How it works
Two claims are worth checking on any site that promises privacy: what it keeps, and what it can read. Here are both, without the marketing.
The door: a signature, not a password
When you open a room you write down one address. That address is stored with the room and there is no route anywhere in the app that edits it afterwards. To get in, the other side signs a short message with their wallet — an EIP-4361 sign-in, free and off-chain — and the server recovers the signing address from the signature itself. It then compares that recovered address to the one on the room, inside the database, in the same statement that hands over the seat.
So a forwarded link, a leaked group chat or a compromised inbox gets an attacker as far as a page that asks them to prove they hold a private key they do not hold. There is no invite code to guess, no password to phish, and no display name to imitate.
The call: directly between the two browsers
Once both sides are in, the browsers open a WebRTC connection to each other. Audio and video are SRTP, chat rides SCTP, and both are keyed by a DTLS handshake performed between the two endpoints. That encryption is part of the standard and cannot be switched off. We hold none of those keys, and neither does anything else in the path.
If your two networks cannot reach each other directly — two symmetric NATs, typically a mobile carrier or an office firewall — the packets are bounced through a TURN relay. The relay forwards sealed records; it has no key and cannot open them.
The room shows a safety number: six groups of four characters, derived from both browsers' DTLS certificate fingerprints. Read it aloud once. If the two screens match, nobody has inserted themselves between you — and you have verified that yourself rather than taking our word for it.
What is actually stored
Your wallet address
While you have a session, and after that as one row saying you have used the site
It is the account. There is no second field to go with it.
The room: two addresses, two random tokens, a lease timestamp
While at least one tab is open, then deleted
So the invited wallet — and nothing else — can be let in.
Handshake messages (SDP and ICE)
Seconds. Reading the inbox deletes it in the same statement
Two browsers cannot find each other without somewhere to leave a note.
Both tabs renew a ninety-second lease while they are open. Closing a tab stops the renewal; a scheduled job then deletes the room, and the handshake rows go with it. Nobody has to remember to press anything, and there is no button whose job is to delete a transcript, because there is no transcript.
What never reaches the server
- Anything you type in the room
- Any second of audio or video
- Anything on a shared screen
- A file, a recording, or a transcript
- An email address, a phone number or a name — there is no field for one
- An analytics or advertising identifier
The limits, stated plainly
A signature proves control of a private key. It does not prove that the person holding that key is honest, or that the key has not been stolen — verify the address the same way you would before sending funds to it.
Encryption protects the connection, not the endpoints. Either side can record their own screen, and no web application can prevent that. What is guaranteed is that nothing in between — this site included — is able to.
The connection reveals your IP address to your counterparty, as any direct connection does, and to the relay if one is used. If that matters for a particular deal, use a VPN.
Ready when you are. Open a room →