Privacy & security

Freedom of expression is respected. However, the following are prohibited and will result in permanent ban:

• Violence: threats, coordination of attacks, incitement
• Harassment: doxing, personal attacks, discrimination, spam
• Illegal content: CSAM, terrorism, human trafficking, malware distribution

• Account: Username and hashed password
• Email address: Optional, stored only if provided during registration (used for password reset)
• Registration IP: Stored at account creation for abuse prevention
• Message archive (MAM): Enabled by default for all conversations, stored for 30 days (90 days for Supporters and custom domains), then automatically deleted. You can disable or delete via your XMPP client
• Metadata: Sender, recipient, timestamp
• Contact lists: Your roster
• Profile/vCard: Display name, avatar and other profile info stored if set
• File uploads: Automatically deleted after 30 days (90 days for Supporters and custom domains)
• Supporter status: If you pay for a Supporter plan, we store your username and the date it ends
• Payment records: Username (or domain), plan, amount, payment status, the payment provider's reference and the email address you give for the receipt and renewal reminder, kept for as long as tax law requires. We never receive your bank or card details
• Custom domain orders: Domain name, owner username and a contact email address

Payments are processed by Mollie on behalf of ICSystems. When you pay, you are sent to Mollie's own checkout page, where you enter your payment details with them, not with us.

We send Mollie the amount and a description that includes the username (or domain) you are paying for. Mollie handles your payment data under its own privacy policy. Paying is optional: the free account never needs any payment details.

• End-to-End Encryption: Supports OMEMO and OpenPGP
• Tor Hidden Service: Connect via .onion address for anonymity
• Last Activity Tracking: Disabled
• Minimal Logging: The chat server logs errors only, kept 3 days. The web server logs IP address and page visited, kept 7 days, to stop abuse
• Database Query Logging: Disabled
• IP Privacy: Registration IP is kept only for abuse mitigation; Tor, VPNs and proxies are welcome
• TLS Encryption: TLS 1.2 or newer on every connection that supports it. Connections over Tor are encrypted by Tor itself
• Fail2Ban: Automatic blocking of brute-force attacks
• Website statistics: We count page visits with GoatCounter. It uses no cookies and does not store your IP address
• Data Sharing: Never sold. Only shared where needed to run the service: other XMPP servers you chat with (federation), our email provider for emails we send you, our payment provider when you pay and when the law requires it