This policy explains what information we collect when you use the TenChat app and the tenchat.mn website (“TenChat”), what we use it for, whom we share it with, how long we keep it, and your rights.
1. Who is responsible
Your personal data is controlled by Ten Plus LLC (registration number 6552072; address: Room 903, LS Plaza, Javzandamba Street, 18th khoroo, Khan-Uul District, Ulaanbaatar, Mongolia; email: support@tenplus.mn), “we” below.
2. What we collect and why
Account data: your email address, a verified phone number if you sign in with it, and, if you sign in with Google or Apple, the email and identifier they give us. A phone number added to your profile without OTP is unverified; we use it only for exact phone lookup and for finding friends from contacts, never for sign-in. Purpose: to sign you in, protect your account, and let people find you by the exact email or profile phone number they search for or have in their contacts.
Profile: your name, bio (up to 150 characters) and profile photo. The people you chat with (in groups too), your friends, people who search for your email or phone, and people who find you from their contacts can see them. Your email address is visible only on your friends' profiles. Your phone number is not displayed on other people's profiles.
Messages: the messages you send and receive in one-to-one and group chats: their text, the photos, videos, voice messages and files attached to them, the message they reply to and the people they mention (in a group also “@all”), whether a message was forwarded, edited or pinned, the reactions people add, when they were sent, and who read them and when. Message text, file names, group names and what a message carries besides its text (a poll, a shared place or contact, a sticker, a link preview) are stored encrypted on our server. This is not end-to-end encryption: the server can decrypt them to build notifications and to review a report. Photos, videos, voice messages and files are stored on our server as they were sent, not encrypted like the text; only the members of the chat can open them, through links that expire after 15 minutes. When a message is deleted with “Delete for everyone” (by its sender within 24 hours of sending, or by a group's admin at any time), its text is erased from the server at once and its photos, videos, voice messages and files are deleted within 7 days, with its reactions, pin and poll votes. You can edit your text message within 48 hours of sending it: the new text replaces the old one, which we do not keep; the chat shows that it was edited. “Delete for me” hides a message only for you; we keep a note of which messages you hid so that your other devices hide them too. A file may be up to 100 MB.
Polls, shared places and contacts: a poll's question and options, and who voted for what. In an anonymous poll nobody, its creator included, is shown who voted; everyone sees only the counts and their own vote. A contact you share is a TenChat user you choose from your friends, the people you chat with or a group's members: the message keeps only that account, and the chat shows its current name and photo. The app does not read your phone's address book for this.
Location: the app uses your location only when you choose “Location” in a chat and send it. Only then does it ask for permission and take your position once; it never shares it live, never tracks it, and never uses location in the background. The place you send (its coordinates and the name you give it, if any) is a message like any other: the people in the chat see it, and it is stored encrypted and deleted as messages are. On a computer you type the coordinates or paste a map link instead.
Link previews: when you write a link in a message, the app asks our server for a preview, and our server (not your phone, and not the people you send it to) fetches the linked page and reads its title, description, site name and image. The website sees our server's address, not yours. The image is stored as your upload and the preview is saved with your message. You can turn link previews off in Settings → Privacy and safety → Chats → Link previews.
Stickers and GIFs: stickers are built into the app. When you search for a GIF, your search words go from our server to GIPHY; your phone never contacts GIPHY, and GIPHY does not get your name, account or IP address. The GIF previews also come through our server. The GIF you send is copied to our server and stored as your video upload, so the people in the chat load it from us. We keep a list of the GIFs shown to you for 24 hours.
Scheduled and disappearing messages: a message you schedule is stored encrypted on our server until its time, then sent like any message; you can change or cancel it before that. In a chat with disappearing messages (1 hour, 1 day, 7 days or 30 days; in a channel only its admins set it), each new message is deleted for everyone when its time runs out, the same way as “Delete for everyone”, and its notification says only “New message”. People in the chat can still copy or capture a message before it disappears.
Channels and threads: in a channel only its admins post; members do not see each other. Its admins see the member list, how many members have seen each post, and who reacted; not who saw it. In a group, replies in a thread are messages of that group; we store which threads you follow and how far you read them.
Chat list: the chats you pin, archive or mark as unread are stored on our server so that all your devices show the same list. Drafts stay on the device where you wrote them.
Group chats: a group's name and photo, its members (up to 200), who added whom, who is its owner or an admin, who left or was removed, and whether you muted it. A friend, or someone you have chatted with, can add you to a group; you can leave it at any time. The members of a group see each other's names and profile photos. Someone added to a group sees its whole history, the messages sent before they joined too, with their photos, videos, voice messages and files; someone who left or was removed sees the messages up to the moment they left.
