Terms of service

01. Agreement to Terms

Welcome to Comchat. These Terms of Service (“Terms”) constitute a legally binding agreement between you (“User”, “you”, or “your”) and Comchat (“we”, “us”, or “our”), governing your access to and use of our web client, messaging protocols, cryptographic relay infrastructure, voice systems, and associated services (collectively, the “Service”).

By creating an account, reserving a handle, generating cryptographic keys through our client, connecting to our relay network, or transmitting any packets through the Service, you acknowledge that you have read, understood, and agreed to be bound by these Terms and our Privacy policy. If you do not agree to these Terms in their entirety, you must not access or use the Service.

02. Eligibility & Age Requirements

You may only use the Service if you possess the legal capacity to form a binding contract in your jurisdiction. You must be at least 16 years of age. The Service is strictly intended and licensed for individuals who are 16 years of age or older. If local law in your jurisdiction requires that you must be older in order for Comchat to lawfully provide the Service to you without parental consent, you must meet that higher age requirement.

By using Comchat, you warrant that you are not prohibited from receiving software or digital services under applicable international sanctions, trade embargoes, or export control laws.

03. Accounts, Email & Credentials

To prevent automated abuse, handle reservation squatting, and support secure recovery, Comchat accounts require a valid, verified email address. Handle reservations and logins are tied to this email verification workflow.

• Verification via Authenticated Mail: Account registration, password changes, and sensitive security events require confirming a 6-digit one-time code (OTP) or single-use verification link delivered exclusively via Comchat’s authenticated mail relay.
• Authentication Mechanisms: Passwords are hashed using the memory-hard Argon2id key derivation function with random salts. Comchat also supports FIDO2 / WebAuthn passkeys, hardware security keys, and time-based one-time password (TOTP) two-factor authentication.
• Single-Identifier Login: Sign-in is conducted using your verified email address alongside your password, passkey, or single-use magic link. Username-only authentication is disabled across public endpoints for credential security.
• Account Lockout & Defense: Repeated failed authentication attempts trigger progressive automated IP and account lockouts to prevent credential-stuffing and brute-force attacks.

You are responsible for safeguarding your login credentials and personal hardware devices. Comchat will never ask for your password, master vault key, or two-factor seed.

04. End-to-End Cryptographic Architecture

Comchat is engineered around client-side end-to-end encryption. Messages and media are sealed cryptographically on your device before network transmission:

• Direct Messages (DMs): One-to-one communications utilize the Extended Triple Diffie-Hellman (X3DH) key agreement protocol over Curve25519 (X25519) combined with the Double Ratchet protocol. This delivers forward secrecy and post-compromise break-in recovery on a per-message basis.
• Symmetric Cipher: Payloads are encrypted using XChaCha20-Poly1305 with 192-bit (24-byte) random nonces, providing quantum-resistant bounds against nonce collision, paired with canonical length-prefixed Additional Authenticated Data (AAD) binding ciphertext to conversation context.
• Spaces & Group DMs: Multi-party discussions utilize the Sender Keys ratcheting protocol, generating separate cryptographically isolated distribution keys per member.
• Zero-Knowledge Vault & Multi-Device Sync: Users can optionally sync their cryptographic key bundles and encrypted settings across devices using a client-side encrypted vault. Unlocking on a new device with your master passphrase restores your existing identity keys to that device. Authorized devices decrypt messages in parallel without disconnecting or overwriting your other active devices.
• Device Logout & Key Purging: Logging out of any individual device immediately scrubs all private keys and conversation caches from that device’s volatile memory. Removing an account from a browser deletes its local keys from device storage, without affecting keys or sessions on your other logged-in devices.

Mathematical privacy limitation: Comchat servers possess zero mathematical or technical capability to decrypt end-to-end encrypted message payloads or zero-knowledge vaults. If you lose your master vault passphrase, Comchat cannot recover your historical encrypted message data.

05. Relay Network & Message Delivery

The Service operates an automated relay network to route encrypted packets between endpoints:

• Routing Metadata: Intermediate servers inspect only the minimal routing envelope (such as recipient handles, public key routing tags, and client message UUIDs) required to deliver packets to active WebSocket connections.
• Encrypted Transit: All connections between clients and relay nodes are enforced using Transport Layer Security (TLS 1.3) with modern cipher suites.
• Queuing & Retention: Undelivered messages for offline recipients are queued in encrypted form for a maximum of fourteen (14) days. Once delivered or upon expiration of this window, queued packets are purged from the relay.

