Security here is not a set of promises but the way the service is built: there is data we could not read even if we wanted to, because we do not have the keys.

End-to-end encryption#

Private chats and calls are protected by end-to-end encryption using the Signal protocol — the same one behind Signal and WhatsApp. Encryption keys are created on the devices and stay there: the server passes on data that is already encrypted and cannot decrypt it.

This means the content of your messages and conversations is out of reach for us, for your network operator, and for anyone intercepting traffic along the way.

What encryption does not cover#

Being honest about the limits. End-to-end encryption protects content, but not the fact of a connection.

Posts, short videos, stories and comments are the open, social part of the service. They are stored on our servers in ordinary form, otherwise there would be no way to show them to other people.

Conversations are not stored on our servers#

An encrypted message lives on the server only until it is delivered and is removed right afterwards. If the recipient stays offline for a long time, undelivered messages are deleted automatically.

So in response to an official request we can hand over only what we have — account data. We do not hold the content of conversations.

Protecting your account#

Your phone number is your login. The account is tied to your number, and signing in is confirmed with a code. Keep access to that number: whoever controls the number can sign in.

Sessions. The settings show the list of devices where you are signed in. Any session can be ended — for example, if you lost your phone.

Backups. A backup copy of your conversations can be protected with a password only you know. Without it the copy cannot be restored — including by us.

Screen security. A separate switch in privacy settings blocks screenshots and screen capture throughout the app.

What you can set up#

Disappearing messages — in every chat or in one.
Who sees your number, profile photo and last seen time.
Blocking and reporting any account.

For details on what data we receive and how long we keep it, see the Privacy Policy.

Official apps#

Download Link only from official sources: the App Store, Google Play, the Microsoft Store, and desktop.linkmessenger.me for Mac.

Modified builds — “mods”, patched APKs, unofficial clients — break security checks and end-to-end encryption: they put both you and the people you talk to at risk. Signing in from such a build leads to the account being blocked for a month.

If you have found a vulnerability#

We are grateful to researchers and look at these reports first. Write to support@linkmessenger.me with “Security” in the subject and describe:

what the problem is and how it threatens users;
how to reproduce it — step by step;
the app version and the device where you found it.

Please do not publish the vulnerability before we have fixed it, and do not use it against other people’s accounts: test only on your own. We will reply and keep you posted until the problem is resolved.

Watch out for scammers#

Link has no Telegram bot. The confirmation code arrives in the official “Telegram” service chat with a blue check mark. Anything asking you to send a bot your phone number or code is a scam.
We never ask for your confirmation code, password or PIN. Not in chat, not by phone, not by email.
We do not disclose account data to third parties — not your phone number, not your conversations, no matter who asks.

If “Link support” writes to you asking for a code or money, those are scammers. Report the account from the app and let us know.