How we protect your session
-
Session-gated chat
Chat access is session-gated. If the required session cookies are missing or invalid you are sent back to the homepage rather than into the room.
-
HttpOnly cookies
Session cookies are set as HttpOnly, so page scripts cannot read them, and they can be configured as Secure in deployment settings.
-
HTTPS and HSTS
Traffic between your device and our servers is encrypted, with HTTPS-oriented settings including HSTS and secure cookies in production.
What we never keep
- Chat messages. Conversations are real-time and ephemeral.
- Personal data. No email, phone number or real name is needed to chat.
- Permanent nicknames. Yours is cached for the session and dropped when you leave.
How to stay safe in the room
- Never share your address, workplace, documents or financial details.
- Pick a nickname that is not your real name or a handle you use elsewhere.
- Treat unsolicited links and payment requests as scams, every time.
- Use the Report button if someone is abusive. A moderator reviews reports.
Found a vulnerability, or someone acting badly?
Report it and we will look into it. For the legal detail, read the privacy policy and the terms and conditions.