MessagesBridge Privacy Policy

Last updated: July 15, 2026

MessagesBridge lets you use your Messages (iMessage & SMS) and Contacts from AI assistants such as ChatGPT. It is built so that your messages and contacts stay on your own Mac — the service relays requests, it does not host your message content.

Safety

• Read-first by default. The connector reads and searches your messages and contacts; it does not message anyone on its own.
• Every send is confirmed. You confirm each message inside ChatGPT before it is sent — nothing is sent silently.
• One recipient per send. A message goes to a single recipient per request — there are no bulk or blast sends.
• Nothing is exfiltrated. Message content never leaves your Mac except as a response to your own request, and is never stored on our servers.
• Demo accounts are fictional. Demo and reviewer accounts use fictional sample conversations, never real message data.

Data we collect and why

• Account data: your email address and a salted, hashed password (scrypt). Used solely to operate your account. We never store plaintext passwords.
• Device pairing tokens: a signed token identifying the Mac agent you paired. Used to route your requests to your own device.
• Message & contact content in transit: when your assistant requests an operation, the request and its result pass through our relay only while in flight to reach your Mac. This content is transient: it is held briefly in encrypted storage (Supabase Postgres, in our own project) with a time-to-live of 45–60 seconds and is not logged, indexed, or retained. We keep no durable copy of your messages, conversations, or contacts. (Demo/reviewer accounts use fictional sample conversations stored server-side instead.)
• OAuth tokens: standard access/refresh tokens so your assistant can act on your behalf. Refresh tokens rotate on every use.

What we do NOT do

• No selling or sharing of personal data with third parties for their own purposes.
• No advertising, tracking, surveillance, or behavioral profiling.
• No storage of your message content at rest, and no access to any other app on your Mac — Messages and Contacts only, not Notes, Reminders, Mail, or files.
• No collection of payment card data, health records, or government identifiers.

Data recipients (subprocessors)

Infrastructure only: Vercel (application hosting), Supabase (transient job queue & account records, Postgres), and Resend (sends the one-time email-address verification message — receives only your email address, never message or contact content). Your assistant provider (e.g., OpenAI) processes the content you exchange with it under its own privacy policy.

Retention

Message & contact content in transit: ≤ 90 seconds (automatic expiry). Account records and pairing tokens: until you delete your account. OAuth refresh tokens: 90 days or until revoked/rotated.

Your rights & deletion

Email us to access or delete your account data at any time. Unpairing your Mac (deleting ~/.apple-messages-agent.json and stopping the agent) immediately severs all access to your messages and contacts, regardless of any tokens outstanding.

Security

All traffic is TLS-encrypted. Authentication uses HMAC-signed tokens with PKCE-protected OAuth flows. Sending a message and adding a contact require explicit confirmation in your assistant before they execute.

Contact

Questions or requests: isaiahdupree33@gmail.com · Support