Risk Score
0 = very fair · 100 = very risky
Summary
This is Signal Messenger's combined Terms of Service and Privacy Policy, governing use of the Signal private messaging app. It is widely regarded as one of the most user-friendly and privacy-respecting documents of its type. Signal explicitly commits to never selling, renting, or monetizing user data, and its end-to-end encryption means even Signal itself cannot access message content. The document does include some standard one-sided clauses such as a liability cap of $100 and broad termination rights, but overall it is unusually fair compared to industry norms.
Flagged Clauses
“Signal does not sell, rent or monetize your personal data or content in any way – ever.”
Signal explicitly states it will never profit from your personal data. This is an unusually strong and clear commitment compared to most consumer apps.
“We work with third parties to provide some of our Services. For example, our Third-Party Providers send a verification code to your phone number when you register.”
Signal shares your phone number with third-party SMS/call verification providers only for the purpose of account registration. These providers are described as bound by their own privacy policies.
“Signal may share data to meet any applicable law, regulation, legal process or enforceable governmental request.”
Signal can share your data in response to legal demands such as court orders or government requests. However, because messages are end-to-end encrypted, Signal has stated it has very little data to share in practice.
“OUR AGGREGATE LIABILITY...WILL NOT EXCEED ONE HUNDRED DOLLARS ($100).”
No matter what harm Signal's service causes you, the maximum financial compensation you could receive is $100. This is a very low cap and is standard in many tech ToS but still significantly limits your recourse.
“THE SIGNAL PARTIES WILL NOT BE LIABLE TO YOU FOR ANY LOST PROFITS OR CONSEQUENTIAL, SPECIAL, PUNITIVE, INDIRECT, OR INCIDENTAL DAMAGES.”
Signal disclaims responsibility for a wide range of potential harms, including financial losses or significant damages even if they were aware such harm could occur.
“We may modify, suspend, or terminate your access to or use of our Services anytime for any reason, such as if you violate the letter or spirit of our Terms or create harm, risk, or possible legal exposure for Signal.”
Signal can terminate your account at any time, including for vague reasons like violating the 'spirit' of the terms or creating 'possible legal exposure.' However, since Signal holds very little user data and messages are stored locally, the practical impact of termination is limited.
“Signal may update the Terms from time to time. When we update our Terms, we will update the 'Last Modified' date...Your continued use of our Services confirms your acceptance of our updated Terms.”
Signal can change its terms by simply updating a date on the document. Continuing to use the app counts as acceptance. There is no requirement for direct notification (e.g., email) before changes take effect.
“You agree to resolve any Claim you have with us relating to or arising out of our Terms...exclusively in the United States District Court for the Northern District of California or a state court in San Mateo County, California.”
Disputes are resolved in California courts. Notably, this clause specifies court litigation — it does NOT include a mandatory arbitration clause or class action waiver, which is more user-friendly than most tech companies' terms.
“You own the information you submit through our Services.”
Signal explicitly acknowledges that you own your own content and data. This is a notably user-protective stance compared to most social or messaging platforms.
“Signal grants you a limited, revocable, non-exclusive, and non-transferable license to use our Services in accordance with these Terms.”
Your right to use Signal is a license that can be revoked. This is standard for software/apps and is not unusually restrictive.
“WE PROVIDE OUR SERVICES ON AN 'AS IS' BASIS WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES...SIGNAL DOES NOT WARRANT THAT...OUR SERVICES WILL BE OPERATIONAL, ERROR-FREE, SECURE, OR SAFE.”
Signal makes no guarantees that the service will work properly, be available, or be free from security issues. This is standard legal boilerplate but means Signal bears no responsibility if the service fails or is compromised.
Missing Protections
- No explicit data deletion/right-to-erasure process is described beyond general account management settings
- No specific notification mechanism for terms changes (e.g., email notice) — only a 'Last Modified' date update
- No defined timeframe for how long support ticket data is retained
- No explicit GDPR rights enumeration (right of access, portability, rectification) despite EU users likely being covered
- No mention of a data breach notification policy or timeline
- No details on how long metadata (authentication tokens, keys, push tokens) is retained on servers
- No explicit process for account recovery or appeals of termination decisions
Fair Terms
- Explicit, unconditional statement that Signal will never sell, rent, or monetize user data — ever
- End-to-end encryption means Signal itself cannot read message content or access calls
- User explicitly retains ownership of their own content and information
- No mandatory arbitration clause — disputes go to real courts
- No class action waiver present
- Contact information (hashed and cryptographically protected) is handled with privacy-preserving techniques
- Minimal data collection philosophy — Signal states it limits technical information to the minimum required
- Message history is stored on user devices, not Signal's servers
- Support data is kept only for the purpose of resolving the specific issue
- Signal is a nonprofit-aligned entity, reducing commercial incentive to exploit user data
Document information only — not legal advice.