This statement covers the public website at mercury-messaging.com, the installer downloads and update-check endpoint hosted on it, and what the Mercury app and relay process. The short version: this site has no accounts, no analytics cookies, and no ad tech — and the relay cannot read your messages.
// last updated: june 10, 2026
The Mercury website does not have account registration, contact forms, payment forms, advertising cookies, or analytics cookies. Mercury does not intentionally collect names, email addresses, phone numbers, payment information, message contents, or app account identifiers through this website.
The website is hosted on Cloudflare Pages. When someone visits the site or downloads an installer, Cloudflare may process standard hosting and security log data such as IP address, browser or user-agent information, requested URL, timestamp, and related request metadata.
This information is used to operate the website, deliver the Windows and Linux installers and their checksums, secure the site, diagnose availability or abuse issues, and maintain basic hosting records. Mercury does not sell website visitor information and does not use it for advertising.
The Mercury desktop app periodically requests /updates/latest.json from this
website to learn whether a newer signed release exists. Like any web request, this is
processed by Cloudflare with standard hosting log data (IP address, user-agent, timestamp).
The request carries no account identifier and no message data; updates are never installed
without an in-app prompt.
The "add a contact" page at /add carries the shared account id in the URL
fragment (the part after #), which browsers do not send to the server. The id
is read and validated entirely client-side, in your browser. An account id is public
reachability information — it lets people reach you; it is not a key and exposes no message
content.
The Mercury desktop app stores identity keys on the user's device, sealed by the operating system's keychain. Message contents are end-to-end encrypted before they reach a relay. A relay may process the routing metadata needed to deliver opaque ciphertext, such as account identifiers, timestamps, ciphertext sizes, and network connection metadata. The relay is not intended to receive plaintext message contents, and the client refuses to send any. You can also run your own relay, in which case our infrastructure is not involved at all.
Your account — profile, contacts, and conversations — lives in an encrypted file on your device, sealed by a key in your operating system's keychain. It survives app updates, and on the same machine it survives an uninstall and reinstall. To move to a new machine, export an encrypted backup from the app's Recovery panel and restore it on first run. Nothing recoverable leaves your device unless you export that backup yourself.
You can erase everything at any time: Recovery → Delete everything on this device removes the account and its key from your device irreversibly, and can optionally send a delete-for-everyone to the people you have messaged (best-effort — it reaches reachable contacts; it cannot reach someone offline forever or who already kept a copy). Undelivered messages waiting on a relay expire on their own. Full details, including the honest limits, are in DATA-HANDLING.md.
Website hosting and security processing is provided by Cloudflare. The Windows installer is code-signed through Microsoft Azure trusted signing infrastructure. Mercury does not sell personal information.
Mercury does not maintain a separate website visitor database. Hosting and security logs are retained according to the policies and settings of the hosting provider and are used only for the operational purposes described above.
The most reliable public channel to reach the project is the open-source Helix repository on GitHub.