FAQ
Frequently asked questions about Umbrella X · Last updated April 7, 2026
Practical answers to the questions people ask most often. For the formal versions of any of this, see the Privacy Policy and the Terms of Service. If your question is not here, write to support@umbrellax.io and a person will reply.
General
What is Umbrella X?
Umbrella X is a private messenger. You install the app, register with your phone number, and chat with people. The content of your messages is end-to-end encrypted with the Signal Protocol, which means we cannot read them even if we wanted to. The Service is built and operated by UmbrellaX LLP, a small team registered in the Republic of Kazakhstan under BIN 260440006927.
Is Umbrella X free?
Yes. The app and the basic Service are free of charge. We do not show advertising and we do not sell user data. The bills are paid by the founders for now; if we ever introduce a paid feature, it will be optional and the basic messenger will stay free.
Where are your servers located?
The Service is operated from infrastructure located primarily within the Republic of Kazakhstan. A small amount of technical traffic — push notifications and error reports — goes through Apple Push Notification Service (APNs), Firebase Cloud Messaging (FCM), and equivalent providers in the European Union and the United States. None of that traffic contains the content of your messages. See section 7 of our Privacy Policy for the legal framing.
How is Umbrella X different from WhatsApp, Signal, or Telegram?
Same family, different priorities. Like Signal, we use the Signal Protocol for end-to-end encryption of all chats by default and we collect very little metadata. Unlike WhatsApp, we are not owned by an advertising company and we do not link your messenger usage to a parent platform. Unlike Telegram, end-to-end encryption is the default for every chat, not an opt-in for one-to-one "secret" mode. We are a smaller team and we make no claim to feature parity with any of these — we are focused on private messaging done well.
Your account
How do I sign up?
Install the app from the App Store or Google Play. Open it. Enter your phone number with the country code. We send you a six-digit SMS code; type it in. Choose a display name (it can be anything). Done. The whole process takes less than a minute.
What is the minimum age to use Umbrella X?
13 years old in most of the world. 16 years old in the European Union, the European Economic Area, and the United Kingdom (or the lower digital-consent age set by your country under Article 8 of the GDPR). If you are under the age of majority in your jurisdiction, you may only use the Service with the consent and involvement of a parent or guardian. We do not knowingly create accounts for anyone below the applicable minimum age, and we delete the account if we discover one was created.
How do I change my phone number?
From inside the app, open Settings → Account → Change Phone Number, enter the new number, and confirm the SMS code we send to it. Your contacts, chats, and groups move with you to the new number. The old number is then released from your account.
How do I delete my account?
Two ways. From inside the app: Settings → Account → Delete Account, then enter the SMS confirmation code we send to the phone number on the account. Done in under a minute. From the web (if you no longer have the app): send an email to delete@umbrellax.io from any address, with your phone number in the body. We send an SMS code to that phone, you reply with the code, and we delete the account once we have verified it. The full step-by-step instructions, an exact list of what we delete, and what we keep briefly afterwards, are on the Account Deletion page.
Can I recover a deleted account?
For 30 days after deletion we keep a minimal tombstone record so you can change your mind. To cancel a pending deletion, write to delete@umbrellax.io from the same phone or email and ask us to reverse it. After 30 days the tombstone is purged and the deletion becomes irreversible — there is no backup we can restore from.
Privacy and security
What does end-to-end encryption mean?
It means the content of your messages is scrambled on your device using a key that only you and the people you are talking to have. The scrambled version travels through our servers, and we relay it to the right recipient, but we cannot unscramble it. Even if someone broke into our servers tomorrow, or pointed a court order at us, the content of past messages would not be readable, because we never had the key. We use the Signal Protocol, which is the same protocol used by Signal, WhatsApp, and Google Messages RCS for the same purpose. Encryption is on by default, in every chat, with no opt-in.
What data does Umbrella X collect about me?
The smallest amount we can. Phone number for registration. Optional display name, profile picture, and bio that you choose. Message routing metadata (who is sending, who is receiving, when, how big — never the content). Push notification token to wake your device. Connection metadata (your IP and a session id) for security and fraud prevention. App version and operating system for compatibility and security updates. That is the complete list. We do not collect address books in cleartext, we do not collect precise location, we do not collect browsing history, we do not collect advertising identifiers, and we do not collect biometric data. The full description with retention periods is in section 2 of the Privacy Policy.
Can governments read my messages?
