Language: Русский (binding) · English summary
Privacy Policy
Non-binding English summary. This page is a courtesy overview for convenience only. The legally binding document is the Russian version at morzy.ru/privacy. If this summary differs from the Russian text, the Russian text prevails. Personal data is processed under the laws of the Russian Federation, including Federal Law No. 152-FZ.
1. General
This summary describes how the operator processes users’ personal data for Morzy. By using the service you confirm you have reviewed the binding Russian policy and Terms summary (binding Russian Terms: /terms).
2. Data we process
- Account: email, @username, display name, city, about, birthday (optional; year can be hidden), password (hash only).
- Third-party sign-in (if you choose it): VK ID and/or Yandex ID account id, plus name, email and avatar those services send with your consent.
- Communication content: messages, files, voice/video messages, reactions, group/channel data you take part in.
- Technical: IP (including at registration), device/browser/app type, push tokens (FCM / Web Push / APNs if available), login and activity times, cookies and local session data.
- Support and reports: name, email, message text, details of disputed content or users.
3. Purposes
- Registration, sign-in, email confirmation and account recovery.
- Delivering messages, files and calls, notifications, people search subject to privacy settings.
- Account security, spam/abuse prevention, handling reports, complying with the law.
- Support replies and fulfilling data-subject requests.
4. Legal bases (summary)
- Performance of the user agreement — to run the messenger.
- Consent — at registration (16+, accepting policy and terms), optional profile fields, VK ID / Yandex ID sign-in.
- Operator’s legitimate interests within the law — security and abuse prevention.
- Legal duties under Russian law.
5. Storage, retention, location
Primary collection and storage are on FirstVDS hosting in the Russian Federation.
- Profile data — until you or the operator delete the account.
- Direct-chat messages and media — while the account exists and history is needed; on account deletion — see section 10.
- Group/channel messages — may remain in chat history after the author’s account is deleted (shown as “Deleted account”).
- Technical logs and IP — as needed for security and diagnostics, generally no longer than required for those purposes.
- Push tokens — while the device/browser is subscribed or until the account is deleted.
- Support tickets — until handled and for a reasonable time after, unless the law requires longer.
Passwords are never stored in plain text. Max upload size follows the current server setting and may change.
6. Third parties and cross-border transfer
We do not sell personal data. Transfer may occur to:
- infrastructure contractors: FirstVDS hosting (Russia); email service for codes and mail;
- sign-in providers — VK (VK ID) and Yandex (Yandex ID), if you choose them; scope depends on your consent with the provider;
- Android push — Google Firebase Cloud Messaging (FCM); this may mean sending technical device identifiers outside Russia to deliver notifications under the agreement;
- authorised bodies when required by Russian law.
7. Cookies and local data
- HttpOnly cookie
morzy_auth— login session (JWT), needed for the site, images and WebSocket without putting the token in the URL. Lifetime within the session term. - Browser/app localStorage: session token, server address, UI settings and service flags — for login and the client.
- Service Worker and Web Push — browser notifications (with your permission).
We do not use third-party advertising or analytics cookies. Disabling strictly necessary session cookies makes web sign-in impossible.
8. Age
The service is for users 16+. By registering you confirm you have reached that age or act with a legal guardian’s consent.
9. Your rights
- Obtain information about processing; update your profile in settings.
- Withdraw consent and delete the account under Settings → Security (see section 10).
- Limit profile/contact visibility via privacy settings; block users.
- Send a data-subject request via the support form or [email protected]. We reply within statutory time limits.
10. Account deletion
- In the app: Settings → Security → Delete account (password confirmation may be required).
- Direct messages are removed for you and your contacts.
- In groups and channels your messages may remain labelled “Deleted account”.
- The profile is anonymised; you cannot sign in to that account again. The same email can be registered anew.
- You can also email [email protected] if you cannot access the account.
11. Security measures
We use organisational and technical measures: HTTPS, password hashing, limited server access, session separation. Absolute security on the internet cannot be guaranteed.
12. Changes
The current binding version is always on /privacy (Russian). Material changes are reflected in the edition date. See also the Terms summary and binding Russian Terms.