Posts and connections: your posts and their photos and videos, likes and comments; your friend list and friend requests. Each post is visible to your friends or only to you, as you choose. Profiles show counts of friends and of the posts the viewer may see; the number of posts you saved is shown only to you.
Saved posts: the posts you save. They are private: only you see them, and a saved post disappears from your list when you can no longer see it.
People you may know: if you have at least 3 friends, the app suggests people who share at least 2 friends with you, showing only how many friends you have in common. We work this out from the friendships we already store. If you dismiss a suggestion, we store that so it does not come back (at most 50 a day).
Online status and last seen: whether you are online now and, when you are not, when you were last online (“last seen”: the time the app last closed its connection on all your devices). We keep only your current online state, when it last changed and that last seen time. Your friends, and a person you have a one-to-one chat with once both of you have sent a text message in it, see when you are online and when you were last seen; nobody sees it across a block. You can turn it off in Settings → Privacy and safety → Show my online status: your status and last seen are then hidden, and you no longer see other people's.
Photos and videos: profile, group, post and chat photos and videos. The app shrinks them on your phone (videos to 720p) and removes metadata such as the location (EXIF/GPS) before sending. Files you attach in a chat are sent as they are, with whatever they contain: a photo or video sent as a file keeps its metadata, including the location where it was taken.
Voice and round video messages: the recording (a voice message up to 5 minutes, with its waveform; a round video message up to 60 seconds). The app uses the microphone, and the camera for a round video, only while you record one, film a video or are on a call.
Voice and video calls: one-to-one calls in a one-to-one chat (not between people who blocked each other). During a call the app uses the microphone, and the camera in a video call, and sends the sound and picture to the other person. They go through our own relay server (TURN), so the other person does not see your IP address, and WebRTC encrypts them (DTLS-SRTP). The app gets short-lived access to the relay (valid 10 minutes) for each call. We do not record calls and do not store their sound or picture. We keep a call history: who called whom, when, how long it lasted and how it ended (answered, declined, missed, cancelled, busy or failed), shown as a line in the chat. Incoming calls ring through a push notification. On Android the app may ask for permission to show a call over the lock screen (full-screen notification). Screen sharing: in a one-to-one call on Android or a computer you can share your screen or a window. It starts only when you choose it and your system asks for your permission (on Android every time, with a notification while you share); the other person sees it like the call's video, through the same relay, and you can stop at any time. We do not record or store it.
Phone and email lookup: people find you only by typing your exact email or phone number (the one you sign in with or added to your profile), or, as described next, by having that phone number in their phone's contacts.
Group calls (only in app versions that offer them; version 1.0 does not): voice and video calls in a group chat, with up to 6 people at once. Any member of the group can start one, and members can join it while it goes on. During a group call the app sends your sound, and your picture in a video call, to each other participant through our own relay server, encrypted by WebRTC (DTLS-SRTP); we do not record group calls and do not store their sound or picture. We keep a group call history: who started the call, who was rung, who joined and left it and when, how long it lasted, how many people took part and how it ended, shown as a line in the group chat. Members are rung through a push notification with the group's name and the name of whoever started the call. Members who muted the group are not rung, nor are members in a block with the person who started it, nor the members of a group of more than 30; they can still join from the chat. As in the group chat, people who blocked each other can be in the same group call.
Finding friends from your contacts (only in app versions that offer it; version 1.0 does not): only if you tap “Find friends from your contacts” and allow the app to access your contacts, the app reads the phone numbers and names in your phone's address book. Only the phone numbers are sent, over HTTPS, to our server, to check which of them belong to TenChat accounts; names, emails, photos and other details of your contacts are never sent. The server uses the numbers only to answer that one request: it does not store them, does not write them to any log and does not share them with anyone. The names stay on your phone and are used only to show whom each result is in your contacts. The results show the TenChat users who sign in with, or added to their profile, one of those numbers, except anyone who blocked you or whom you blocked. The app never reads or sends your contacts on its own or in the background, and an app version without this option never reads your contacts at all. You can skip this, and deny or later revoke the contacts permission in your phone's settings; the rest of TenChat works without it.
