As part of the Data Rights series, this article examines two messengers marketed as secure and private: Signal and Dust. We review what their privacy policies actually permit in terms of data collection, retention, and sharing.
Signal
Signal states that information transmitted for placing calls or sending messages is kept only as long as necessary for that purpose and is not used otherwise. The data they store includes the phone number or identifier you register with, randomly generated authentication tokens and keys needed for call setup or message transmission, and IP addresses that may be kept in memory.
Signal does not share your information with outside companies, organizations, or individuals unless legally required. They will share information if they have a good faith belief that access, use, preservation, or disclosure is necessary — a standard carve-out that leaves room for interpretation.
Dust
Dust’s operator, Radical App, reserves the right to change its privacy policy at any time without notice, with changes becoming effective immediately upon posting. Continued use of the service signifies acceptance.
The data Dust collects at account creation includes username, password, email address, phone number, and age. With user authorization, they may also access contact lists. Beyond what the user provides directly, Dust collects usage information such as time, date, sender-recipient pairs, number of messages, language, browser info, pages viewed, IP address, and referring site. They and third-party service providers such as Google Analytics use log files and tracking technologies covering cookies, IP addresses, device type and identifiers, browser type and language, referring and exit pages, URLs, platform type, click counts, domain names, and landing pages. This information is associated with your user ID for internal use and may be combined with data from other sources.
Dust uses collected information to detect, investigate, or prevent fraudulent or illegal activity and for any other purpose for which the information was collected. They may disclose information when they have a good faith belief that legal process requires it, or when they believe there is an emergency. They may grant access to servers or turn over information — including personal information and content — to the extent required under a subpoena or official demand.
Notably, Dust temporarily collects, processes, and stores the contents of your messages on the devices of recipients. In the event of a business transition such as a merger, acquisition, or asset sale, they may transfer all of your information, including personal data, to the successor organization.
Observations
Signal’s policy is notably more restrained: minimal data retention, no advertising or analytics tracking, and sharing limited to legal requirements. Dust, despite its privacy-focused branding, collects a broad range of metadata, employs third-party analytics, reserves the right to modify its policy unilaterally, and permits transfer of all user data in a business transaction. The difference between marketing claims and policy text underscores the importance of reading the actual terms before trusting a messenger with sensitive communications.