each time you open the app and expires automatically after about 30 days without it. For any additional request, contact privacy@countersign.me.
10. Data security
Your identity key is generated in and protected by your device's dedicated secure hardware and is non-exportable. Traffic between the app and the relay is encrypted in transit (HTTPS/TLS). Verification messages are additionally end-to-end signed and are opaque to the relay. Because we hold no persistent database of personal information, there is no central store of user data to breach; a full compromise of the relay would expose only push tokens and traffic timing, not names, your contact list, or message content.
No system is perfectly secure, and we cannot guarantee absolute security, but Countersign.me is architected specifically to minimize what could ever be exposed.
11. Children's privacy
Countersign.me is not directed to children under 13 (or 16 where a higher age applies, such as in parts of the European Economic Area), and we do not knowingly collect personal information from children. Because the app collects no personal information and requires no account, it does not build profiles of any user, including minors.
12. Your privacy rights
Depending on where you live (for example, under the EU/UK GDPR or the California Consumer Privacy Act), you may have rights to access, correct, delete, or port your personal information, and to object to certain processing. Because Countersign.me holds essentially no personal information about you — no account, no name, no contact graph, only transient device identifiers on the relay — most such data is not in our possession to begin with. To exercise any right, or to ask what we hold, contact privacy@countersign.me and we will respond as required by applicable law. We do not "sell" or "share" personal information as those terms are defined under applicable privacy laws.
13. International users and data transfers
The app can be used worldwide. Our relay server is currently operated in the United States (Azure Container Apps, East US region). If you use the app from another country, the limited, transient data described above (such as your push token and opaque queued messages) is processed on servers in that region. Given the minimal and short-lived nature of that data, we rely on that minimization as our principal safeguard.
14. Changes to this policy
We may update this policy as the app evolves. Material changes will be reflected by updating the "Effective date" above and, where appropriate, an in-app or store notice. Continued use of the app after an update constitutes acceptance of the revised policy.
15. Contact us
Questions about this policy or your privacy? Contact FMJ Security, LLC at privacy@countersign.me.