Methodical Enterprises LLC
Last updated: October 12, 2026
The short version: Frost is an encrypted group messenger for iPhone. There is no phone number, no email and no account. Your keys are made on your iPhone and never leave it. Unlike our other apps, Frost uses a server of ours, called the postbox. It passes sealed messages between phones and deletes them after seven days. It is built so that we can't read them, and it stores no names, no phone numbers and no IP addresses. Notifications never show a message, screenshots of Frost come out blank, and nothing can be shared out of the app. Frost is a test build and has not been independently audited, so please don't trust it with real secrets yet.
This policy applies to Frost, an end-to-end encrypted group messenger for iPhone, published by Methodical Enterprises LLC ("we," "us"). "Frost" is a working name, and the name may change.
Frost is a test prototype. Its encryption uses MLS, an open standard for group messaging, with post-quantum keys. Each piece is tested on its own, but the whole app has not yet been tested from end to end on two phones, and no independent security audit has been done. An audit comes before real use. Until then, don't use Frost for anything you need to keep secret. This page describes how Frost is built to work. A flaw found later could mean it doesn't fully protect what this page says it protects.
The name you choose, your keys, your chats, your contacts' names and keys, your notification disguise and your settings are stored on your iPhone. Frost never asks for your phone number or email address, and it doesn't read your contacts.
Phones in a chat can't reach each other directly, so Frost passes messages through a server we run at relay.methodical-ep.com, called the postbox. Each chat has its own mailbox there. Your phone leaves sealed messages in the mailbox and collects new ones from it. While Frost is open and unlocked, it checks your mailboxes every couple of seconds. All traffic goes over HTTPS.
What the postbox receives:
What the postbox stores, and for how long:
What the postbox doesn't store: names, phone numbers, email addresses, keys, message text, the exact time of any message, IP addresses, or Apple push tokens. It has no accounts. Its logs hold only totals, such as how many messages arrived in the last ten minutes, never which mailbox or who. We don't back up the postbox.
What it can still see while running: like any server, the postbox can't avoid seeing some things in the moment it answers a request. Your IP address reaches the server so it can answer you; the web server in front of the postbox keeps no logs and doesn't pass your address on to the postbox, and nothing records it. Someone in control of the running server could also watch the timing of requests and which mailboxes are checked together. And so that your phone isn't woken for your own message, it shows the postbox its sealed push handle when it sends; the postbox can't open the handle, but it can tell which of the phones in that mailbox sent the message. None of this is written down, but you should know it is possible.
To tell you a message is waiting, Frost uses Apple's push notification service (APNs). Frost asks permission to show notifications when you set it up. Two separate parts of our server share the job, so that neither one alone can tell which chats are on which phone:
If you turn notifications off, Frost still works: you see new messages when you open it. Some test builds don't have notifications set up; they never send a push token at all.
For now, the postbox and the notifier run on the same server, both run by us. Someone in control of that running server could match up the timing of the two. The notifier on its own can see which phones are woken at the same moment, so it could guess that they share a chat, though not which one.
You connect with someone only in person. One phone shows a code, and the other scans it with Frost's own scanner. There are no invite links: an invite is never sent through another app, a text message or the clipboard. The code holds a new mailbox's id and a secret. The postbox sees only the mailbox id; the secret, which unlocks the invite, never reaches it. Your name and public keys go into that mailbox sealed with the secret, so the postbox can't read them. An unused invite is deleted from the postbox after seven days, like any other message.
Scanning uses the camera, so iOS asks permission the first time. The camera is used only to read the code. Nothing is recorded or saved. You can compare safety numbers afterwards to make sure nobody is in the middle.
The postbox and the notifier run on a single rented server that we manage, reached at relay.methodical-ep.com. The postbox has no access to the internet; only the notifier can reach out, and only to Apple's push service. Builds we install directly from our own development computer for testing may use a test relay on that computer instead.
Frost opens only after Face ID, Touch ID or your device passcode. This check is performed entirely by iOS. Frost is told only whether it succeeded — no biometric information is ever available to the app, to us, or to anyone else.
You can lock a chat with a passphrase you agree face to face. Messages in it are sealed a second time with a key made from the passphrase. Frost never saves the passphrase or its key, and they never leave your phone. If everyone loses the passphrase, the chat can never be read again, and we can't help recover it.
You can report a person from a chat's info. Reporting blocks them on your phone. Where reporting is set up, Frost then opens your Mail app with an email to us containing only the reason and what you type. Frost can't read anyone's messages, so it never attaches them. We receive only what you choose to send, and use it only to look into the report and answer you. In builds where reporting isn't set up yet, the person is blocked and nothing is sent.
Frost contains no analytics, no crash reporting, no advertising and no tracking of any kind. It uses no third-party services besides Apple's push service. Its encryption library (OpenMLS) is open source and runs on your phone. We do not build a profile of you and do not track you across apps or websites. There are no purchases, subscriptions or ads.
Frost doesn't ask anyone for their age, phone number, email or real name, and we don't knowingly collect personal information from children. Nothing on our server identifies who you are.
Your chats live on your iPhone, and you control them: delete a chat, use Wipe everything, or delete the app. On our server, sealed messages are deleted after seven days, and sealed push handles are deleted once Apple reports your phone no longer has Frost. Because the postbox holds nothing that says who you are, we can't look up or hand over your data, and there is no account to close. There is no way to recover chats, keys or messages if you lose your iPhone.
If we change this policy, we'll update the date at the top of this page and post the new version here.
Questions? Email dwheat@methodical-ep.com.