Does Signal Collect Metadata?

Signal collects far less metadata than most messengers, but it does not collect zero. Its architecture is deliberately built to minimise metadata, and Signal's own legal disclosures show it holds only a couple of coarse timestamps about an account. The catch is structural: your Signal account is a phone number, and a phone number is itself a durable piece of identifying metadata that lives on the server whether or not any message is logged.

So the honest answer to "does Signal collect metadata" is: very little, by design, and less than nearly all mainstream alternatives, but not none, and the phone-number requirement sits at the centre of what remains.

What "metadata" actually means

When people ask about metadata, they usually mean everything around a message rather than its contents. Content is the "what you said." Metadata is the "who, whom, when, from where, and how often." It typically includes:

• Who is talking to whom (sender and recipient identifiers)
• When messages are sent and how frequently
• Your IP address and rough network location
• Your contact graph (who is in your address book)
• Account identifiers like a phone number or email

End-to-end encryption protects content. It does not automatically protect metadata. A service can scramble every message so it can never read a word, and still know exactly who messaged whom, when, and how often. That gap is why metadata matters: patterns of contact can reveal a source, a relationship, or a movement even when the words are sealed. For a fuller treatment, see our deep dive on messaging metadata.

What Signal does to minimise metadata

Signal is E2EE by default, open-source, and has invested heavily in shrinking the metadata it can see. A few of its notable measures:

Sealed sender. For many messages, Signal's servers do not learn who sent a message, only that a message is bound for a given recipient. The sender's identity is encrypted so the relay can route without reading the "from" field. We break this mechanism down in how sealed sender works.

Private contact discovery. Signal uses secure enclaves to let you find which of your contacts are on Signal without handing the server a readable copy of your address book.

No message-content storage and no relationship logs. Signal states it does not keep records of your contacts, group memberships, or who you message.

Usernames. Signal added usernames so you can connect with people without revealing your phone number to them. This hides your number from other users. Importantly, it does not remove the number from Signal's own registration system.

Post-quantum key agreement. Signal adopted PQXDH, a hybrid post-quantum layer for its key exchange, hardening the encryption itself against future attacks. (That protects content and keys, not metadata, but it is worth noting in the same breath.)

The result is one of the most metadata-lean designs in mainstream messaging. When Signal has been served legal demands, the information it has been able to produce has been strikingly thin.

So what does Signal still have?

Two things are worth being clear-eyed about.

1. The account is a phone number. To register for Signal you must provide a working phone number and verify it. That number is your account's root identifier on Signal's servers. Usernames can mask it from other users, but the number still exists in the system, and a phone number is linked to a SIM, a carrier, and frequently a real identity. This is the single largest piece of standing metadata in the Signal model.

2. Minimal account timestamps. Signal has publicly documented, through its responses to legal requests, that the main data it can produce for an account is the date and time the account was created and the date it last connected to the service. That is a small amount of metadata by any standard, but it is not nothing.

There is also the unavoidable network reality: Signal's servers see the IP address you connect from in order to deliver traffic, even though Signal says it does not retain those connection logs. If you want to hide your IP from the service itself, you have to add something on top, such as a VPN or Tor.

None of this makes Signal "bad" on privacy. It remains an excellent, audited, content-private messenger. It simply means the phone number and the connection layer are where residual metadata concentrates.

A different starting point: no account at all

The cleanest way to not leak account metadata is to not have an account. That is the design premise behind Graphite.

Graphite asks for no phone number and no email. There is no account record on the server to subpoena, because there is no account. Your identity is a 12-word recovery phrase generated on your device; the server never sees it. Where Signal minimises the metadata attached to a phone-number account, Graphite removes the account itself from the equation.

Two other differences follow from that:

• The network layer is closed by default. Graphite routes over Tor by default and fails closed, connecting to a bundled hidden service. That hides your IP and network from the relay, rather than leaving IP-hiding as an optional extra you configure yourself. (Real-time call media uses peer-to-peer DTLS-SRTP rather than Tor, and on mobile calls are routed so the other person does not see your IP.)
• The relay is built to forget. Graphite's no-logs relay stores only sealed ciphertext, with a 7-day maximum time-to-live, and messages are deleted after delivery once receipt is acknowledged. It never sees plaintext, your keys, or your recovery phrase.

Side-by-side on metadata

Metadata question	Signal	Graphite
Account identifier	Phone number (required)	12-word recovery phrase; no server-side account
Hides sender from server	Yes (sealed sender)	Relay only ever sees sealed ciphertext
Stored account timestamps	Account created + last connected	No account record to attach timestamps to
Your IP at the network layer	Server sees connection IP; not retained (policy)	Tor by default, fail-closed; IP hidden from relay
Message retention on server	Not stored	Sealed ciphertext only, 7-day TTL, deleted after delivery

This is a contrast of models, not a scorecard. Signal's approach earns trust through open source, audits, and a policy of not retaining what it doesn't need. Graphite's approach tries to structurally remove the identifiers and logs in the first place, so there is less that could be retained even in principle. If you want the broader landscape, our guide to choosing an encrypted messenger walks through the trade-offs.

The honest takeaway

Does Signal collect metadata? It collects very little, works hard to see even less, and is far more metadata-respecting than WhatsApp or Telegram's default cloud chats. But it does require a phone number, it holds a couple of account timestamps, and its servers see your connecting IP. Those are the residual pieces to understand before you decide it's "metadata-free" — it isn't quite, and no honest messenger should claim to be.

If the phone-number requirement is your sticking point, a no-account design is worth trying.

---

Try Graphite. It's a free, public-beta, end-to-end-encrypted messenger with no phone number, no email, and no logs — Tor on by default, and a relay that only ever holds sealed ciphertext. Runs on Windows, Android (including GrapheneOS and de-Googled phones), and the web. Get it at graphite.chat.