Nobody can read your private messages here — not us, not anyone holding this server. What we cannot hide is that two people exchanged one, and anything you type in a public channel is public by definition.
This page is about RebellionChat, the terminal. Social is a different product with different rules — it carries pictures, which this one does not, and it publishes its own page.
Nothing obliged us to write this page. We would rather you decided with it in front of you, so the drawbacks come first and the reasons come with them. None of it is meant to alarm you — every one of these is a consequence of not keeping your life on somebody else's computer.
The message itself is locked in your browser and we do not have the key — that part is absolute. But while it waits for the other person to pick it up, this server is holding a note that says who it is from and who it is for. It is deleted the moment they collect it, and after seven days regardless. Our other product, Social, does not work this way, and bringing messages across to match it is work we have not done yet.
`dm_messages` stores the sender's and recipient's public keys and the sender's current handle as ordinary columns, alongside ciphertext we cannot decrypt. Anyone who seized this machine, its disk or a backup taken during those seven days would learn that two keys exchanged a message and when — never a word of what it said. RebellionSocial solves this with addresses derived from a secret only the two people share, so its storage has no identity column at all; the same change for direct messages is on the list and is not done.
Anything typed into a public channel is readable by everyone in it and by this server, because a room anyone can walk into cannot have a key only some people hold. Private rooms and direct messages are the encrypted ones. If it matters, say it there.
Public channel messages are relayed in the clear and never written to disk — they exist only in the connected sessions and in your own browser's scrollback. Private rooms encrypt to a key wrapped for each member, and direct messages to a key derived between the two of you; in both cases this server only ever holds ciphertext.
Messages travel like letters through a post office. Nobody along the way can open them, but somebody watching that post office for a long time notices which boxes fill up and when. Hiding even that would mean holding your messages back for hours before delivering them, and we would rather deliver them.
This site reaches you through Cloudflare, which unlocks the connection at its own edge before passing it to our machine — so Cloudflare, and whoever controls this server, can see the pattern of requests, never the contents of an encrypted message. The alternative is exposing this server's home address directly to the internet, which is worse for everybody involved. Cloudflare's own records are outside our control.
Conversations exist while you are there and are gone when you close the tab. Messages sent to a channel while you were away were never stored anywhere, so nobody can send them to you later — not us, not your friends' devices. That is the same decision that makes there be nothing to seize, seen from the other side.
Public and private channel messages are relayed to whoever is present and never written to disk. Direct messages are stored as ciphertext only until the recipient's browser acknowledges them, then deleted. Your own scrollback lives in your browser and goes when its storage does.
There is no email address to send a reset to and no account for us to look up, because we never asked for either. The twelve words are the identity itself. Write them down somewhere real — you can see them again from the menu at any time.
Your key is derived from a 128-bit random number, shown to you as twelve words in the standard BIP39 wordlist. The server only ever sees the resulting public key, and verifies you by asking your browser to sign a challenge. There is nothing on this machine that could regenerate a lost key, which is the same property that makes an account here impossible to seize or subpoena.
Names are held for seven days at a time and renewed by turning up. Stay away longer and yours is free again. Nobody can take a name you are still using, and nobody is ever told who held one before.
A handle maps to your public key with a rolling 7-day expiry. The check only ever answers free or taken — never who holds it — because "is @maya here" is a question about a person that a stranger should not be able to ask a server.
There are no moderators here reading messages and removing people, so a mute changes what you see and nothing else — the person carries on elsewhere. In a private room the members can vote somebody out together. In a public channel, everyone decides for themselves, and you can hand your mute list to a friend.
Mutes are keyed on identity rather than on the current nickname, so a rename cannot dodge one, and they sync across your own devices. A shareable mute list is a code you pass to someone directly — it never reaches this server, because a central list of who is disliked is exactly the moderation apparatus this design refuses to build.
Wiping your identity here takes a second and touches nothing but this browser — deliberately, because for somebody acting under pressure a delay is the thing that must not exist. Anything already delivered to another person's screen is theirs.
`/forget` clears this browser's storage and reloads, with no network round-trip at all, so it works offline and cannot be blocked or observed. It cannot un-send: messages are ephemeral and were never stored, but whatever was on somebody's screen was on their screen.
Direct messages and private rooms are encrypted in your browser with a key that never leaves it. We hold the locked version and could not open it if we were asked to, which is a stronger thing than promising we would not.
No email, no phone number, no password, no name. You arrive and you are somebody. There is no profile on this server to seize, sell, leak or subpoena, because we never made one.
Channels are in the order they exist and messages in the order they were said. Nothing measures how long you stay, nothing tries to bring you back, and nothing is optimised against you.
No operators, no moderators, no badges, no verified anybody. Removing somebody from a private room is a flat vote of the people in it, visible to everyone including them — there are no quiet decisions taken about you elsewhere.
No ads, no tracking, no tiers, no investors expecting a return. There is nothing to sell, because what reaches us is either unreadable or already public, and nobody to sell it to.
No photos, no video, no attachments — which keeps this cheap enough to give away, and keeps a conversation about what somebody said rather than what they look like. This is Law III, and here it is kept exactly.
A name is only a label; the identity underneath it is a key that lives in your browser. Somebody who picks up a name you stopped using is visibly a different person, and anyone you had muted stays muted no matter what they rename themselves to.
Your mutes, your blocks and your preferences travel as one sealed blob, locked with a key made from your twelve words. Restoring them on a new device works because you hold the words — not because we kept a copy we could open.
rebellionchat.com — free forever. The five laws are at /manifesto.