Privacy, in plain words.

Off until you choose

Installing the extension does not enable presence. The welcome screen asks for explicit privacy consent, then lets you enable social mode and grant network permission for the relay. You can turn social mode off, withdraw consent, or block specific domains and paths. Private requests are a separate option, off by default, and a conversation requires the recipient’s acceptance.

Encryption and anonymous participants

Private and public chat use MLS end-to-end encryption (E2EE). Acceptance starts automatic private key agreement before writing. The relay forwards ciphertext and public setup objects. Anonymous first-contact keys remain unverified unless you compare the private security code through another trusted channel; an active relay can substitute them. Public admission stays open: new participants, including a relay-operated participant, can read new public messages. The relay sees IP, timing, sizes, routing and membership. Participants can copy content and compromised endpoints can read it. Restart creates fresh keys without history or cross-device recovery. Matching 0.3.0 client and relay are required; old versions fail closed. Participants connect through the relay, not direct P2P.

Page rooms use the website origin and pathname. The query and fragment are removed locally before hashing. The hash changes hourly, but known or guessable locations can still be matched. The same IP address can link activity across places. A pathname can itself contain sensitive data, so use your own blocks where needed.

Short-lived does not mean secret

There is no server-side chat history or replay for new arrivals. The extension temporarily keeps up to 50 group messages per space for up to five minutes in worker memory. It can also keep up to eight private conversations per origin and 50 messages per conversation. Transcripts are not written to persistent extension storage or exported. Reloading or disconnecting clears affected transient messages.

A participant can still copy or capture what they see. A chosen name is not a verified identity. Blocking applies to the current temporary membership, not permanently to a person. Share only what you are comfortable revealing to the participants and relay provider.

What stays in your browser

Settings such as your name preference, blocklists, language, and appearance remain in the browser profile. Multiple tabs in the same profile can participate; counts represent participating profiles, not the website’s full visitor count. Uninstalling removes extension settings. For a manual update, retain the original folder and reload the extension to keep its identity and saved settings.

This download website

This website has no analytics, advertising trackers, accounts, or forms. It does not send your installed version to an application service: the optional #installed= version fragment is read locally and is not included in an HTTP request. Language and appearance choices are stored locally in your browser. The only application fetch is the latest release metadata from this website.

Your browser still contacts the hosting provider to load pages, assets, metadata, and downloads. The hosting provider can see normal request information, including IP address and timing, and may keep operational logs. No claim of anonymous hosting is made.