Privacy

What this service does not do

• No advertising, ad networks or advertising identifiers.
• No third-party analytics or tracking pixels.
• No third-party requests: the only origin this client talks to is this instance. \ No CDN, no remote fonts, no remote scripts.
• No data sale or sharing with data brokers. No advertising profile is built.
• No email tracking: mail is rendered as text, so a sender's tracked image is never \ fetched.

What end-to-end encryption covers

Message bodies, attachments and notes are encrypted on your device (Olm for direct \ messages, MLS for channels). The server stores ciphertext and has no key to open it.

What this server can still see

An encrypted relay must still route. Unless this instance runs the most restrictive \ trust tier, the operator can observe:

• routing metadata — who is in which conversation, who sent a message and when, message sizes, read state;
• account data — username, email address, display name, avatar, published public keys;
• connection data — IP address and timestamps, as any web server records;
• standard access and error logs, for operations and abuse response — not for advertising or profiling.

The exact policy this instance runs is published at /app/tier (and at GET /api/tier without an account).

Retention

• Deleting a message removes it; disappearing messages are purged on a timer, with their notifications.
• Device links expire after ten minutes and carry only opaque wrapped bytes.
• Log and backup retention are operator settings — ask your operator for the values in force.

How to check

The client is AGPL-3.0. The no-analytics claim is checkable in the dependency tree, \ the single same-origin stylesheet is in main.rs, the mail path never renders a remote document, and scripts/e2ee-verify.mjs proves two real browsers decrypt what the server stores as ciphertext. The full \ statement, including what is deliberately not claimed, is in PRIVACY.md.