Safety and privacy
A clear explanation of what Mozilra Chat does and does not protect.
Are my passwords stored securely?
Yes. Passwords are hashed with Argon2, rather than stored as readable text in the database. Use a strong, unique password.
Can anyone create an account?
No. Registration requires approval and a single-use invitation. This limits unwanted accounts, but does not guarantee protection against abuse.
Are my conversations end-to-end encrypted?
No. HTTPS protects data in transit when you use the site over HTTPS, but Mozilra Chat does not provide end-to-end encryption. The server processes messages, and an administrator with server or database access may be able to read stored content.
Who can see my messages and photos?
Conversation participants can view shared content. Profile photos are visible to other signed-in users. Do not share sensitive information that must remain completely secret.
Are messages deleted automatically?
Conversations can have a retention period, including five minutes. The server removes expired content according to that period. Recipients can take screenshots or make copies beforehand, and backups may remain for longer.
How do sessions and online status work?
Signing in uses a secure session cookie and protection against unwanted requests (CSRF). Sessions expire after twelve hours. Friends and conversation participants may be able to see your online status.
Are profile photos safe?
The server checks the image and creates a smaller WebP version. The original is not stored as your profile photo. This reduces storage use, but a profile photo is not private.
Your profile photo is visible to other users. Your online status updates automatically.