Privacy

Message text, clips, photos, map pin labels and times, and room secrets are encrypted on your device before they leave. The relay is built to forward opaque ciphertext and presence metadata — not to read your chat. An account is optional and, when used, is stored on this device behind a passkey.

“Mote” refers to this application: the web client and the blind Socket.io relay used to exchange encrypted envelopes and WebRTC signaling. If you self-host the relay, that operator’s practices also apply to connection logs on their infrastructure.

The following are encrypted on your device with keys derived from the room secret in the invite link (and optional passphrase):

• Chat messages (including delete and edit updates)
• Short video clips
• Still photos (re-encoded on device before encrypt)
• Map pin coordinates, labels, event times, and attend toggles
• WebRTC signaling payloads used for walkie-talkie audio

Room keys live in the URL fragment (#…) and/or device storage. Fragments are not sent to the web server in normal browser navigation. The relay is not given room keys or plaintext.

The blind relay may process:

• Connection metadata (IP address, timing, User-Agent via the host stack)
• Opaque mote identifiers and peer identifiers you choose for the session
• A join capability token derived from the room key (stored only as a hash after a successful join)
• Encrypted message envelopes (ciphertext, nonces/salts, size) and encrypted signaling blobs
• Ephemeral presence (who is currently connected to a mote)
• Closed mote identifiers after a creator Ends a Mote (TTL-limited, so that invite cannot rejoin — still no message content)
• Abuse-report metadata you submit (mote id, peer id, nickname) if you use People → Report — not encrypted chat content
• If you opt in to saved-Mote notifications: a Web Push endpoint for this device plus the mote id (so the relay can send a content-free wakeup). Not message text, nicknames, or room keys

The relay cannot decrypt message content with the information it is designed to hold. Presence is process-local; production hosts typically keep a short opaque message ring in Redis (~12 hours after last write), join digests and creator host claims (~30 days after last write), plus closed mote ids (~30 days), still without plaintext. Relay logs do not print mote or peer ids.

Accounts are optional. If you create one, Mote stores a device-local profile (display name, credential id, saved mote metadata) in your browser’s IndexedDB. Room keys saved to an account may be sealed with WebAuthn PRF material when your authenticator supports it. This data is not synced to a Mote “cloud account” by default — it stays on that device until you clear site data or use Erase local data from the home account panel.

The PWA may keep messages, an offline outbox, identity keys, themes, ignore lists, and saved motes in IndexedDB, plus limited session flags in sessionStorage (for example passphrase cache or huddle ICE consent). You can wipe this browser with Erase local data on the home account panel, or clear site data in your browser settings.

• OpenStreetMap / tile providers — map tiles when you use the shared map (referrer is restricted where configured).
• Nominatim (OpenStreetMap) — place/postcode lookup when you drop or search pins. Queries you type are sent to that service; mote paths are not intended to be sent as Referer.
• Web Push — if you opt in, the browser’s push service (for example Apple, Google, or Mozilla) delivers a generic “new message” ping. That service does not receive chat content from Mote.
• STUN/TURN — production hosts typically configure NEXT_PUBLIC_MOTE_ICE_SERVERS (often self-hosted coturn). Walkie-talkie may contact those servers; peers may learn network addresses via WebRTC. LAN-only deployments may omit ICE (host candidates only).

Mote is not built around advertising or cross-site tracking cookies. Functional storage (IndexedDB, sessionStorage, service worker caches in production) is used for the product features above.

Mote is for adults only. You must be at least 18 years old to create or join a Mote. We do not knowingly collect data from anyone under 18. If you believe a minor is using the service, stop sharing invite links with them and clear local data on devices you control.

Relay presence is ephemeral (in-memory). Opaque message rings may persist in Redis on production hosts for about 12 hours after the last write. Join digests and creator host claims may persist for about 30 days after the last write — they survive restarts and empty rooms (no wipe-on-leave). End Mote already clears the ring, join digest, host claim, and push rows, and keeps a closed-mote tombstone for about 30 days so that invite cannot rejoin. Memory-only relays clear those records when the process restarts. Device-local data persists until you delete it. Invite links remain powerful secrets for as long as someone holds them — treat them like passwords. Status pages show live mote and peer counts only.

We may update this policy as the product evolves. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.

For privacy questions about a deployment you use, contact the operator who hosts that Mote web app and relay. Self-hosted instances are controlled by their operators.