Acceptable Use Policy.

These rules apply to everyone with a Murmur account, whatever app they use to connect to our servers. They cover what you send and share, and also everything people can see of you, meaning your username, display name, profile photo and bio, and, for admins, a group’s name, picture, description, rules and invite links. They also cover automated members and the chats you import.

They come with our Terms of Service and our Child Safety Standards. A group can add its own rules, but they can’t replace ours.

• Harming children. Any form of child sexual abuse or exploitation, including images or videos of child sexual abuse (real, edited, drawn or made with AI), grooming, sextortion, sexualizing minors, or trafficking them. We have zero tolerance. See our Child Safety Standards.
• Threats and violence. Threatening to hurt or kill someone, calling for violence, or praising an attack to encourage more.
• Terrorism and violent extremism. Supporting, promoting, recruiting for, funding or planning terrorism or violent extremism, or sharing its propaganda.
• Harassment. Bullying, intimidating or stalking someone, or contacting them again and again after they’ve made clear they don’t want it, for example with new accounts after being blocked. Sharing someone’s private information, like their address or their documents, to expose or target them.
• Hate. Promoting hatred or violence against people because of who they are, such as their race, ethnicity, religion, sex, sexual orientation, gender identity or disability.
• Intimate images without consent. Sharing, or threatening to share, intimate images of someone without their consent, including fake or AI-made ones. Sextortion is never allowed.
• Encouraging self-harm. Pushing or helping someone to kill or seriously hurt themselves. Talking about your own struggles is not against the rules.
• Spam. Sending bulk or automated messages people didn’t ask for, sending message requests or invites in bulk, or posting group links to flood other groups.
• Scams and fraud. Phishing, fake investments, fake giveaways, or tricking people out of their money or their information. Asking someone for their Murmur password or Recovery Key is always a scam, because Murmur never asks for them.
• Impersonation. Pretending to be another person, an organization or Murmur, with a username, a name, a photo or messages that mislead people. There is only one official Murmur account, and it carries a badge no one else can get.
• Illegal goods and services. Selling or buying illegal drugs, weapons, stolen data, stolen accounts or counterfeit goods, or offering illegal services. Human trafficking and sexual exploitation.
• Other people’s rights. Sharing what you have no right to share, like someone else’s copyrighted work, or someone’s private messages or personal information to harm them.
• Malware and attacks. Sending malware or harmful files, trying to break into accounts or into our systems, overloading or disrupting Murmur, getting around our limits, a block or a ban, creating accounts in bulk, or collecting usernames or other data in bulk.
• Trading accounts. Buying, selling or renting usernames or accounts, or taking them to resell.
• Using Murmur under 16. Murmur is for people 16 and older.
• Anything illegal. Using Murmur to break the law where you are, or a law that applies to you.

Security research is welcome. Looking for security flaws in good faith is not an attack when you follow our disclosure policy and report to [email protected]. Don’t access other people’s data, and don’t disrupt the service.

Admins run their groups, and they have real moderation tools, including an owner and admins with the rights the owner gives them, permissions for what members can do, with exceptions that let one member do more or less, join requests with questions, limits for newcomers, remove, ban or restrict, deleting others’ messages, slow mode and flood limits, an under-attack mode, reports to admins, rules members accept before joining, and an admin log. None of them need our servers to read a word.

If you own or run a group:

• Set clear rules. Members accept them before joining. Your rules can be stricter than ours, never looser.
• Handle the reports members send you, and act on what breaks your rules or ours.
• Don’t use admin tools to harass people, or to collect information about members.
• Be careful with links. “Anyone with this link can join and read new messages.” Links can expire, and groups above 200 members ask for approval by default.
• A group that exists to break these rules isn’t allowed, whatever its own rules say.

Admins are members, so they read the group like everyone else. They also see the answers to join questions and the reports members send them.

Murmur has one kind of bot, a simple automated member that a group’s admin runs on their own computer.

• Only a group’s admins can add one.
• It has its own account, with a name that ends in “bot”, and a permanent label that tells members it reads the group.
• It runs on the admin’s own computer, not on our servers, and it follows the same limits as everyone.
• The admins who run it are responsible for what it does. Never use it to spam, to collect people’s data or to get around our limits.

On a computer, you can import your own Telegram chats, from the export Telegram Desktop makes. The archive is read-only, visible only to you, and labeled “Imported from Telegram · authorship not verified”.

