Transparency Report - Nygma
Last Updated: October 13, 2026
This page explains how Genie9 LTD (“Genie9”, “we”, “us”) handles requests from governments, courts and law enforcement for information about people who use Nygma, and what we can and cannot provide. It is a statement of how we handle requests, not a statistics report.
1. How We Handle Requests
- • Genie9 is a company based in the United Kingdom. We respond to requests that are valid legal process under United Kingdom law.
- • Requests from authorities outside the United Kingdom should normally come through the UK authorities, for example under a mutual legal assistance treaty or another international agreement that applies to us. We decide case by case whether we must or may respond.
- • We review each request. We may refuse, challenge or ask to narrow a request that is not valid, is too broad or unclear, or asks for information we do not have.
- • When we do respond, we provide only the information the request lawfully requires.
2. What We Can Produce
We can produce only what we hold. For a Nygma account, that is at most:
- • account details: email address, name, how the person signs in, when the account was created and last signed in, and whether two-factor authentication is on;
- • plan, subscription and billing records;
- • drive names and drive settings (for example Time Bomb and Duress mode, including which drive is a decoy);
- • the sizes, counts and timestamps of files and folders, and how they are arranged in folders;
- • activity records and server logs, with IP addresses, device details and times (server logs are kept for up to 90 days);
- • share-link records: when a link was created, when it expires and how many times it was opened;
- • for Nygma Chat, at most short-lived delivery information (mailbox identifiers, arrival times and device push tokens) and a daily count of chats and invitations created. On its own this does not show who a person chats with; and
- • encrypted files and encrypted chat data exactly as we store them, which we cannot decrypt.
3. What We Cannot Produce
Files and chats are encrypted on the user’s device with keys we do not have. So we cannot produce:
- • the contents of files, the names of files and folders, thumbnails or file details in readable form;
- • drive passwords, PINs, recovery phrases, share-link passwords or encryption keys; or
- • chat messages or attachments, the names people show each other in chat, or a list of who a person chats with.
Some limits apply to files uploaded before Nygma 1.0 and to drives with a PIN. They are explained in section 7 of our Zero-Knowledge Statement.
4. Emergencies
If we believe in good faith that disclosing information without delay is necessary to prevent death or serious harm to a person, we may disclose the limited information we hold without waiting for legal process, where the law allows.
5. Telling Users About Requests
We may tell a user about a request for their information, unless the law or a court order prohibits it, or we believe telling them would put someone at risk of harm. We do not promise to tell users in every case.
6. Our Hosting Provider
Our servers are hosted by Amazon Web Services in the United States. Authorities may in some cases ask our hosting provider for data directly. Anything they could obtain that way is limited to the information in section 2, and file and chat contents would still be encrypted.
7. Abuse and Illegal Content
- • Because files and chats are encrypted, we cannot see or scan them. We act on reports.
- • To report abuse, illegal content or a child-safety concern, email abuse@genie9.com or use Report a problem in the app. We acknowledge abuse reports within 48 hours.
- • Under our Terms of Service, we may suspend or close accounts that break our rules.
8. Publishing Figures
A report with the number of requests we receive may be published on this page in the future. We do not commit to publishing one, or to any schedule.
9. Contact Information
Legal process and law enforcement requests:
Email: legal@genie9.com
Requests must be in writing and identify the account by its email address.
Abuse reports:
Email: abuse@genie9.com
Mailing Address:
Genie9 LTD
3 Shortlands
London W6 8DA
United Kingdom
This page was last updated on October 13, 2026. We may change it at any time.