Privacy & security
The short version: we store as little as possible, encrypt everything in transit, and never sell or share your data.
Server rules
Freedom of expression is respected. However, the following are prohibited and will result in permanent ban:
- Violence: threats, coordination of attacks, incitement
- Harassment: doxing, personal attacks, discrimination, spam
- Illegal content: CSAM, terrorism, human trafficking, malware distribution
What's stored
- Account: Username and hashed password
- Email address: Optional, stored only if provided during registration (used for password reset)
- Registration IP: Stored at account creation for abuse prevention
- Message archive (MAM): Enabled by default for all conversations, stored for 30 days then automatically deleted. You can disable or delete via your XMPP client
- Metadata: Sender, recipient, timestamp
- Contact lists: Your roster
- Profile/vCard: Display name, avatar, and other profile info stored if set
- File uploads: Automatically deleted after 30 days
Privacy measures and security
- End-to-End Encryption: Supports OMEMO and OpenPGP
- Tor Hidden Service: Connect via .onion address for anonymity
- Last Activity Tracking: Disabled
- Minimal Logging: Errors only, 3-day retention
- Database Query Logging: Disabled
- IP Privacy: Registration IP is kept only for abuse mitigation; Tor, VPN, and proxies are welcomed
- TLS Encryption: Required for all connections
- Fail2Ban: Automatic blocking of brute-force attacks
- Data Sharing: Never shared with third parties (except standard federation and legal requirements)