06. Encrypted Attachments & Media

Files, images, videos, and documents sent through Comchat are encrypted on your device prior to upload:

• Per-File Symmetric Keys: Each file is sealed with an independent 256-bit symmetric key using XChaCha20-Poly1305. The decryption key is transmitted directly to recipients through the end-to-end encrypted message payload and is never shared with the storage backend.
• Blind Storage: Our storage systems hold only opaque ciphertext blobs and blind SHA-256 integrity hashes.
• Client-Side Safety Screening: To comply with mandatory Child Sexual Abuse Material (CSAM) laws while preserving message confidentiality, media files are evaluated locally on your client using perceptual hash matching (PDQ) prior to encryption. Comchat servers never receive or inspect plaintext images.

07. Voice, Video & Screen Sharing

Comchat provides real-time voice, video, and screen sharing powered by WebRTC, LiveKit SFU (Selective Forwarding Unit), and STUN/TURN relays:

• Media Transport Encryption: Media channels are encrypted in transit using Datagram Transport Layer Security (DTLS 1.3) and the Secure Real-time Transport Protocol (SRTP).
• No Call Recording or Tapping: Audio and video data stream directly through volatile memory to active call participants. Comchat does NOT record, transcribe, archive, or listen to voice or video calls under any circumstances.
• TURN Relay Bandwidth: Relay bandwidth is provided for legitimate personal and community communication. Misusing media relays for unauthorized proxying or traffic tunneling is strictly prohibited.

08. Acceptable Use Policy

To maintain the integrity, availability, and safety of the Comchat network, you agree to adhere strictly to this Acceptable Use Policy. You agree that you will NOT use the Service to:

• Transmit, store, promote, or facilitate Child Sexual Abuse Material (CSAM) or Child Sexual Exploitation and Abuse (CSAE). Comchat maintains zero tolerance for CSAM/CSAE and reports violations to the National Center for Missing & Exploited Children (NCMEC) and relevant law enforcement authorities.
• Transmit malware, viruses, trojans, ransomware, spyware, or malicious code designed to compromise software, hardware, or network endpoints.
• Execute denial-of-service (DDoS) attacks, automated packet flooding, socket exhaustion, or activities that place an unreasonable load on Comchat relay servers or databases.
• Transmit unsolicited mass automated messages (“spam”), commercial advertising schemes, or deceptive phishing communications.
• Impersonate any person, entity, corporate representative, or Comchat team member in a manner intended to deceive or defraud others.
• Coordinate or incite imminent physical violence, unlawful destruction of property, or targeted doxxing of individuals’ physical locations.
• Attempt to circumvent rate limits, cryptographic proofs, Cloudflare Turnstile verification challenges, or access control barriers.

Comchat reserves the right to rate-limit, suspend, or terminate access for any account, IP address, or endpoint violating these guidelines.

09. Spaces & Community Governance

Users can create, organize, and administer collaborative Community Spaces, text channels, and voice nooks (“Spaces”). Spaces are managed and governed independently by their creators and designated administrators.

Administrator Responsibilities: As a Space creator or administrator, you are solely responsible for setting rules, moderating room discussions, managing participant permissions, and maintaining safety within your Space. Comchat provides role hierarchy tools, kick/ban controls, and permission boundaries to assist administrators.

Intermediary Protection: Because conversations within private Spaces are cryptographically sealed, Comchat does not monitor or actively curate conversations within Spaces and disclaims all liability for statements, files, or actions made by participants in third-party Spaces.

10. Bots, Developer APIs & Webhooks

Comchat provides programmatic developer APIs, bot integrations, and signed outbound webhooks:

• API Tokens: API keys and bot tokens are confidential credentials. You are responsible for all activity conducted through your tokens.
• Rate Limits: Developer endpoints are subject to automated rate limits. Attempting to bypass limits through distributed key cycling or proxy pools will result in immediate API revocation.
• Webhook Signatures: Webhook events are cryptographically signed using HMAC-SHA256 headers. Recipients must verify signatures before trusting inbound payloads.

11. Subscriptions, Payments & Refunds

Certain premium features, storage upgrades, and profile customizations may be made available as paid tiers or subscriptions:

• Payment Processors: Traditional fiat payments are processed by Stripe (a PCI-DSS Level 1 certified payment gateway). Comchat never receives or stores your raw credit card numbers or banking details. Cryptocurrency payments are processed non-custodially.
• Billing Cycle: Subscriptions renew automatically on a recurring monthly or annual basis until cancelled through your account settings or Stripe Customer Portal.
• Cancellation & Refunds: You may cancel your subscription at any time; your benefits remain active through the end of your current paid billing period. Except where required by applicable local law, paid fees are non-refundable.

12. Content Rights & Relay License

Your Content Belongs to You: You retain complete ownership, copyright, and all other proprietary rights to any messages, files, or media you transmit through Comchat (“User Content”). Comchat claims no intellectual property ownership over your communications.

