Beep — Privacy Policy

Last updated: 17 October 2026

Beep is a messaging app for Android, published by Concise Design. This policy explains what happens to your information. The short version: Beep has no account, no server of ours carries your messages, and it collects nothing. What it sends goes through MQTT brokers: your encrypted messages and, to contacts you have accepted only, encrypted delivery receipts, read receipts, typing indicators, and your display name and "about" text. It also sends a small signed marker saying whether you are online, which is not encrypted. Read receipts, typing indicators and online status are on by default, and you can turn each of them off in Settings.

What we collect

Nothing.

There is no account, no sign-up, no phone number, no email address and no analytics. The app sends the developer no usage statistics and no crash reports, and no server of ours relays or stores your messages. Invite links point at our website, but the Beep code in them is never sent to it; see Your Beep code and invite links.

What stays on your device

Your identity keys, sealed with a key held in your device's Android Keystore (in secure hardware on most devices), which cannot be exported from the device. They leave only if you export a backup; see Identity backup
Your display name and optional "about" text. A copy goes, encrypted, to each contact you add or accept, and again when you change them; see What leaves your device
Your contacts and message requests: their display names, public keys and Beep codes
Your message history
The ids of messages received in the last 14 days, and of messages you delete for 14 days after you delete them, so a copy of one cannot be replayed to you
Your settings, including your broker list and any broker usernames and passwords

Removing Beep deletes all of it from your device, and so does Settings → Delete identity and all data, which also asks each broker you have switched on to drop the session it keeps for your device, with any encrypted messages waiting in it, and your online-status marker. We hold no copy, so there is nothing for us to delete on request. Some copies are outside your device and out of reach of either of us: your contacts keep their side of your conversations, plus your name and keys. A broker that cannot be reached when you delete your identity, or one you had switched off, may keep encrypted messages waiting for your device and your last online-status marker until it decides to discard them. So may every broker if you uninstall Beep without deleting your identity first.

What leaves your device

Encrypted envelopes to your contacts, and a small online-status marker to the brokers.

Each message is signed with your Ed25519 identity key, then encrypted on your device before it is sent, using a one-time X25519 key agreement and AES-256-GCM. Only the recipient's device holds the key material needed to read it. Your public keys and the signature travel inside the encryption, so the message itself tells only the recipient who sent it, and every message is padded to one of a few fixed sizes before it is encrypted. The broker can still see which connection published it; see MQTT brokers.

Besides the messages and pages you send, Beep sends some things on its own. Each is encrypted the same way and goes only to that contact:

a delivery receipt when their message arrives
a read receipt when you open it, unless you turn read receipts off
a typing signal while you write, unless you turn it off
your profile: your display name, your "about" text and the key for your online status. It goes out when you add, accept or unblock a contact, when you change your profile, after you restore your identity, when another contact is blocked or removed, when a contact sends you an online-status key your device has not seen before, and each time Beep's connection starts, to any contact whose online-status key your device does not hold yet

Nothing goes back to a message request until you accept it or reply. If Online status is on, which it is by default, Beep also publishes a signed but unencrypted marker to every broker; see Online status.

To connect, Beep gives each enabled broker a connection name made from part of your inbox topic and a random value, and the list of topics it listens on, which includes the online-status topic of each contact whose status you can see. If you add a broker with a username and password, Beep sends them to that broker when it connects.

Your Beep code and invite links

Your Beep code is your display name, your two public keys, and the list of brokers you are reachable on. It is not encrypted: anyone who has it can send you a message, which arrives as a message request. It leaves your device when you share it, by showing your QR code, using Copy link, or using Share.

The QR code and Copy link give a beep:// link, which opens Beep directly and never touches the web.
Share sends a link that looks like https://beep.monster/c/#…, and everything after the # is your Beep code. If someone opens it in a web browser, or the app you sent it with fetches a link preview, the request goes to our web server at beep.monster, but the part after the # is never sent in a web request, so the server receives only /c/ and not your Beep code.

A link you send or paste passes through the app you send it with, like the rest of the message.

MQTT brokers

Beep delivers messages through MQTT brokers, and can use several at once. A broker is a relay: it passes encrypted messages between devices. While your phone is offline, each broker holds the encrypted messages waiting for it and delivers them when it reconnects. While Online status is on, it also keeps your latest online-status marker. How long a broker keeps undelivered messages is up to its operator; see What stays on your device for what Delete identity and all data asks of it.

A broker cannot read your messages. Every message reaches it only as ciphertext. The online-status marker described below is signed but not encrypted, and the broker also sees the connection details listed next.

