Good to know.

Your ID and your account

An ID is created when you open the app. A protected cookie keeps you signed in. Save your secret recovery key to restore your ID, contacts and chats if you lose your browser data. Anyone with the key has full access to your account. Share only your public ID. Your language choice is saved in a separate preference cookie on this device.

Encryption

The connection uses HTTPS. Messages, media and saved media metadata are encrypted on the server. This prototype does not use end-to-end encryption: the operator holds the storage key and can read content. Push notifications do not contain message text.

Logs and media metadata

To investigate abuse, the service records IP addresses, available source ports, timestamps, browser User-Agent, browser language preferences, interface language and account actions. Some proxies do not provide a verified client port. There is no advertising tracking or device fingerprinting.

Cloudflare may provide an approximate country and city based on your IP address. These estimates are recorded with connection logs.

Network and admin audit logs are retained for 365 days.

Available image EXIF metadata is read before resizing and re-encoding. It may include camera, time and location data. Metadata is stored separately from the chat image. Video and audio are converted for playback. The operator can review messages and export conversations, media, metadata and connection logs for documented investigations. These admin actions are audited.

The operator stores original images and recordings privately for troubleshooting. Contacts receive only the version you send.

Requests and controls

Requests must be accepted before messaging. Opening a shared ID link sends a request. You can block contacts and report messages. Voice recording starts only after you choose to record and grant microphone access.

Legal notice

Privacy information from the operator

cryptcow 0.4.3 · Self-hosted prototype