Privacy and Security on CipherChat

Your privacy matters. Learn how CipherChat protects your data and what settings you control.

Privacy and Security on CipherChat

Your privacy is important. This guide explains the security features CipherChat offers and the settings you control to keep your account safe.

Profile Visibility

You can choose whether your profile is public or private:

• Public — Anyone can view your profile, posts, and bio
• Private — Only your followers can see your profile details

Change this in Edit Profile under "Profile Visibility."

Password Protection

You can set a password on your account to enable cross-device login. This means you can access your account from any device by logging in with your username and password.

To set a password:

1. Go to Edit Profile
2. Scroll to "Cross-Device Login"
3. Enter and confirm a password (minimum 4 characters)
4. Tap "Set Password"

Passwords set through the current system use salted scrypt hashes rather than plain text. Legacy password hashes are upgraded after successful password login. Use a strong, unique password.

New devices sync your messages

When you sign in on a new browser device, CipherChat loads your existing DM and private-group message history — just like WhatsApp's "Syncing messages" flow. Your account, contacts, group memberships, and prior conversations all appear on the new device, whether you use a password, Google, or Account Protection.

Returning devices keep their history

Messages created before or after a device's first sign-in are visible on later visits, subject to retention. Logging out and back in or changing login method does not reset your history. Previously registered devices keep their existing history. Clearing browser storage, using a different browser profile, or using private browsing can make you appear as a new device, but all messages still sync.

Account Protection and device approval

Account Protection may still require trusted-device approval or an existing account passcode for password sign-ins. Those controls authorize account access. Once approved, the device receives your full message history. Google sign-in can bypass device approval.

Message retention

The cleanup policy is 14 days for DMs, 21 days for private-group messages, and 7 days for Global Chat, measured from message creation. Pins do not extend the period. Cleanup runs hourly when the scheduled service is deployed; outages and backlogs can delay deletion. Other public groups have no automatic retention period currently. The production cron service must be deployed to activate scheduled cleanup.

Privacy and encryption limits

This is a server-enforced history-access rule, not end-to-end encryption or deletion of the conversation for everyone. CipherChat currently processes and stores readable messages. HTTPS protects transport on secure connections; database encryption at rest depends on deployment settings. Cleanup removes message records, not moderation reports, notifications, already-shared media URLs, recipient copies, or provider backups. Keep sensitive secrets off chat.

Device Identification

CipherChat assigns your device a unique ID stored in your browser. This is used to:

• Automatically restore your session on the same device
• Track your online/offline status
• Associate your account with your device

If you clear your browser data, this ID is reset and you'll need to log in again.

Notification Email

You can optionally add a notification email to receive alerts when:

• Someone sends you a direct message
• Someone follows you
• You receive a mention in chat

Your email is never shared with other users or shown on your profile.

Data We Store

CipherChat stores:

• Your username, display name, and bio
• Your profile picture (if uploaded)
• Your messages, posts, and comments
• Your followers and following list
• Your timezone preference (for accurate time display)
• Your streak count and activity data

We do NOT store:

• Your actual password (only a hash)
• Your precise location (only your selected country for timezone)
• Payment information (not yet available)

Keeping Your Account Safe

• Set a password to prevent unauthorized access
• Don't share your password with anyone
• Log out from shared devices when you're done
• Keep your profile private if you don't want strangers to see your details
• Report suspicious behavior to an admin

Reporting Issues

If you encounter a bug, have a suggestion, or want to report a user, use the Feedback tab to send a message to the CipherChat team.