Privacy notice

Applies to the JawaChat web prototype hosted at jawachat.com (on Vercel).

Account data on your device

Your saved JawaChat account vault is stored in your browser. The private recovery key is encrypted with a key derived from your local vault password. The password is not stored by JawaChat. If you choose Keep me signed in, the unlocked key is also encrypted with a device key that can't be copied out of the browser or app, so you stay signed in until you sign out; signing out deletes it.

Public profile data

If you publish your profile, your display name, @username, JawaChat number, handle, selected country/region, optional status, optional profile picture (photo or emoji avatar), public key and a timestamp are published as a signed public relay event. Don't put private information in these fields.

Messages

Private messages, reactions, edits, unsend requests, receipts and typing indicators are encrypted before they are sent to relays. Relay operators may still see network metadata, event timing, IP addresses and the recipient key tag. You can choose which relays to use in Settings.

Messages that can't be delivered are held in an encrypted outbox in your browser and retried automatically; they are removed after successful delivery or after several days.

Message requests and blocking

Messages and calls from people you haven't accepted are held, encrypted, in Message requests on your device. They don't open a chat, ring, or get read or delivery receipts until you tap Accept. Deny deletes the request; Block also ignores everything that person sends from then on. You can turn requests off, and unblock people, in Settings.

Calls

Call signaling is sent as encrypted private messages. WebRTC tries to connect peers directly, so call peers and networks may learn IP/network metadata. You can configure your own TURN server and enable relay-only calls to hide your IP address from peers.

Encrypted local app data

Contacts, conversation history, groups, preferences (including optional TURN credentials) and the outbox are encrypted before being stored in browser storage. A compromised or malicious browser or device can read this data while your account is unlocked.

Photos and attachments

Photos are resized and re-encoded in your browser before sending, which removes embedded metadata such as EXIF and GPS location.

Local search and export

Search runs only against decrypted history in your browser; queries are never uploaded. Conversation exports are created locally and are not encrypted — store them carefully.

Website analytics

jawachat.com uses Vercel Web Analytics to count page views and visitors. It sets no cookies and does not identify you. It records the page path, the referring site, your country, and your browser, device type and operating system. Query strings are removed before sending, so usernames in invite links are never included. Analytics never sees your messages, contacts, keys or calls, and the Android and iOS apps don't use it.

Notifications

Desktop notifications are off by default. When enabled, message previews are hidden unless you turn them on, so message content does not appear in your operating system's notification centre.

Third-party infrastructure

By default the prototype uses public Nostr relays and public STUN servers. These are run by third parties with their own policies and availability.

Portable backups

A JawaChat backup contains your password-encrypted identity vault and already-encrypted private-store records. The vault password is not included. Anyone who obtains the file can attempt offline password guessing, so use a strong vault password and protect the file.

Deletion

You can delete your account at any time from Profile → Delete account — see how to delete your JawaChat account. Signing out does not delete the local encrypted vault. Deleting an account from the sign-in screen, or clearing site data, removes locally stored JawaChat data from that browser. Public events already accepted by relays may persist and cannot be guaranteed to be deleted everywhere. Disappearing messages are deleted from your device when their timer ends.

Contact

Questions about privacy or your data? Email jawachat@yahoo.com. JawaChat can't read your messages or recover your account, because they are stored encrypted on your device.

Security status

JawaChat has not completed an independent security audit and should not be used for emergency or high-risk communication. See the security model.