• Import only chats you were part of and have the right to keep, for your personal use.
• Don’t use an imported archive to expose, harass or deceive anyone.

Murmur is end-to-end encrypted. We can’t read your messages, and we don’t scan them, on our servers or on your device. So reports come from you. When you report, you choose to share the messages with us.

In the app:

1. 1

   Report the message, the person or the group.

2. 2

   Choose what’s wrong, whether spam, scam, harassment, impersonation, child safety, intimate images shared without consent, threat, or something else.

3. 3

   Choose the messages to include, up to 10. For spam, the app sends who sent the message and which message it was.

4. 4

   In a group, choose who gets the report, whether the group’s admins, Murmur’s safety team, or both.

What a report contains. The messages you chose, with their original signatures and the sender’s certificate. That lets our team check who really sent them, without breaking the encryption of anything else. As the app says, “Our team will see the messages you choose. Signed messages can’t be denied.”

What our team sees. Only what you send, and the account data we already hold. Reports are encrypted to our safety team’s key. They never go into an AI tool, and we give them to no one else, except to the authorities when the law requires it.

How fast. We review reports about child safety and intimate images within 24 hours, and we aim to review all other reports within 72 hours.

Blocking. You can block anyone, with or without reporting them. Blocking happens on your device, and our servers keep no list of who you blocked.

Without an account. Anyone can tell us about a problem on Murmur, for example a group link posted somewhere else. Write to [email protected]. A useful notice says:

• what the problem is, and why you think it breaks these rules or the law;
• where it is, such as a username or a group link;
• your name and how to reach you (you don’t have to give them to report child sexual abuse);
• that what you tell us is true, as far as you know.

We confirm we received your notice, and we tell you what we decided and how to challenge it. Copyright notices go to [email protected].

Reports in bad faith. Reporting someone again and again to harass them, or making reports you know are false, is against these rules.

We act on accounts. We can’t see inside chats or groups, so we never act by reading them.

Depending on how serious the problem is, and whether it happened before, we can:

• warn the account;
• limit what it can do for a while, for example how many new chats it can start, how many usernames it can look up, how many groups it can join, how many files it can upload or how many invites it can send;
• suspend it;
• close it and remove its devices;
• remove a username that misleads people or impersonates someone. A banned username stays locked for 365 days.

For the most serious problems, like child sexual abuse, we close the account at once.

Automatic limits. Some limits apply automatically, based on details about the account, such as how old it is, how many new chats it starts, failed username lookups, how fast it joins groups and reports we upheld against it, and never on what anyone writes. New accounts can do less at first. If an account keeps hitting the limits, the steps get firmer, starting with some extra work for its device, then a 24-hour block, then a review by our team. We publish how this works, but not the exact thresholds, so they’re harder to game.

What we can’t do. We can’t read a chat or a group, see who is in a group, or delete a message already delivered to people’s devices. In a group, its admins can remove members, ban them and delete messages.

Telling the authorities. We report child sexual abuse to the bodies the law requires, such as NCMEC’s CyberTipline. If someone’s life is in immediate danger, we can share with the police the minimum we hold, where the law allows it.

When we limit, suspend or close your account, or remove your username, the app tells you:

• what we did, and for how long if it’s temporary;
• which rule it was about;
• the facts that led to it;
• whether the decision was made automatically;
• how to appeal.

We don’t tell you where the law forbids it, or where it would put someone at risk. We never alert someone reported for child sexual abuse.

• Within 7 days. You can appeal a decision from the notice in the app, within 7 days. Tell us why you think we got it wrong.
• A person reviews it. Someone on our team looks at your appeal and the reasons for the decision.
• Automatic decisions. You can also ask what information about you was used, the reasons and main factors behind the decision, and have wrong information corrected. At any time, even after 7 days, you can ask a person on our team to review an automatic decision by writing to [email protected].
• Without the app. If your account was closed and you can no longer use the app, write to [email protected] with your username.
• The result. We tell you what we decided. If we got it wrong, we undo it.
• Other ways. Appealing to us never takes away your right to go to court, or to a public authority where you live. For a complaint about your personal information, see our Privacy Policy.

Twice a year, our transparency report counts the legal requests we received and the data we handed over, by country and type, the child safety reports we made, and the accounts we acted on.

When we change these rules, we tell you the same way as for our terms.

Reports without an account, and appeals without the app

[email protected]

Copyright notices and legal requests

[email protected]

Security flaws

[email protected]

Your personal information

[email protected]

Anything else

[email protected]