Security
Last updated October 2026
Passwords
Your password is stored as a one-way hash. We never store or display it in plain text, and we can't look it up. If you forget it, you'll need to reset it.
Sessions
Your sign-in session is kept server-side, not in a format that can be read or forged from the browser.
Private file access
Files and voice notes are never given a public URL. Every download is checked against whether you're actually a participant in that conversation, each time it's requested.
Accountability
Sensitive actions, such as blocking an account or editing a message's timestamp, are written to an audit log with who made the change and when, so nothing changes silently.
Reporting a concern
If you believe your account has been compromised, or you've found a security issue, get in touch.