Your private messages sent through the Signal messaging app might not be as hidden as you think — even if you delete the app. Reporting by 404 Media this week found the FBI was able to extract messages from inside an iPhone’s notification system, long after the user had deleted the privacy-focused messaging app.
InJuly 2025, a group of people set off fireworks and vandalized propertyat the ICE Prairieland Detention Facility in Alvarado, Texas, anincident that resulted in one police officer being shot in the neckand nine people being arrested and charged with domestic terrorism. Itwas revealed during the trial, 404 Media reported, that the FBI was able to extract Signalprivate messages, which were used as evidence, from an iPhone’s notification database.
An FBI special agent testified that the Signal app had alreadybeen removed from the phone when the FBI looked it over. A witness tothe testimony told 404 Media that the messages were set to disappear,which is a feature of the app. The app successfully deleted the message, but the iPhone held onto it.
Thisis a big deal, because Signal Private Messenger is an encryptedmessaging service, and messages sent through the service shouldn’t bevisible if the app has been deleted from the phone. The FBI was able toextract the data because the messages were displayed through theiPhone’s notification system, which saved those messages to the phone’sinternal database.
Representatives for Signal, Apple and the FBI did not immediately respond to requests for comment.
The loophole presents a security concern foriPhone owners who assume that their messages are forever private if theyuse an encrypted messaging service, and according to John Davisson, deputy director of the Electronic Privacy Information Center, there’s noclear reason why those messages should still be there after the app wasdeleted.
«Someone who deletes a secure messaging app reasonablyexpects that their messages won’t hang around indefinitely or beretrievable if the device falls into untrusted hands,» Davisson toldCNET in an email. «Apple owes it to the public to fix this problem, anddevelopers should consider warning their users of the risk until thathappens.»
All nine of the defendants in that trial were found guilty inmid-March on charges ranging from aiding in domestic terrorism toattempted murder.
How to protect your privacy
Signalhas a setting that prevents this very problem from happening to others. You choose not to display any information in pushnotifications, so that if they’re stored in an iPhone, they can’t beextracted later by the authorities. If you want your messages to truly vanish, this is the step you should take.
To do this, open Signal and take the following steps. They should be the same on Android and iOS.
- Open the Settings menu and navigate to Notifications.
- Find where it says Show and change that setting to No name or message.
That’sthe whole process. Once that setting is set, you’ll still get pushnotifications, but the notification won’t show who sent the message orwhat the message says. You’ll have to open the app every time to replyto messages, but this ensures that messages aren’t saved on the iPhone’sinternal storage indefinitely, ready to be plucked out by an untrustedindividual.
«In our Surveillance Self-Defense guide, we advise users to check the settings of their secure messaging tools and change them according to their security needs,» said Thorin Klosowski, a security and privacy activist with the Electronic Frontier Foundation. «Signal has the option to control what (if anything) is shown in notifications, while for other apps, you may need to dive into the settings of notifications more generally.»