Security & Your Data

People come here to talk as themselves, so we treat what you share with care. This page says plainly what protects you, what you can control, and where the limits are. Nothing here is marketing: if something is not protected, we say so.

Protecting your account

How we make spam and fake accounts harder, without spying on you

• Sign-up needs a Red Pearl code, and the code is checked by our database at the moment the account is created, not only by the web page. Skipping the page does not skip the check.
• Cloudflare Turnstile runs at sign-up and sign-in to tell humans from scripts.
• The Human Check looks at a few signals while you write a post: whether text was pasted, an impossible typing speed, a hidden field only bots fill in, and posting in rapid bursts. We keep one number from 0 to 5 on your profile. We do not keep what you typed for this check, and you can see your number in Settings > Privacy.
• That number and your account status are changed only by the database, not by editing your profile. The Human Check is a light speed bump for scripts, not a lie detector: it is one layer next to Turnstile and the sign-up code, and it is not proof that someone is human.

Secure messages (end-to-end encryption)

How it works

• You choose a recovery passphrase. Your device creates a pair of keys. The public key is published so other members can lock messages for you. The private key stays on your device, and a copy locked with your passphrase is stored so you can restore it on a new phone. We cannot open that copy.
• Every message gets its own random key, and that key is locked separately for each person in the chat. The server only ever stores unreadable text.
• A chat is encrypted when everyone in it has turned this on. The chat then shows a green "End-to-end encrypted" bar. If someone has not, an amber bar says so, and the app asks before it sends a message without encryption (you can answer once, or "don't ask again for this chat"). If the app cannot work out whether your secure messages are on, it also asks instead of quietly sending plain text.
• Notifications for encrypted messages never contain the message: they only say you received one.
• Disappearing messages, blocking, clearing a chat and data download all keep working. Downloaded chats show encrypted messages as readable text when your device holds your key; your private key is never in the file.
• The name shown on a message comes from the sender's account, not from the message itself, and a message that cannot be matched to a key the app has seen for that person is hidden behind "Show anyway".

What it does not protect

• Photos and videos are not encrypted. Only text is.
• We can still see who is in a chat, when messages are sent, roughly how long they are, and the addresses of any photos. Account names, profile information and your friend list are not encrypted either.
• A server that wants to cause trouble could delete, repeat or reorder encrypted messages, and the app cannot tell. It cannot read or change their text without being noticed.
• There is no forward secrecy: if someone steals your private key and also holds copies of old encrypted messages, they could read them. Keep your device locked.
• Anything on your own screen: a screenshot, someone looking over your shoulder, or a phone that has been broken into.
• Our website's code is delivered to your browser by our server each time. Someone who took over our hosting could ship harmful code. This is a limit of every web app.
• We built this with your browser's standard Web Crypto tools (AES-256-GCM, ECDH P-256, HKDF and PBKDF2-SHA-256 with 600,000 rounds). It has not been independently audited.
• Who is in a chat is decided by our server. The app locks each message for the people our server lists as members. Our database only lets people be added to a chat while it is created, and the app remembers who was in each chat: if a new person shows up it tells you and waits for your OK before sending them anything. But someone who took over our database could still add themselves, and safety numbers do not cover this. Keep an eye on who is in your chats.
• Messages from before you turned it on, and chats where someone has not turned it on, are not encrypted, and a message sent before you turned it on cannot be opened later: it was never locked for you.

Check that nobody is in the middle

• Open Chat options > Safety number and compare the number with your contact in person or on a call (not in the chat). If it matches, nobody swapped keys. You can mark it verified.
• The app records a contact's key the first time it sees it (when you send to them or read a message from them). If that key later changes (a new phone, or someone interfering), the chat warns you and holds your message until you choose to continue. Messages they sent with their earlier key stay readable and are labelled "earlier key". A contact you have never exchanged a message with has no earlier key on record, so compare safety numbers before trusting anything important. These records live in your browser's own storage: if your browser clears it, the app starts fresh for that contact.

