Privacy Policy

Last updated 10 November 2026

1. Who we are

assa is developed and operated by Boris Mutafov, Bulgaria (“we”, “us”, “our”), who is the data controller for the personal data described in this policy. You can reach us at bmutafov@gmail.com.

assa is distributed on Apple’s App Store and TestFlight under the developer account of Rosina Genova, who publishes it on our behalf. Through that account, the publisher can see only what Apple gives every developer, such as anonymous download, crash and usage statistics (see section 8). The publisher doesn’t receive any other data from assa.

This policy covers the assa iOS app, its notification relay and this website. It doesn’t cover Instagram. Meta handles your Instagram data under its own Privacy Policy (see section 4).

2. How assa works

assa is an independent, third-party app. It is not affiliated with Instagram or Meta. When you sign in, assa opens Instagram’s own login page inside the app. From then on your device talks directly to Instagram, the way a web browser does on instagram.com, and assa shows your messages in its own interface. assa has no accounts of its own, and your messages don’t pass through our servers. Our only server is an optional notification relay, described in section 5.

3. Data that stays on your device

  • Your Instagram session. You type your password into Instagram’s own login page, and it goes to Instagram only. We never receive it. The resulting session (Instagram’s cookies) is stored by iOS on your device.
  • A message cache. To open quickly, assa keeps recent conversations on your device, including messages, names, usernames and profile pictures. The cache is encrypted with a key kept in the iOS Keychain.
  • Notification keys. If you turn on notifications, assa creates encryption keys on your device. The private key never leaves the device, so only your device can read your notifications.
  • Settings, such as your theme and whether notifications are on.

We can’t access any of this. Signing out of assa and deleting the app removes it from your device.

4. Data exchanged with Instagram (Meta)

Everything you do in assa goes directly between your device and Instagram. That includes reading and sending messages, photos and voice messages, reactions, read receipts, typing indicators, activity status, and any Instagram settings you change in assa. Instagram receives the same kinds of information it gets when you use instagram.com in a browser, including your IP address and technical details about your device and browser engine. Meta may be able to tell that you are using Instagram through a web interface.

Meta is an independent controller of this data, and the Instagram Privacy Policy applies to it. We don’t receive copies of it.

5. Data our notification relay processes

This section only applies if you turn on notifications. Instagram encrypts each notification to a key only your device has. The notification travels through Mozilla’s push service to our relay, which forwards it to Apple Push Notification service (APNs). Apple delivers it to your device, and assa decrypts it there. The relay can’t read what is inside.

To deliver notifications, the relay stores:

  • a random subscription ID, and a hashed secret the app uses to manage the subscription;
  • your device’s APNs push token, the app’s bundle identifier and the push environment;
  • the Mozilla push-service identifiers and addresses for your subscription, and Instagram’s public key;
  • when the subscription was created, when a notification last passed through, and its status;
  • an App Attest key identifier. App Attest is Apple’s way of confirming that a request comes from a genuine copy of assa on a real Apple device. We use it to prevent abuse.
  • encrypted notifications that are too large to send through Apple directly. They are kept until your device fetches them, which deletes them, and for at most 7 hours.

The relay uses your IP address briefly, in memory, to limit how many subscriptions can be created from one address. It doesn’t store it in its database. The relay’s logs contain timings, sizes and random IDs, never notification contents, push tokens or secrets.

The relay doesn’t receive your Instagram username, account ID, password, contacts or messages in readable form.

6. Device permissions

assa asks for these permissions only when you use the feature that needs them:

  • Notifications, to show new messages.
  • Photos, to send photos you choose. assa only reads the photos you select.
  • Microphone, to record voice messages, and only while you are recording.

You can change these at any time in iOS Settings.

7. What we don’t do

  • We don’t show ads.
  • We don’t use analytics or tracking tools in the app or on this website.
  • We don’t track you across other companies’ apps or websites.
  • We don’t sell or rent personal data, or share it for advertising.
  • We don’t build profiles of you or make automated decisions about you.

8. Who else processes data

  • Apple delivers notifications (APNs), provides App Attest, and distributes assa through the App Store and TestFlight. If you choose to share analytics or crash reports with app developers in iOS, Apple may give us anonymous crash and usage statistics. See Apple’s Privacy Policy.
  • Mozilla runs the push service that carries encrypted notifications from Instagram to our relay. Mozilla sees the relay’s IP address, not yours, and can’t read the notifications. See Mozilla’s privacy notice.
  • Our hosting provider runs the server, in the European Union, that hosts the relay and this website.
  • Meta, as described in section 4.

We may also disclose data if the law requires it, or to protect the rights, safety or security of users, the public or the Service. If someone else takes over assa, this policy will continue to apply to the data they receive.

10. International transfers

Our relay and this website are hosted in the European Union. Apple and Mozilla may process data in the United States or other countries. When they do, they rely on safeguards recognised under the GDPR, such as the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

11. How long we keep data

  • Relay subscription: until you turn off notifications in assa or sign out, which deletes it. If you delete the app without signing out, the relay stops using the subscription once Apple reports the push token as invalid. You can ask us to delete what remains at any time.
  • Encrypted notifications held for your device: until fetched, and at most 7 hours.
  • Technical server logs: a short time, rotated automatically, unless we need them to look into a security incident.
  • Emails you send us: as long as needed to answer you and keep a record of the request.

12. Security

Notifications are end-to-end encrypted between Instagram and your device. The message cache is encrypted on your device. Connections to our relay use HTTPS. The relay stores only hashed secrets and runs on a server we keep up to date. No system is perfectly secure. Please protect your device with a passcode.

13. Your rights

Under the GDPR you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To use these rights for data we hold, email bmutafov@gmail.com. The relay doesn’t know who you are, so we may ask for details that help us find your record. Most assa data is on your own device, and signing out and deleting the app removes it. For your Instagram data, use Instagram’s own tools.

You can complain to a data protection authority. In Bulgaria this is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg. You can also complain to the authority where you live or work. We would appreciate the chance to help first.

If you live in California or another place with similar laws: we don’t sell personal information or share it for cross-context behavioural advertising, and we don’t treat you differently for exercising your rights.

14. Children

assa is not meant for children under 13, or under the minimum age to use Instagram where they live. We don’t knowingly process children’s data. If you believe a child is using assa, contact us.

15. This website

This website uses no cookies, analytics or third-party trackers. Its fonts are served from our own server. Like any web server, ours may keep short-lived technical logs, which can include your IP address, the page you asked for and your browser type. We use them only for security and to fix problems.

16. Changes to this policy

We will update this policy when assa or the law changes, and change the “Last updated” date above. For significant changes we will tell you in the app before they take effect.

17. Contact

Boris Mutafov, Bulgaria. Email: bmutafov@gmail.com.