The content of your messages, no — it is end-to-end encrypted and we do not have the keys, so we cannot hand it over even if compelled. Metadata (who chatted with whom, when, how much), maybe — if a Kazakhstan court or another authority recognised under Kazakhstan law issues a legally valid request, we comply with the minimum we are required to disclose, never more, and we challenge requests that are overbroad or improper. We do not have a backdoor and we will not build one. If you want a more formal account of how we handle law enforcement requests, see section 6 of the Privacy Policy.
How do I report a security vulnerability?
Email security@umbrellax.io with a clear description of what you found, how to reproduce it, and any proof-of-concept code or screenshots. We respond as fast as we can and treat responsible disclosure as a contribution to the project, not an attack. If the issue is genuinely urgent (active exploitation) say so in the subject line.
Does Umbrella X have backups?
We keep encrypted backups of operational systems for up to 90 days for disaster recovery, then they are overwritten on the regular schedule. We do not back up the content of your messages because we cannot — we never had it in plaintext. The app may offer you, separately, a personal backup option that you control with your own passphrase; if that is enabled, the backup is encrypted on your device with that passphrase before it leaves the phone, and we cannot decrypt it.
Safety and moderation
How do I report abusive content or users?
From inside the app, long-press the message (or right-click on desktop), tap Report, choose a category (spam, harassment or abuse, illegal content, child sexual abuse material, impersonation or scam, other), add an optional comment if it helps, and tap Submit. The report goes to a human reviewer on our Trust & Safety team. If you cannot use the in-app flow (because you uninstalled the app, for example), email abuse@umbrellax.io with the offending account's phone number or username, the type of violation, and a short description.
How do I block someone?
Open the chat with the user, tap their name at the top to open their profile, and tap Block User. Or, from any message they sent you, long-press and choose Block. Blocking is instant, you do not need to wait for anyone to review anything, and the blocked user is not told that you blocked them. After they are blocked they cannot send you messages, see your online status or last-seen, or create new chats with you. To unblock, go to Settings → Privacy → Blocked Users.
What happens after I report?
Every report is reviewed by a human. You get an acknowledgement within 24 hours and a decision within 7 calendar days for routine cases. Reports involving child sexual abuse material are reviewed 24 hours a day, 7 days a week, with action typically taken within hours. Credible threats of imminent physical harm are also treated as urgent and reviewed around the clock. If we take action against an account, the affected user can appeal within 14 days as described below.
Can I appeal a ban?
Yes, in most cases. Write to appeals@umbrellax.io within 14 days of the action. Include the phone number on the account, the approximate date and time of the action, and a brief explanation of why you believe the decision was wrong. We aim to respond within 7 days. If we agree the action was wrong, we reverse it. If we do not agree, we tell you why. Appeals are not available for permanent bans related to child sexual abuse material or for accounts banned as a result of a lawful order from a competent authority.
How do you handle child safety reports?
Zero tolerance, no exceptions. Accounts found to be sharing or soliciting child sexual abuse material are permanently banned on first offence. We file a report with the National Center for Missing and Exploited Children (NCMEC) — the universal CSAM reporting channel that forwards to Interpol and to national authorities worldwide — and with the Kazakhstan authorities responsible for crimes against minors. We preserve the minimum data required by law to support that report and no more. Reports in this category are reviewed around the clock, every day of the year.
Website
Does umbrellax.io use cookies or trackers?
The website stores two small items in your browser's local storage and that is the entire list. theme remembers whether you last chose light or dark mode, so the page does not flash the wrong colour on reload. lang remembers your language preference on the landing page. Both are stored on your device only and never sent anywhere. We do not use Google Analytics, Facebook Pixel, session replay, third-party widgets, or any other tracking. Our fonts are self-hosted. Because everything we store is strictly necessary to remember your own choices, we do not need a consent banner under the GDPR and we do not have one. The full version of this answer is section 10 of the Privacy Policy.
Why is the site dark by default?
Design choice. Most people who visit the site visit it on a phone in the evening, and a dark interface is easier on the eyes in low light. If you prefer light mode, click the sun icon in the header — your choice is remembered for next time.
What languages does the site support?
78. The landing page auto-detects your preferred language from your browser settings and falls back to English if your language is not in the list. You can also pick a language manually from the dropdown next to the theme switch. The language selector affects only the landing page interface; the policy and FAQ pages stay in English so that the legal text has a single canonical source.
Still can't find an answer?
Write to support@umbrellax.io for general questions, privacy@umbrellax.io for privacy-specific ones, legal@umbrellax.io for legal or contract matters, and security@umbrellax.io for security disclosures. A real human reads the inbox.