Nobody can read your messages here — not us, not anyone holding this server. What we can't hide is that messages are being sent, and, for direct messages, between whom.
This page is about RebellionChat. Social is a different product with different rules — it carries photos in posts, and it publishes its own page.
The drawbacks come first, each with its reason. None of it is meant to alarm you — each one comes from not keeping your life on somebody else's computer.
The message is locked in your browser and we don't have the key. But while it waits for the other person, this server holds a note saying who it's from and who it's for. The note is deleted when they collect it, or after seven days. Social doesn't work this way; changing direct messages to match is work we haven't done yet.
`dm_messages` stores the sender's and recipient's public keys and the sender's current handle as ordinary columns, alongside ciphertext we cannot decrypt. Anyone who seized this machine, its disk or a backup taken during those seven days would learn that two keys exchanged a message and when — never a word of what it said. RebellionSocial solves this with addresses derived from a secret only the two people share, so its storage has no identity column at all; the same change for direct messages is on the list and is not done.
Anyone you're connected to can walk into your rooms and read what's said while they're there — and in someone else's rooms, that includes their connections, who may not be yours. For fewer people, use a private room or a direct message.
A lobby's rooms are encrypted with one key the owner shares with every connection; the server relays the ciphertext and never writes it to disk. A private room encrypts to a key wrapped for each member, and a direct message to a key derived between the two of you. In every case this server only ever holds ciphertext.
Messages travel like letters through a post office. Nobody along the way can open them, but somebody watching that post office for a long time notices which boxes fill up and when. Hiding even that would mean holding your messages back for hours before delivering them, and we would rather deliver them.
This site reaches you through Cloudflare, which unlocks the connection at its own edge before passing it to our machine — so Cloudflare, and whoever controls this server, can see the pattern of requests, never the contents of an encrypted message. While you are connected, the running server also knows whose lobby you walk into; it writes no record of it, and no table here says who knows whom. Cloudflare's own records are outside our control.
A room can last as long as its owner wants, but its messages reach only who is there at the time. Nothing said while you were away was stored, so nobody can send it to you later — not us, not your friends' devices. It's also why there is nothing to seize.
Room and private-room messages are relayed to whoever is present and never written to disk; a room's lifespan covers the room, not a transcript. Direct messages are stored as ciphertext only until the recipient's browser acknowledges them, then deleted. Your own scrollback lives in your browser and goes when its storage does.
There is no email address to send a reset to and no account for us to look up, because we never asked for either. The twelve words are the identity itself. Write them down somewhere real — you can see them again in Settings → Privacy & identity.
Your key is derived from a 128-bit random number, shown to you as twelve words in the standard BIP39 wordlist. The server only ever sees the resulting public key, and verifies you by asking your browser to sign a challenge. There is nothing on this machine that could regenerate a lost key, which is the same property that makes an account here impossible to seize or subpoena.
Names are held for seven days at a time and renewed by turning up. Stay away longer and yours is free again. Nobody can take a name you are still using, and nobody is ever told who held one before.
A handle maps to your public key with a rolling 7-day expiry. The check only ever answers free or taken — never who holds it — because "is @maya here" is a question about a person that a stranger should not be able to ask a server.
There are no moderators reading messages and removing people, so a mute changes what you see and nothing else. Disconnecting from someone keeps them out of your rooms; in a private room the members can vote somebody out together. You can hand your mute list to a friend.
Mutes are keyed on identity rather than on the current nickname, so a rename cannot dodge one, and they sync across your own devices. A shareable mute list is a code you pass to someone directly — it never reaches this server, because a central list of who is disliked is exactly the moderation apparatus this design refuses to build.
Wiping your identity here takes a second and touches nothing but this browser — deliberately, because for somebody acting under pressure a delay is the thing that must not exist. Anything already delivered to another person's screen is theirs.
`/forget` clears this browser's storage and reloads, with no network round-trip at all, so it works offline and cannot be blocked or observed. It cannot un-send: room messages were never stored, but whatever was on somebody's screen was on their screen. Settings → Privacy & identity → Forget this device does the same.
Every message — in rooms, private rooms and direct messages — is encrypted in your browser with a key we never have. We could not open it if we were asked to, which is a stronger thing than promising we would not.
No email, no phone number, no password. You arrive through someone's invitation, with a key your own browser made. There is no profile on this server to seize, sell, leak or subpoena, because we never made one.
Rooms are listed by name and messages in the order they were said. Nothing measures how long you stay, nothing tries to bring you back, and nothing is optimised against you.
No operators, no moderators, no badges, no verified anybody. Removing somebody from a private room is a flat vote of the people in it, visible to everyone including them — there are no quiet decisions taken about you elsewhere.
No ads, no tracking, no tiers, no investors expecting a return. There is nothing to sell, because what reaches us is unreadable, and nobody to sell it to.
No photos, no video, no attachments — a conversation is about what somebody said, not what they look like. Your face is pixel art unless you turn on your picture for chats, and then only your connections see it. This is Law III.
A name is only a label; the identity underneath it is a key that lives in your browser. Somebody who picks up a name you stopped using is visibly a different person, and anyone you had muted stays muted no matter what they rename themselves to.
Your mutes, your blocks and your preferences travel as one sealed blob, locked with a key made from your twelve words. Restoring them on a new device works because you hold the words — not because we kept a copy we could open.
rebellionchat.com — free forever. The five laws are at /manifesto.