Signal Privacy Policy

This document governs use of Signal Messenger LLC's messaging and calling services, combining Terms of Service and a Privacy Policy under California law, with the stated purpose of operating end-to-end encrypted communications. The terms assert that Signal does not sell, rent, or monetize personal data or content in any way, that message content cannot be decrypted or accessed by Signal, and that minimal technical metadata (authentication tokens, push tokens, keys) is retained only as required to operate the service. Notably, the document's data minimization posture is substantially narrower than typical consumer messaging platforms, reflecting Signal's architectural commitment to collecting only a phone number for registration and hashing contact data for discovery; however, the policy's compelled disclosure provision permits sharing data in response to applicable law, regulation, or enforceable governmental requests without explicit notice to users, which is standard but operationally significant given Signal's user base. The policy engages GDPR, CCPA, COPPA (minimum age 13), and FTC Act consumer protection frameworks; GDPR applicability is not explicitly addressed in the document, though the effective date of May 25, 2018 coincides with GDPR enforcement commencement, suggesting awareness of that framework. The absence of explicit EU/EEA data transfer mechanisms, a Data Protection Officer designation, or a dedicated GDPR lawful basis statement represents a material gap for EU-facing compliance review.