TenChat assistant (AI): a one-to-one chat with an AI assistant that you open yourself from “New chat”. Nothing is sent to the AI until you have read the notice and agreed. After that, to answer each message you write in that chat, our server sends the last messages of that one chat (up to 20, at most about 12,000 characters) and today's date to Anthropic, through its Claude API. Your name, email, phone number, other chats and contacts are never sent; photos, videos and files are not sent either (only a note that one was sent). Anthropic uses them only to produce the answer, on our behalf. Under Anthropic's Commercial Terms, data sent through its API is not used to train its models; Anthropic may keep it for a limited time for safety and abuse checks. The assistant's chat is stored on our server, encrypted like your other chats. We also store when you agreed and how many messages and how much text (tokens) the assistant processed for you each day, to apply the limits (30 messages a day and 200 a month for each person). You can withdraw your consent at any time in the assistant chat's menu (“Withdraw consent”): nothing more is sent to Anthropic, and messages it has not answered yet are not sent. The assistant is never in groups or calls. Its answers are made by AI and can be wrong; do not send it anything you would not want processed this way.
Chat backup: in Settings → Privacy and safety → Chats → “Back up chat history” the app can write your chats' messages to a file on your device, encrypted with a password you choose (AES-256-GCM, with a key made from the password by Argon2id). Photos, videos and files are not in it. The file is never uploaded to us: you choose where it is saved (if you choose a cloud drive, that drive keeps it). We cannot open it or recover its password. Restoring a backup adds its messages to the app on that device.
Safety: the people you block, and reports made by you or about you (the reason, the note, and the reported message, post, comment or group). Purpose: to protect users from objectionable content and abuse.
Notification tokens: your phone's push token and its platform (Android or iOS), to send you notifications.
Signed-in devices: for each device you are signed in on (your phone and any computers you link), its name, platform, a random identifier of the app installation and last-seen time, so you can see and sign out your devices in the app. We send your phone a notification when a new computer signs in. An account has one phone and up to 5 computers; a sixth computer signs out the one used longest ago, and a new phone signs out the old one and, if it is another phone, the computers. Signing in on a computer with your phone: the computer shows a QR code, and you scan it with the TenChat app on your phone (Settings → Devices → Link a computer), which uses the camera only for this. The phone shows which computer it is before you approve. The code is valid for 2 minutes and never written to any log; we keep only a hash of it, deleted after a day. A computer that was linked can refuse the link: it is then signed out and your phone is told. The session list keeps, for each session, when it started, was last used and ended, and why it ended.
IP address and technical logs: your IP address is used to limit the number of sign-in attempts, in the server's memory only (for about a minute). Our servers' access logs keep the IP address, the requested address, the time and the app or browser version. The app server's log keeps account and item ids, error codes and, when an app verification fails, the IP address. Message, post and comment texts, email addresses, the phone numbers from your contacts, passwords and tokens are never written to any log. Logs are limited in size and are overwritten by newer entries.
Crash reports (Crashlytics): when the app crashes or hits an error: the phone model, the system and app versions and technical details of the error. They never include your name, email or message text. Purpose: to find and fix bugs.
App verification (App Check): a token from Google Play Integrity or Apple App Attest that shows a sign-in request comes from the official TenChat app.
Data on your phone: your chat history, messages waiting to be sent with their attachments, and the chat files and voice messages you opened are stored on your phone; they are removed when you sign out or delete your account. Photos you have seen are cached on your phone for up to 30 days and removed when you delete your account. Your drafts, your language and theme settings and the link preview setting stay on the phone until you remove the app.
We never use your data for advertising and never sell it. TenChat has no ads and no usage analytics or tracking. The website uses no cookies.
3. Third parties
These providers process data on our behalf, only for the purposes above:
Google Firebase (Google LLC): sign-in (Firebase Authentication: email, password hash, Google sign-in), push notifications (Firebase Cloud Messaging), crash reports (Crashlytics) and App Check. A push notification carries the sender's name, in a group chat also the group's name, and the first 100 characters of the message or comment; for a message without text, what it carries (such as “Photo”, “Voice message” or a file's name). A call push, and the push for a missed call, carries the caller's name; a call push also says whether it is a voice or video call. A group call push carries the group's name and the name of whoever started the call. The calls themselves go through our own relay server, not through a third party.
Apple (Apple Inc.): Sign in with Apple, iPhone push notifications (APNs) and App Attest.
Anthropic (Anthropic PBC, USA): the TenChat assistant's answers (Claude API), only for people who agreed, with the messages of the assistant chat described in section 2, under its Commercial Terms.
GIPHY (Giphy, Inc.): GIF search. It gets only the search words and our server's requests, never your account, name or IP address.
For a link preview our server fetches the page from the website you linked, which sees our server's address, not yours.
Their servers are outside Mongolia, so this data is transferred abroad. We give your data to nobody else, except a public authority when the law requires it.
4. Where and how we store it
TenChat's server, database and media (photos, videos, voice messages and files) are stored on servers in Mongolia. All connections between the app and the server are encrypted with HTTPS. Message text, file names and group names are encrypted on the server. A copy of the database is made every day and kept on the same servers in Mongolia for 7 days. Only a few authorised staff can access the servers.
