comchatcomchat.eu
Privacy & data protection•Effective: November 11, 2026•Version 3.0

Privacy policy

Comchat is engineered around a simple standard: what cannot be collected, decrypted, or viewed by our servers cannot be leaked, compromised, or monetized.

01. Privacy Philosophy & Data Minimization

Comchat (“we”, “us”, or “our”) builds communication software for human beings who demand real privacy. Traditional communication platforms maintain centralized databases of plaintext message logs, social graphs, call recordings, and advertising profiles.

Comchat takes a fundamentally different architecture based on strict data minimization and client-side cryptographic sealing. We design our software so that we possess neither the mathematical ability nor the keys required to read your private messages or listen to your calls. This policy details the exact technical parameters of what data we process, how it is retained, and how your rights are protected under global privacy regulations.

02. What We Never Collect or Sell

To provide absolute transparency, Comchat does NOT collect, store, or process:

  • Plaintext message contents: All direct messages, group chats, Space room messages, and uploaded files are end-to-end encrypted on the client device before touching our network.
  • Private encryption keys: Cryptographic private identity keys and prekey bundles are generated locally on your personal device and are never transmitted to our servers.
  • Voice or video recordings: Real-time audio, video, and screen sharing streams pass through volatile memory and are NEVER recorded, transcribed, or stored.
  • Contact address books: We never request access to, upload, or index your mobile phone or desktop address book.
  • Phone numbers: Comchat does not require, collect, or store telephone numbers for registration or two-factor authentication.
  • Advertising cookies & trackers: We do not use third-party advertising cookies, Google Analytics, Meta Pixels, IDFA, or device fingerprinting trackers.
  • No sale of personal data: We never sell, rent, monetize, or share user personal data with data brokers, advertisers, or third-party marketing companies.

03. Information We Process & Retain

To provide a functioning real-time communication platform, we process only strictly necessary technical data:

A. Account Information

  • Username: Your chosen handle (e.g., @username) used by contacts to identify you.
  • Verified Email Address: Used for account identity, login, single-use magic links, password resets, and critical security alerts.
  • Public Cryptographic Keys: Your Curve25519 (X25519) identity key and prekeys, published so contacts can compute end-to-end encrypted session keys with you.
  • Authentication Data: Memory-hard Argon2id password hashes, registered FIDO2 / WebAuthn passkey public keys, and encrypted TOTP two-factor configuration.
  • Optional Profile Data: Display name, custom bio, and avatar selection.

B. In-Transit Encrypted Routing Packets

When you dispatch a message, our relay network receives an encrypted payload packet containing:

  • Ciphertext payload: The encrypted message bytes sealed using XChaCha20-Poly1305.
  • Routing envelope: The recipient username or routing tag, used solely to forward the packet to the recipient’s active connection.
  • Cryptographic parameters: A unique 24-byte random nonce and authentication tag necessary for recipient verification.

Retention: In-transit packets pass through volatile server RAM and are immediately discarded from memory once delivered to the recipient.

C. Temporary Queuing for Offline Recipients

If the recipient is disconnected when a message is dispatched, the sealed ciphertext packet is held in a temporary encrypted queue. This queue holds packets for a maximum duration of fourteen (14) days. Once delivered or upon expiration of the 14-day window, packets are permanently deleted.

04. End-to-End Cryptographic Architecture

Comchat employs modern, peer-reviewed cryptographic primitives:

  • Key Agreement: Extended Triple Diffie-Hellman (X3DH) over Curve25519 (X25519) combined with the Double Ratchet protocol for per-message forward secrecy and break-in recovery.
  • Symmetric Encryption: XChaCha20-Poly1305 authenticated encryption with 192-bit (24-byte) random nonces, offering high collision resistance across high-throughput messaging.
  • Group Discussions: Sender Keys ratchet protocol for end-to-end encrypted multi-party Space channels.
  • Transport Layer Security: All client-to-server connections require TLS 1.3 with modern, forward-secret cipher suites.