Limited Technical Relay License: In order to deliver your encrypted messages to recipients, you grant Comchat a strictly limited, non-exclusive, worldwide, royalty-free license solely to route, cache temporarily in volatile memory, and deliver your ciphertext packets across intermediate relay nodes to fulfill requested delivery actions. This license terminates automatically when transmission is completed or deleted.

13. Copyright & DMCA Policy

Comchat respects intellectual property rights and complies with the Digital Millennium Copyright Act (17 U.S.C. § 512). If you believe copyright-protected material is accessible within public or discoverable areas of the Service in an infringing manner, you may submit a formal notification to our Designated Copyright Agent:

DMCA Designated Agent:Comchat Legal Department
Email: [email protected]
Subject: DMCA Takedown Notice

Under 17 U.S.C. § 512(c)(3), notices must include: (a) physical or electronic signature; (b) identification of the copyrighted work; (c) location of the infringing material; (d) contact info; (e) a good-faith statement; and (f) a statement under penalty of perjury that the notice is accurate.

14. Disclaimer of Warranties

THE SERVICE IS PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS, WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. TO THE MAXIMUM EXTENT PERMITTED BY LAW, COMCHAT EXPRESSLY DISCLAIMS ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, AND NON-INFRINGEMENT.

COMCHAT DOES NOT WARRANT THAT: (A) THE SERVICE WILL OPERATE UNINTERRUPTED OR ERROR-FREE; (B) RELAY TRANSIT TIMES WILL MEET SPECIFIC LATENCY REQUIREMENTS; (C) DEFECTS WILL BE IMMEDIATELY CORRECTED; OR (D) THE SERVICE IS IMMUNE FROM DEVICE-LEVEL COMPROMISES, OPERATING SYSTEM KEYLOGGERS, OR PHYSICAL THEFT OF USER HARDWARE.

15. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL COMCHAT, ITS AFFILIATES, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, INCLUDING DAMAGES FOR LOSS OF PROFITS, DATA LOSS, DEVICE CORRUPTION, OR BUSINESS INTERRUPTION, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE SERVICE.

IN NO EVENT SHALL COMCHAT’S AGGREGATE MONETARY LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE EXCEED THE GREATER OF ONE HUNDRED UNITED STATES DOLLARS ($100.00 USD) OR THE TOTAL AMOUNT PAID BY YOU TO COMCHAT IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

16. Indemnification

You agree to defend, indemnify, and hold harmless Comchat, its officers, directors, employees, and agents from and against any claims, damages, obligations, losses, liabilities, costs, and expenses (including reasonable attorney’s fees) arising from: (a) your use of or access to the Service; (b) your violation of any provision of these Terms; (c) your violation of third-party rights, including intellectual property or privacy rights; or (d) any claim that your User Content caused damage to a third party.

17. Arbitration & Class Action Waiver

Informal Resolution: You and Comchat agree to attempt in good faith to resolve any dispute informally for at least thirty (30) days before initiating arbitration. Notice must be sent to [email protected].

Binding Individual Arbitration: If unresolved within 30 days, disputes shall be settled by binding arbitration administered by the American Arbitration Association (“AAA”) under its Commercial Arbitration Rules.

CLASS ACTION WAIVER: YOU AND COMCHAT AGREE THAT ANY PROCEEDINGS TO RESOLVE CLAIMS WILL BE CONDUCTED SOLELY ON AN INDIVIDUAL BASIS AND NOT AS A CLASS, CONSOLIDATED, OR REPRESENTATIVE ACTION.

Arbitration Opt-Out: You may opt out of binding arbitration within thirty (30) days of first accepting these Terms by emailing written notice to [email protected] with the subject “Arbitration Opt-Out” and your registered account email.

18. Governing Law

These Terms and any action related thereto shall be governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of law provisions or the United Nations Convention on Contracts for the International Sale of Goods (CISG).

19. Modifications to Terms

Comchat reserves the right to revise or update these Terms at any time as our features, security measures, and services evolve. Any modifications take effect immediately upon being published on this page, accompanied by an updated “Effective Date”.

When material updates occur, we will provide an advisory notice within the application or website following the update. Your continued access or use of Comchat after updated Terms are posted constitutes your acceptance of the changes. If you do not agree to the revised Terms, you should discontinue use of the Service.

20. Legal Contact & Notices

For official legal notices, inquiries, complaints, or safety reports, contact our designated legal desk:

Official Legal & Abuse Desk: [email protected]

All legal notices, DMCA notifications, safety reports, security disclosures, and complaints are handled exclusively through [email protected].