Who controls your data
AMAAR ONE LTD is the operator and data controller for MARCO Chat. Privacy and deletion questions can be sent to support@melega.app.
Account and profile
MARCO Chat uses a pseudonymous account and does not require a phone number or email address. We process the account identifier, username, display name, optional biography, optional profile image, session and device records, and the security state needed to operate the account. Account identifiers and security records are needed to operate the account. Biography and profile images are optional. Profile data supports exact-username discovery and the choices you make about how other users see you.
Messages, calls and media
Private message content and shared media are end-to-end encrypted before they leave your device. MARCO servers store and transmit ciphertext but do not hold the conversation keys needed to read it. Your recipients can decrypt the content on their authorised devices. If you deliberately report a message, the selected evidence is shared with MARCO moderation as described below; this does not provide access to the rest of the chat. Encrypted content may include text, reactions, replies, voice notes, photos, videos, documents, location and contact cards that you deliberately share.
The self-hosted Matrix service necessarily processes operational metadata such as pseudonymous user and room identifiers, event identifiers, timestamps, membership, delivery state and encrypted object references. Read receipts and typing indicators are processed only when those features are enabled. We do not place message plaintext or conversation metadata in push notifications.
Notifications
With notifications enabled, MARCO registers a platform push token for Firebase Cloud Messaging on Android or Apple Push Notification service on iOS. Push delivery uses generic activity alerts and/or wake signals, an opaque routing reference and, where applicable, a badge count. Push payloads do not include message text, filenames, Matrix room IDs or event IDs. Device revocation and account deletion remove server-side push registrations. You control notification presentation and sounds through the app and system settings.
Contacts, biometrics and device permissions
MARCO Chat does not upload or synchronise your address book. On Android, the system contact picker lets you deliberately choose one contact and grants the app access only to that selection. A contact card leaves the device only if you choose to send it in an encrypted conversation. Biometric templates remain with the operating system; MARCO receives only the success or failure of an authentication request.
Location you choose to share
Location access is requested when you choose to share your location. You may grant approximate or precise access where your operating system supports that choice, or decline and continue using the app. The selected coordinates are sent within the encrypted conversation. Opening a location in an external maps app or website sends those coordinates to the service you open. A location message deliberately selected for a report may also be included in readable moderation evidence.
Reports, blocking and safety
Reporting a user sends the reporter and reported account identifiers, the selected reason, timestamp and optional note. Reporting a message additionally shares only the selected evidence and limited opaque references after your confirmation. It does not automatically share surrounding messages or your full chat history. Authorised MARCO moderators can read submitted evidence to assess abuse and take action. Blocking preferences are associated with your account and are used to suppress unwanted contact.
Report evidence and the reporter’s note are deleted automatically 30 days after the ticket is closed, unless preservation is necessary for a documented legal obligation or dispute. Basic report and moderation-action records are retained separately for abuse prevention and accountability. Account deletion removes account associations where required by the deletion workflow; it does not immediately erase every report. Safety and reporting contact: report@melega.app.
Optional services
GIF search is optional. When you perform a GIF search, MARCO forwards the search terms to GIPHY without intentionally including your MARCO account identifier or contact graph. GIPHY receives the search query through MARCO’s server proxy and applies its own privacy terms. MARCO does not intentionally forward your device IP address to GIPHY. Wallet verification is optional and processes a public wallet address, a challenge and a signature. The MARCO Passport integration is currently disabled in production.
Service providers and locations
The production Matrix and account services run on infrastructure hosted by Hostinger. Encrypted media objects are stored in Cloudflare R2. Google Firebase Cloud Messaging provides Android push delivery, Apple provides iOS push delivery, and GIPHY answers searches initiated by the user. These providers process data on our behalf or at your explicit request. We do not sell personal data and do not use chat activity for advertising profiles.
Retention
- Account and profile records remain while the account is active and are removed on deletion, subject to the separate moderation records described above.
- Sessions, devices and push registrations remain until they are revoked, signed out or deleted.
- Encrypted message history and media remain while required by the participating rooms and are subject to user deletion and redaction actions.
- MARCO does not retain GIPHY search terms as a search-history profile.
- Network IP history is disabled in the Matrix application configuration.
- Production service logs are size-bounded and rotated; they are not message-content logs.
Account deletion cannot remove copies already delivered to another person, exports or screenshots, or data another person must retain under law. Encrypted historical events may remain on recipient devices or in shared rooms without becoming readable by MARCO. No separate application-data backup system is currently configured.
Your choices and account deletion
You can edit profile data, disable notification and interaction settings, revoke devices, or permanently delete your account in the app. You can also submit an external deletion request on the Delete MARCO account page. We may need to verify control of the account before acting on an external request.
Review demonstration sessions
An explicitly chosen, code-protected review session uses a separate demonstration identity and synthetic starter content. Its automated contact is a recipient of the demo messages and can decrypt and reply to them. This contact has no access to ordinary conversations. Ordinary account creation does not populate demonstration content. Demo reports use the real moderation system and are identified as tests by the server.
Security and changes
Data is encrypted in transit and private conversation content is additionally protected by end-to-end encryption. No security measure eliminates every risk. Material changes to this policy will be posted on this page with a new effective date.