Phone lost or passphrase forgotten

• On a new phone, choose Restore in Settings > Privacy and enter your passphrase to read your old encrypted messages again.
• If you forget the passphrase and have no device that still holds your key, older encrypted messages cannot be recovered, by you or by us. Start over creates a new key; your contacts will see that your safety number changed. Choose a passphrase of at least 10 characters that is hard to guess, because someone who got the locked backup could try guesses offline.
• Changing your passphrase does not change your key. Anyone who copied the old locked backup and knows the old passphrase could still open it, so if you think the old passphrase was exposed, choose Start over (a new key) instead.
• You can turn secure messages off at any time. Your key and its backup are deleted from our servers (the app tells you if that fails and then changes nothing) and from the device you turned it off on. Other phones that still hold the key notice the next time they sign in and remove it.

Reports and moderation

• We cannot read encrypted messages. If you report one, the app says so first: the report contains the text you see (up to 270 characters), which you choose to hand to us, and nothing else from the chat. We cannot verify it, because we only hold the locked version, so it is labelled "supplied by the reporter, unverified" and moderators weigh it that way.

Your messages

• Messages travel over encrypted connections (HTTPS) and our hosting provider encrypts stored data. That protects them on the way and on disk, but it does not stop the service from reading chats that are not protected by secure messages.
• Without secure messages, chats are not end-to-end encrypted. That means the service itself can technically open them. We do not read private messages as a matter of course; they are looked at only when a member reports them. Turn on secure messages to lock chat text so even we cannot read it.
• Disappearing messages (optional): in a chat, open the options button and choose 24 hours or 7 days. From then on every new message gets its own expiry time, stamped by our server, so changing the timer never deletes older messages and nobody can backdate one. Expired messages disappear for everyone in the app straight away and are permanently deleted from our database by a regular cleanup shortly after. A banner at the top of the chat shows whenever a timer is on. Timed chats are text only, because photos are stored separately.
• Clear chat for me hides the history on your side only. The other people keep their copy.
• Photos sent in chats are stored at long, hard-to-guess web addresses. Anyone who has the exact address can open the photo without signing in, so do not pass those addresses around.
• Voice and video calls go directly between devices and are never recorded or stored by us.
• You can block anyone, and you can report posts, replies and messages. Reports are reviewed within 24 hours.

Your data, your control

• Download my data (Settings > Privacy): one file with your account details, profile, posts, replies, votes, friend connections, notifications and the chats you are in. Photos and videos are linked rather than embedded.
• Delete my account (Settings > Privacy or Settings > Profile): removes your login, profile, messages, friend links, votes and blocks right away, and removes your profile photo and the photos you sent in chats from storage. Your old public posts stay readable but are detached from you and show as "[deleted]"; photos or videos attached to those posts stay with them.
• Private profile: hides your post and reply history from other members.
• The full detail is in the Privacy Policy.

How the site itself is built

• Private data (messages, friendships, notifications, invitations, votes) sits behind row-level security rules and guests have no access to it, so the database, not the web page, decides who may read or change it even if someone tampers with the page in their browser.
• The database also refuses things the page should never ask for: editing someone else's post, changing who wrote a post, setting your own admin role or Human Check score, inventing vote counts, or rewriting a poll tally. Poll votes are recorded by the database, one per member. They are public: others can see which option you chose.
• Our own script libraries are hosted on this site at a fixed version rather than loaded from a third-party network. The only outside scripts are Cloudflare Turnstile, our human check, and OneSignal's notification script, which loads only on a device where you turn notifications on.
• Pages are served over HTTPS only, cannot be placed inside another site's frame, and tell browsers not to guess file types.
• Content from members is escaped before it is displayed.
• We use a small number of providers (Supabase, Vercel, Cloudflare, OneSignal) and list them in the Privacy Policy.

Report a security problem

• If you test in good faith, stay within these rules and report promptly, we will not take legal action against you.
• Please do not read, change or delete other people's data beyond what is needed to show the problem, do not run denial-of-service or spam attacks, and do not test with real members' accounts.
• We do not run a paid bounty program, but we will thank you publicly if you want.
• A machine-readable copy of this is at /.well-known/security.txt.