05. Encrypted File Storage & Media

Attachments, documents, and images uploaded to Comchat are encrypted on your local device before transmission:

  • Unique File Keys: Each file is encrypted with an independent 256-bit symmetric key. The file key and nonce are delivered to recipients inside the end-to-end encrypted message payload and are never transmitted to our storage server in plaintext.
  • Blind Storage: Our storage systems hold only opaque ciphertext blobs and blind SHA-256 integrity hashes.
  • Client-Side Perceptual Hash Safety: To prevent the transmission of Child Sexual Abuse Material (CSAM) without decrypting or inspecting your images, images are screened locally on your device prior to encryption using perceptual hash (PDQ) verification. Plaintext images are never uploaded or inspected by server personnel.

06. Real-Time Voice, Video & Screen Calls

Real-time voice and video calls operate through WebRTC with LiveKit SFU (Selective Forwarding Unit) and coturn STUN/TURN relays:

  • Volatile In-Memory Routing: Audio, video, and screen sharing streams pass through volatile server RAM only to replicate packets to active room participants.
  • Zero Recordings: Comchat never records, stores, logs, or transcribes voice or video calls.
  • Transport Encryption: Real-time streams are secured using Datagram Transport Layer Security (DTLS 1.3) and the Secure Real-time Transport Protocol (SRTP).

07. Zero-Knowledge Cloud Vault & Storage

Users who wish to sync conversation states across multiple devices or browsers can utilize Comchat’s client-side encrypted vault:

  • Master Passphrase Derivation: Your vault is encrypted and decrypted locally using a master key derived from a secret passphrase that only you hold.
  • Zero Server Access: Comchat stores only sealed ciphertext. We cannot unlock, inspect, or reconstruct your vault data. If you lose your master passphrase, your encrypted vault cannot be restored by Comchat.
  • Multi-Device Synchronization: Adding a new device using your master passphrase restores your existing identity key pair to that device rather than generating a new identity. Authorized devices decrypt incoming messages in parallel without overwriting or disconnecting your other active sessions.
  • Device Logout & Key Purging: Logging out of any individual device immediately scrubs all active private keys and conversation caches from that device’s volatile memory. Removing an account from a browser deletes its local keys from device storage, without affecting keys or sessions on your other logged-in devices.

08. Verified Email & Security Credentials

Your verified email address is used solely for essential security and account functions:

  • Essential Service Communications: One-time verification codes (OTP), single-use magic login links, password reset authorizations, and immediate alerts for new logins or password changes.
  • No Marketing Emails: We do not send promotional newsletters, marketing campaigns, or third-party advertisements to your email.
  • Authenticated Relay: Emails are transmitted using secure TLS-encrypted SMTP relays with SPF, DKIM, and DMARC enforcement.

09. Turnstile Bot Protection & Anti-Abuse

To protect against distributed denial-of-service (DDoS) attacks, automated username reservation bots, and credential-stuffing abuse, we employ Cloudflare Turnstile on public authentication forms. Turnstile verifies that visitors are human without presenting intrusive puzzle CAPTCHAs and does not track users across non-Comchat websites or harvest user advertising profiles.

10. Payment Processors & Billing

When you purchase subscriptions, space boosts, or digital items:

  • Stripe: Credit card and debit transactions are processed directly by Stripe (PCI-DSS Level 1 certified). Comchat servers never receive, store, or process your credit card numbers, CVVs, or bank account credentials.
  • Cryptocurrency: Cryptocurrency checkout is conducted non-custodially. Blockchain transactions are public on their respective distributed ledgers, but Comchat links only minimal payment status metadata required to fulfill your account tier.

11. Infrastructure & Service Providers

We do not integrate third-party marketing SDKs or tracking pixels. To operate our underlying network infrastructure, we engage trusted cloud, hosting, and network transit providers under strict Data Processing Agreements (DPAs). These providers process only encrypted transit packets and possess neither access to message content nor the mathematical capability to decrypt user traffic.

