PrivateChat · Settings

Account

—

Creator access

Permission to create private rooms.

—

Security

Password

PrivateChat does not provide password recovery. If you lose your password, we cannot restore access to your account.

Security

Sessions

PrivateChat keeps only minimal session metadata. No IP address, location or hardware fingerprint is stored as part of the account session record.

Privacy architecture

What PrivateChat is

P

Temporary private messaging, built around the room.

PrivateChat is an invitation-only two-party messaging service designed to minimize the information required to create and use a private conversation.

01

End-to-end encrypted messages

Message text is encrypted in the participants' browsers before it is sent to the PrivateChat server. The server stores encrypted ciphertext, not the plaintext conversation.

02

One creator. One approved guest.

A private room is designed for two parties: its creator and the first guest browser profile that is claimed and approved for that room.

03

Guests do not need an account

A guest can join through the private invitation. An email address, phone number or separate guest account is not required to participate.

04

Rooms are temporary

Every room has an expiry time. The creator can also destroy it early. When the room is destroyed or expires, its server-side room data and encrypted messages are removed by PrivateChat.

Server side

What the PrivateChat server can know

For a creator account, the server stores the username, password hash and minimal authentication-session records. For rooms, it stores the identifiers and information needed to operate them, including ownership, status, expiry, cryptographic public or proof material, hashes of access capabilities, encrypted message ciphertext and the metadata needed to order and deliver those messages.

Device side

What stays local to your browser

Room private cryptographic keys, local room capabilities, local chat names and plaintext message previews are kept in the browser rather than uploaded as ordinary account data.

Account minimization

What we do not require

A creator account does not require an email address, phone number or physical location. PrivateChat does not use an IP address or location as the identity of an account.

Network

Internet connections are not invisible

Like any Internet service, the server and hosting infrastructure receive network connection information such as an IP address while a device connects. PrivateChat is designed to minimize production logging, but end-to-end encryption does not hide the existence of a network connection.

Destruction

What “destroy room” means

Destroying a room removes the room and its encrypted messages from the active PrivateChat database and instructs connected clients to remove their local room secrets. PrivateChat does not claim forensic erasure from storage hardware, infrastructure backups or copies that another participant may have independently created.

Security boundaries

End-to-end encryption protects message content from normal server-side storage. It cannot protect plaintext on a compromised participant device or browser.

PrivateChat currently uses room cryptographic keys for the lifetime of a room. It does not claim Signal Protocol-style forward secrecy or a continuously rotating message ratchet.

Room secrets are browser-profile local. Automatic transfer of an existing room to a new device is not currently provided.

Password recovery is intentionally not available. Losing the account password can permanently remove access to the creator account.

Support

Contact

Support contact is not configured yet.