Privacy

Message text, clips, photos, map pin labels and times, and room secrets are encrypted on your device before they leave. The relay is built to forward opaque ciphertext and presence metadata — not to read your chat. An account is optional and, when used, is stored on this device behind a passkey.

“Mote” refers to this application: the web client and the blind Socket.io relay used to exchange encrypted envelopes and WebRTC signaling. If you self-host the relay, that operator’s practices also apply to connection logs on their infrastructure.

The following are encrypted on your device with keys derived from the room secret in the invite link (and optional passphrase):

• Chat messages (including delete and edit updates)
• Short video clips
• Still photos (re-encoded on device before encrypt)
• Map pin coordinates, labels, event times, and attend toggles
• WebRTC signaling payloads used for walkie-talkie audio

Room keys live in the URL fragment (#…) and/or device storage. Fragments are not sent to the web server in normal browser navigation. The relay is not given room keys or plaintext.

The blind relay may process:

• Connection metadata (IP address, timing, User-Agent via the host stack)
• Opaque mote identifiers and peer identifiers you choose for the session
• A join capability token derived from the room key (stored only as a hash after a successful join)
• Encrypted message envelopes (ciphertext, nonces/salts, size) and encrypted signaling blobs
• Ephemeral presence (who is currently connected to a mote)
• Closed mote identifiers after a creator Ends a Mote (TTL-limited, so that invite cannot rejoin — still no message content)
• Abuse-report metadata you submit (mote id, peer id, nickname) if you use People → Report — not encrypted chat content
• If you opt in to saved-Mote notifications: a Web Push endpoint for this device plus the mote id (so the relay can send a content-free wakeup). Not message text, nicknames, or room keys

The relay cannot decrypt message content with the information it is designed to hold. Presence is process-local; production hosts typically keep join digests, a short opaque message ring, and closed mote ids in Redis (TTL-limited), still without plaintext.

Accounts are optional. If you create one, Mote stores a device-local profile (display name, credential id, saved mote metadata) in your browser’s IndexedDB. Room keys saved to an account may be sealed with WebAuthn PRF material when your authenticator supports it. This data is not synced to a Mote “cloud account” by default — it stays on that device until you clear site data or use Erase local data from the home account panel.

The PWA may keep messages, an offline outbox, identity keys, themes, ignore lists, and saved motes in IndexedDB, plus limited session flags in sessionStorage (for example passphrase cache or huddle ICE consent). You can wipe this browser with Erase local data on the home account panel, or clear site data in your browser settings.

• OpenStreetMap / tile providers — map tiles when you use the shared map (referrer is restricted where configured).
• Nominatim (OpenStreetMap) — place/postcode lookup when you drop or search pins. Queries you type are sent to that service; mote paths are not intended to be sent as Referer.
• Web Push — if you opt in, the browser’s push service (for example Apple, Google, or Mozilla) delivers a generic “new message” ping. That service does not receive chat content from Mote.
• STUN/TURN — production hosts typically configure NEXT_PUBLIC_MOTE_ICE_SERVERS (often self-hosted coturn). Walkie-talkie may contact those servers; peers may learn network addresses via WebRTC. LAN-only deployments may omit ICE (host candidates only).

Mote is not built around advertising or cross-site tracking cookies. Functional storage (IndexedDB, sessionStorage, service worker caches in production) is used for the product features above.

Mote is for adults only. You must be at least 18 years old to create or join a Mote. We do not knowingly collect data from anyone under 18. If you believe a minor is using the service, stop sharing invite links with them and clear local data on devices you control.

Relay presence is ephemeral. Opaque message rings may persist briefly in Redis on production hosts (across restarts and empty rooms, with TTL); closed mote ids may be kept for about 30 days so ended invites cannot rejoin. Memory-only relays clear those records when the process restarts. Device-local data persists until you delete it. Invite links remain powerful secrets for as long as someone holds them — treat them like passwords.

We may update this policy as the product evolves. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised policy.

For privacy questions about a deployment you use, contact the operator who hosts that Mote web app and relay. Self-hosted instances are controlled by their operators.