Mast Privacy Policy

Last updated 2 October 2026

This policy covers the Mast app for iPhone and for Android, made by Tissue Systems ("we"). Mast has no analytics and no advertising, so this document is short. You can use the app without an account. If you sign in to a Tissue Mast account, the account itself is covered by the platform privacy policy; this one describes what the app stores and why.

1. What Mast stores

• A device record. When the app first opens, it registers with our servers and we store a random device identifier, the push token Apple or Google issues for delivering notifications to your phone, the device name and model the phone reports, its operating system version, language and time zone, the app version, whether it was installed from the App Store, Google Play, TestFlight or a developer build, and which of the phone's notification settings are on, so a page can be sent the way the phone will actually show it.
• Your channels. The name, kind, priority, and schedule of each channel you create, and the key that forms its send address.
• Your messages. The content posted to your channel addresses, with its priority and timestamps, and any acknowledgements. Messages are kept for your plan's history window and then deleted: 7 days on Try it out and Free, 30 days on Solo, 90 on Team and 365 on Company. Copies of the app bought before it became free keep at least 30 days.
• Escalation links. If you pair with another Mast user for escalation, we store the link between the two device records, because routing an unanswered page to them needs it.

2. Accounts

Try it out needs no account: the device record is the whole identity, and there is no email address, password or profile. The Free, Solo, Team and Company plans need a Tissue Mast account. You sign in on tissue.systems with an email link, a passkey, Google or GitHub, and the account holds your email address and name as the platform privacy policy describes.

When a phone joins an account, we store which account and which member it belongs to. The other phones on that account can see its name and model, and they get a notification when it joins, so anyone on the account can spot a phone that shouldn't be there and remove it. On Team and Company, the on-call screen shows members' names so you can see who holds the pager.

3. Proof that a registration is real

When a new install registers, the app asks Apple (App Attest, on iPhone) or Google (Play Integrity, on Android) for a proof that the request comes from our app on a genuine phone. On Android, Google decodes that proof for us. We check it once and don't keep it. It says nothing about who you are or what you've bought.

4. What Mast never collects

No analytics or crash-tracking SDKs, no advertising identifiers, no location, no contacts, no cross-app tracking of any kind. We do not sell any of the data above, and we do not use your message content to train machine-learning models.

5. Where messages travel

A message posted to your channel address travels to our servers over HTTPS and is delivered to your phone through the Apple Push Notification service on an iPhone or Firebase Cloud Messaging on an Android phone, which is how any notification arrives on those phones. Apple or Google processes the notification payload to deliver it; each describes its handling in its own privacy documentation. The Android app includes Google's messaging and Play Integrity libraries and nothing else from Firebase; its analytics collection is switched off. Message content is otherwise stored only on infrastructure we operate. The platform security page says where and how.

6. The channel address is a key

Anyone who has a channel's send address can post to that channel. That's the design (it's what lets a shell script page you with one line), so treat the address like a password. You can rotate a channel's key in the app at any time; the old address stops working after a short grace period.

7. Purchases

The app is free on the App Store and on Google Play, with nothing to buy inside it. Copies bought before the app became free carry an Apple receipt that marks them as purchased; we never see payment details. Paid plans are billed on tissue.systems and covered by the platform privacy policy.

8. Deleting your data

Deleting a channel in the app removes it and stops its address. Messages delete themselves at the end of the history window. Removing a phone from the account, or unlinking a device, removes its record from our servers, and deleting the app from your phone invalidates its push token, after which nothing further can be delivered or stored.

To delete a Tissue Mast account, open Settings, then Tissue Mast, then Delete my account in the app, which takes you to Account settings. Deletion happens seven days after you ask, and any owner can cancel it in that time. After that we delete the account with every channel, message, vital and device record in it.

For anything beyond that, including removing every trace of a device straight away, email privacy@tissue.systems from any address, naming the channel or device, and we will delete it.

9. Changes and contact

Material changes to this policy move the date at the top. Questions about privacy reach privacy@tissue.systems; anything else about Mast reaches support@tissue.systems.