5. How long we keep it
Account data is kept until you delete your account.
When you delete your account, your name, bio, email address, phone number, sign-in account (Firebase), notification tokens, friendships and friend requests are deleted at once, and you are signed out on every device. The comments and likes you left on any post, your own included, are deleted for good at once. Your posts are hidden from everyone at once and their text is deleted; the comments and likes other people left on them stay stored but nobody sees them any more. Your saved posts and the suggestions you dismissed (and those that name you) are deleted at once, so are your scheduled messages, your consent to the TenChat assistant and its usage counts, and the assistant chat's messages are erased. Your live calls are ended. Your profile photo and your posts' photos and videos are deleted within 7 days. You leave every group you were in (its members see that you left; a group you owned passes to an admin or another member). Messages you sent, with their photos, videos, voice messages and files, stay in the chats of the people you talked to, groups included, shown as “Deleted user”; so do the group names and photos you set, your reactions and your poll votes. Your call history stays in the same way for the other person, with the call lines in the chat, and your group call history for the other members, with the line in the group chat. Reports and blocks are kept for the safety of other users; a report of a comment you wrote stays a report of your account, without the comment. An internal record of the account (its sign-in identifier, when it was created and whether it was banned, and its online state with the time it last changed) is kept so that a deleted or banned account cannot be used again, with the list of its ended sessions.
When you delete a post, it is hidden from everyone at once; its text stays stored in our database, and its photos and videos are deleted within 7 days. When you delete a comment, it is hidden from everyone at once; its text stays stored in our database.
Messages, with their photos, videos, voice messages and files, are kept until they are deleted for everyone or, in a chat with disappearing messages, until their time runs out (see section 2). An edited message keeps only its newest text.
A scheduled message is kept until it is sent or you cancel it; one that could not be sent is deleted after 7 days.
Your consent to the TenChat assistant is kept until you withdraw it or delete your account; its daily usage counts until you delete your account.
The list of GIFs shown to you is kept for 24 hours; a QR code's record for one day; link previews of pages are cached in our server's memory for up to 24 hours.
Photos and videos of deleted posts and messages, profile and group photos that were replaced or removed, and uploads that were never used are deleted within 7 days.
Notification tokens not renewed for 60 days are deleted.
Call history, group calls' included, is kept with the chat line that shows it, with no automatic expiry; it is not call content. When you delete your account it stays for the other person (see above). Online status is only a current online or offline marker with the last seen time; a deleted account is never shown as online.
Deleted data may remain in backups for up to 30 days, after which it is deleted automatically.
Google keeps Crashlytics crash reports for 90 days.
6. Your rights
See and correct your data: the app's “Me” tab and “Edit profile”.
Delete it: “Me” → “Delete account”, or without the app as described here.
Choose whom you deal with: block anyone, unfriend, leave a group, delete your posts and comments (they are hidden from everyone, see section 5), and delete a message for everyone within 24 hours of sending it.
Turn your online status off in Settings → Privacy and safety: it hides your last seen too, and other people's status and last seen from you.
Hide a message only for you (“Delete for me”), set disappearing messages in a chat, turn link previews off, and stop sharing your screen at any time.
Withdraw your consent to the TenChat assistant in its chat's menu; nothing more is then sent to Anthropic.
Deny or revoke the app's access to your location in your phone's settings (sending a place then needs typed coordinates or a map link).
See your signed-in devices and sign any of them out in Settings → Devices.
Remove a post from your saved posts at any time; all saved posts go when you delete your account. Dismiss a suggested person to hide them.
Turn notifications off in your phone's settings, and the microphone and camera off in its permissions (calls, recordings and scanning a computer's QR code then do not work).
Deny or revoke the app's access to your contacts in your phone's settings (finding friends from your contacts then does not work).
Block anyone to stop calls from them.
Ask about your data, get a copy of it, or complain: support@tenplus.mn. We answer within 30 days. You may also complain to the competent public authority.
7. Children
TenChat must not be used by children under 13. If we learn that an account belongs to a child under 13, we delete it. Please tell us at support@tenplus.mn if you know of one.
8. Law
We process your data under the Law of Mongolia on Personal Data Protection and other applicable laws, based on the consent you give when you sign up and use TenChat and on what is needed to provide the service.
9. Changes
We may update this policy. We announce important changes in advance in the app or on the website. The date of the last update is at the top of this page.
10. Contact
Ten Plus LLC, Room 903, LS Plaza, Javzandamba Street, 18th khoroo, Khan-Uul District, Ulaanbaatar, Mongolia. Email: support@tenplus.mn.