12. Government & Legal Requests

Comchat complies with valid legal process (such as court orders or search warrants) issued by courts of competent jurisdiction. However, our cryptographic architecture strictly bounds what data can ever be produced:

Inherent technical limitation: Comchat cannot provide plaintext messages, voice logs, media files, or private keys to law enforcement or intelligence agencies under any circumstance, because Comchat does NOT possess or store these items.

In the event of a valid court order, we can only provide the minimal metadata that exists on our systems: the registered username, verified account email, registration timestamp, last active timestamp, and the public cryptographic identity key. We notify affected users of legal inquiries regarding their account unless expressly prohibited by law or court gag order.

13. International Data Transfers

Comchat operates server infrastructure located in the European Union, the United States, and other international jurisdictions. For users residing in the European Economic Area (EEA), United Kingdom, or Switzerland, international data transfers comply with applicable data protection legislation (including standard contractual clauses approved by the European Commission pursuant to GDPR Article 46).

14. Your Rights (GDPR & CCPA/CPRA)

Regardless of where you reside, Comchat respects your fundamental rights to data privacy and digital self-determination:

European Economic Area & UK (GDPR):
  • Right of Access (Art. 15): Request verification of the minimal account data we hold.
  • Right to Rectification (Art. 16): Update your account details directly in user settings.
  • Right to Erasure (Art. 17): Delete your account, cryptographic keys, and profile data immediately.
  • Right to Restrict Processing (Art. 18) and Right to Object (Art. 21).
  • Right to Data Portability (Art. 20): Export your local cryptographic keys and device data.
California Residents (CCPA / CPRA):
  • Right to Know: What personal information is processed and how it is used.
  • Right to Delete: Request complete deletion of your registered account record.
  • Right to Opt-Out of Sale/Sharing: We do NOT sell or share personal information under CPRA standards.
  • Right to Non-Discrimination: Equal service regardless of exercising privacy rights.

15. Account Deletion & Right to Erasure

You have the absolute right to delete your account at any time directly through the User Settings menu in the application. When you initiate account deletion:

  • Your public cryptographic identity keys, prekey bundles, and profile elements are immediately invalidated.
  • Your active sessions, passkeys, and API tokens are revoked and disconnected across all endpoints.
  • You are placed in a standard 30-day deletion grace period (allowing you to reactivate if initiated inadvertently), after which all database records are permanently purged. You may also request an immediate permanent wipe by contacting our Data Protection desk.

16. Children’s Privacy

Comchat is strictly not directed to, marketed to, or intended for individuals under the age of 16. We do not knowingly collect or maintain personal information from individuals under 16 years of age.

If we discover or receive verifiable notice that an individual under the age of 16 has created an account, we will promptly delete the account, its public keys, and all associated registration data from our systems. Inquiries should be sent to [email protected].

17. Technical Security Measures

We maintain safeguards to protect our network and your account, including:

  • Volatile memory routing that clears in-transit message buffers once delivered.
  • Automated rate limiting and progressive lockouts to prevent password brute-forcing.
  • End-to-end cryptographic verification on all client connections.

18. Updates to this Policy

We may update this Privacy Policy at any time to reflect real-time improvements in our cryptographic protocols, architecture changes, new features, or regulatory requirements. Revisions become effective immediately upon being posted to this page, with the “Effective Date” updated accordingly.

Following material revisions, we will surface a notice within the app or on the website to inform users of the updates. Your continued use of Comchat after updates are published signifies your acknowledgment and acceptance of the revised policy.

19. Data Protection Contact

For data access requests, privacy inquiries, or complaints, contact our designated data protection desk:

Official Contact & Privacy Complaints: [email protected]

All privacy questions, data protection inquiries, security reports, and legal complaints must be submitted directly to [email protected].