Your words.
Your keys.

Privacy depends on clear boundaries. Here are ours.

What is encrypted

Chat content is encrypted on the sending device with the same Olm-based protocol used by the mobile app. Each browser is a separate device with its own keys. The server receives encrypted envelopes, not the message text.

What the server still knows

End-to-end encryption does not hide all metadata. The service processes account emails, device public keys, conversation membership, delivery timing and receipts to route messages and manage accounts. Google processes sign-in information when you choose to sign in.

Your browser vault

Your browser creates a non-exportable encryption key and stores it locally alongside the encrypted chat vault in IndexedDB. No extra password is required. Google verifies account access; it does not know this key or recover your old messages. This convenience relies on protecting your browser profile and device. It does not provide password-based protection against a copied browser profile. Clearing browser data can lose local history. Old password-protected profiles can be converted once, or kept locally for a later history import.

Verify before trusting

Compare security codes directly with your contact using a separate trusted channel before marking devices verified. A directory response is not proof that a key belongs to your contact.

Browser limits

An unlocked browser can read your messages. Malicious extensions, compromised site code or a compromised device can access them. This implementation has not had an independent security audit. The web version supports encrypted text, images, audio, short videos and voice-note recording using the mobile media format. Each media file is limited to 1 MB; images can be resized locally before sending. One-to-one audio/video calls use encrypted backend media while direct P2P connects, then switch when media flows in both directions. No TURN service is used. Keep the web app open for incoming calls; alerts need browser permission and browsers may suspend background tabs. Closed-tab calling is not supported yet.

Receipts and local locking

The web app sends delivered receipts after saving a decrypted message and seen receipts for text in a selected visible conversation. Media is marked seen after you open the photo or start playback. The chat screen asks for Google sign-in again after 15 minutes without interaction or when you lock it manually. It does not receive push notifications when closed.