Your data.

What it can access.

Decrumb connects as a linked Signal device through the unofficial signal-cli client. That client can receive and decrypt your messages. Decrumb uses eligible incoming text to clean links.

Cleaned links go only to Note to Self. Sender names are included by default when a display name is available; phone numbers and account IDs are not used as substitutes. You can turn sender names off.

Decrumb processes disappearing messages under the same cleaning rules as ordinary messages. It skips view-once content, spoilers, edits, story replies, and unsupported privacy information. Ordinary outgoing or synced messages are ignored. If you enable phone commands, only your own fresh, authenticated self-to-self command transcripts are accepted, including when Note to Self has a disappearing-message timer. Their replies use the same local queue and cleanup controls; commands do not fetch URLs, access arbitrary files, run shell commands, or send data to an AI provider. It does not request read receipts. Normal Signal delivery receipts still occur.

Ordinary attachments, avatars, stories, and stickers are skipped. The Signal client can temporarily download long-text attachments to reconstruct a message. Text within the app’s size limit can then be processed. A crash can leave temporary files behind.

What stays on your machine.

Mac data lives in ~/Library/Application Support/Decrumb. Windows data lives in %LOCALAPPDATA%\Decrumb, separate from the extracted program. Windows setup restricts the state folder to your user and SYSTEM; new files inherit those permissions. Java temporary files also stay inside that private folder. Pi data lives in ~/.local/state/decrumb, or your configured XDG state directory. Umbrel stores private state under data/state in its app directory, separate from the container image.

• Links waiting to send: a plaintext SQLite queue holds cleaned links and command replies, their Decrumb codes, and optional sender names. It does not hold the original message body.
• Send and cleanup records: hashes, note codes, timestamps, deadlines, and status let Decrumb manage its own notes. These records contain no links, message bodies, display names, or raw account IDs.
• Signal data: the client keeps keys, credentials, contacts, groups, profiles, and account state. Its incoming-message cache is encrypted. Processed entries are normally removed; crashes or trust errors can leave messages cached.
• Settings and diagnostics: settings and error history stay local. Decrumb records only known error codes, with no successful-send timeline. It keeps at most 128 entries from the current UTC day and the previous six days. Cleanup runs while Decrumb is active; files may remain longer while it is stopped. Upgrading removes the old rotating logs. There is no automatic telemetry or crash upload. QR images are temporary and removed when pairing ends or is cancelled.

Folder permissions restrict access; they do not encrypt the queue or all Signal data. Someone with access to your machine, snapshots, or backups may be able to read retained copies.

How long data stays.

Queued link content is cleared after an attempted send, local cancellation, or expiry. Cancelling before a send is dispatched keeps that unattempted note.

Unsent content becomes eligible for cleanup after 24 hours. Delivery and note records become eligible after 30 days. Aggregate loss counters stay longer.

Cleanup runs while Decrumb is working or during relevant app actions. Data can remain longer while the machine or cleaner is off. SQLite secure deletion does not erase older snapshots or backups.

On Mac, Quit Decrumb stops cleaning and keeps queued links, saved settings, and receipts. Hiding the app or closing its window leaves cleaning running. Pausing keeps valid queued links unless you enabled Discard queued links on pause. Clear queued links removes only notes that haven’t been attempted.

Removing notes and disconnecting.

Sent notes can remain on your Signal devices. Cleanup is manual by default. Optional lifetimes and schedules request removal only for notes this installation recorded sending to the same linked account.

Decrumb requests removal within the supported 24-hour window. Deletion is best effort: acceptance of a request does not prove erasure on every device. Deleted-message markers, quotes, saved copies, and backups can remain.

Clearing local data, deleting the original message, or uninstalling Decrumb does not retract sent notes. Generated notes follow Note to Self’s disappearing-message timer and your configured Decrumb note-cleanup policy. Decrumb does not copy the source chat’s timer or change either chat’s timer. A cleaned note can remain after its original message disappears.

To revoke access, unlink Decrumb’s device in Signal on your phone and pause Decrumb on its host machine. This does not erase local files or delivered notes. More about note cleanup →

The Umbrel dashboard.

Umbrel’s login and a separate app password protect the browser dashboard. It can show a temporary Signal pairing QR and change your settings. It does not show messages, contacts, account identifiers, keys, or raw logs. You can preview a content-free diagnostic report and copy it yourself. Previews stay in memory and are not saved.

An expiring login token is kept in your browser’s session storage for this app. Locking the dashboard removes it; restarting the app invalidates all dashboard sessions. No analytics or third-party scripts are loaded. Use your trusted local network or a protected remote connection.

What update checks send.

Mac app updates use Sparkle. Automatic checks and installation are off by default. You can check manually or enable automatic updates. Turning off automatic checks also turns off automatic installation.

Checks contact mkships.app; downloads contact GitHub. These hosts receive ordinary connection information, including your IP address and app version. No Signal identity, contacts, messages, note IDs, cleaning rules, or system profile are sent with update checks.

Updates replace the app and keep its separate account data, settings, queued work, and receipts. Cleaning stops briefly during installation and starts when the app reopens, including if you had paused it. Choosing Quit Decrumb before installation starts lets a ready update finish without reopening the app. Cleaning stays stopped until the next app launch, including an enabled login launch. Pause lasts until you reopen Decrumb or choose Resume cleaning.

Pi updates are manual: download the new archive and rerun its installer. The installer contacts the dependency provider listed in the Pi guide for the pinned Signal client; that provider receives ordinary download connection information. No Signal account data is included in that request.

Umbrel updates come through its app update controls and preserve local account state and settings. Installation pulls the container from GitHub’s registry, then downloads a checksum-pinned native helper from GitHub (Intel/AMD) or the ARM provider listed in the setup guide. These services receive ordinary download connection information, not Signal account data. Native libraries use a separate temporary directory on disk.

Windows setup and updates.

Pairing displays a private QR in your terminal. Do not record or share that screen. The temporary QR image is removed after linking or cancellation. The optional login setting creates a startup entry for your current Windows user; it is off by default.

Windows updates are manual and preserve the separate local state. Building the preview downloads dependencies from the upstream providers listed in the Windows guide; they receive ordinary download connection information, not Signal account data. The finished bundle includes its runtime and does not add automatic update checks.

Diagnostic reports you control.

You can preview a report before copying it for support. It contains app and dependency versions, operating-system version (kernel version on Linux), processor type, local worker health, and recent error codes with their originating app version. It omits messages, links, contacts, account identifiers, custom rules, paths, machine names, activity counts, exact timestamps, raw exceptions, and crash dumps.

No report is sent automatically. Copying puts the previewed text on your clipboard; you decide whether and where to share it. Clear diagnostics removes local error history, not reports already copied or shared, system backups, or the separate delivery/loss counters.

Website and support.

GitHub Pages hosts this website. We use no analytics or advertising scripts. GitHub may process information such as your IP address under its privacy statement.

GitHub also hosts downloads, source code, and support issues. Issues and attachments are public: use made-up examples and leave out messages, contacts, sensitive links, QR codes, credentials, and app data.

Ask general privacy questions in GitHub issues without sharing sensitive information. Report security vulnerabilities privately. We’ll update this page if the app’s behavior changes.