A broker can see metadata. Specifically:

the topics involved, which are hashes that contain neither your Beep code nor your keys
when messages pass, and which of a few fixed sizes they are
your IP address, as with any internet connection
your connection name (MQTT client id), made from part of your inbox topic and a random value Beep generates the first time it connects. The name is the same on every broker. The random part stays the same even if you restore or replace your identity, until you remove Beep or delete its data, so an operator can link your old and new identity through it
for the broker's operator, which connection listens on and publishes to which topics
any username and password you set for that broker

An operator who wants to can work out from that which two devices are exchanging messages. Beep does not tell them who you are, but your IP address may, and anyone who holds the QR code or link you share as your Beep code can work out which inbox topic is yours.

Anyone else connected to a public broker can subscribe to every Beep topic at once. That lets them see when traffic arrives on each topic, which of the fixed sizes it is, and every online-status marker, without learning whose topics they are.

The brokers Beep ships with are free, publicly available test services operated by third parties, not by us. The first three are on by default:

EMQX Public — broker.emqx.io (EMQX)
HiveMQ Public — broker.hivemq.com (HiveMQ)
Eclipse Mosquitto Test — test.mosquitto.org (Eclipse Foundation)
EMQX Public (alt region) — broker-cn.emqx.io (EMQX), off unless you turn it on

We have no relationship with these operators, no agreement with them about your data, and no control over what they log or for how long. Their own policies govern what they do with connection metadata.

If that is not acceptable to you, use your own broker. Settings → Brokers lets you add a broker you run yourself and switch the public ones off. Your contacts need to add the same broker and switch the public ones off too: two people can only reach each other through a broker they both use, and until your contacts switch them off, what they send you still passes through the public brokers. A broker of your own, used this way, is the recommended configuration for anyone with a meaningful threat model; a hosted MQTT service is still run by someone else. Keep TLS on for your broker: if you add a broker without TLS, anyone on the network between you and it can see the same metadata the broker sees, and any username and password you set for it. Message contents stay encrypted either way.

Online status

Online status is on by default. While it is on, your device publishes a small signed marker saying it is connected, on a topic derived from a key that only the contacts you have accepted receive. Blocking or removing a contact changes the key.

The marker is signed but not encrypted, and each broker keeps your latest one until it is replaced or removed. Anyone who subscribes to every topic on a public broker can read every marker and see when it changes, but without the key cannot tell which one is yours. The broker's operator can also see which connection publishes it. Anyone who has the key (your accepted contacts, or anyone they pass it to) can tell which marker is yours. It says only that you are online or offline, and when.

You can turn it off in Settings, and Beep works normally without it. Beep then removes your marker from each broker you have switched on: straight away from the ones it is connected to, and from the others the next time it connects to them, which with "Stay connected" off is not until you turn it back on. A broker you switched off or removed while Online status was on keeps the last marker it received, which may say you are online, until its operator discards it.

Permissions

Permission	Used for
Internet, network state	Connecting to your MQTT brokers
Foreground service (special use)	Holding the connection open so messages arrive in real time. Runs while "Stay connected" is on, which is the default
Notifications	Telling you about messages and pages
Full-screen alerts	Taking over the screen, like an incoming call, when a page from a contact you have accepted arrives. Over a lock screen with a PIN, pattern or password, that screen says only that someone is paging you; it never shows the note. The page's notification follows your phone's lock-screen notification settings, like any other
Run at startup	Restoring the connection after a reboot, only if "Stay connected" is on
Vibrate	The alert pattern for a page
Biometrics	The optional app lock. Beep never sees your fingerprint; the system confirms or denies
Camera	Scanning a contact's QR code. Images are processed on the device and never stored or sent

Children

Beep is not directed at children and we do not knowingly collect information from anyone. It permits unrestricted communication between users and is rated accordingly.

Identity backup

You can export your identity as a passphrase-protected block of text. It is encrypted with a key derived from your passphrase (PBKDF2-HMAC-SHA256, 210,000 iterations) before it is shown to you, and Beep does not upload it anywhere — where you store it is entirely your choice. Beep can restore it during first setup or from Settings.

Anyone who holds both the exported text and your passphrase can impersonate you, read messages sent to you from then on, and decrypt any earlier messages to you that they or a broker recorded. Store them separately.

Third-party libraries

Beep uses open-source libraries — Eclipse Paho for MQTT, Bouncy Castle for cryptography, ZXing for QR codes, and AndroidX and Jetpack Compose from Google. They run entirely on your device. None of them are analytics, advertising or tracking libraries, and none of them transmit anything on their own.

Changes

If this policy changes, the date at the top changes with it, and material changes will be noted in the app's release notes on Google Play.

Contact

Questions about this policy: support@beep.monster