Privacy by design
Chat256 puts the conversation first. The core experience does not require a phone number or public profile to start a private conversation. Direct invitations can use QR codes, private links or chat keys.
Supported private message data is protected with client-side authenticated encryption. Secure HTTPS/WSS transport protects communication between the browser and the service, while authenticated sessions and service controls protect the application around the encrypted payload.
Messages and encrypted content
Supported private messaging uses ECDH P-256 for shared key agreement, HKDF-SHA256 for key derivation and AES-256-GCM authenticated encryption for protected message data. The browser performs the protected-content encryption before the encrypted envelope is sent through the service.
This architecture separates protected message content from the ordinary routing and authentication functions required to operate a communication service.
Identity and sessions
Chat256 uses browser-based cryptographic identity and authenticated sessions for supported account and private communication flows. Public-key material can be used to establish and verify identity, while private cryptographic keys remain under client-side control.
Users should protect their device, browser profile, recovery material and credentials. A secure application cannot compensate for a private key or account secret being deliberately shared.
Encrypted files and media
Supported file and media transfers are protected on the client before transmission and can use chunked transfer, authenticated transfer controls, expiry, deletion and quota management. Workspace provides a separate area for working files so material does not have to become part of the ordinary conversation stream.
Expiry and deletion controls reduce availability inside the supported service. They cannot erase a copy already saved by a recipient.
Private voice and video
Chat256 voice and video calling uses WebRTC media with application signalling, ICE and STUN/TURN network traversal support. WebRTC provides encrypted media transport between supported participants while the Chat256 application protects signalling and session establishment.
Calling still requires normal internet connectivity and browser microphone or camera permissions.
Notifications and local browser data
Chat256 keeps operating-system notification text generic so private message content is not copied into notification bodies. Browser storage is used for supported local identity, encrypted contacts, preferences and application state.
Clearing browser storage can remove local application state without automatically deleting service-side records.
Disappearing messages
Supported conversations can use message-expiry controls. Expiry is a retention feature, not a guarantee that a recipient has not copied the information. Screenshots, photographs, downloads and other recipient-controlled copies remain outside the application's control.
Workspace
Workspace is designed for organised encrypted working material. Files can be uploaded and managed separately from the main chat stream, with storage, transfer and deletion controls applied by the service.
Chat256 Mail
Chat256 Mail uses standard email delivery. Mail messages are not end-to-end encrypted by Chat256, and message content, sender and recipient details, subject lines and delivery metadata are handled by the mail service. Do not use Chat256 Mail for information that requires the end-to-end protection provided by supported Chat256 chats.
A no-sign-in temporary inbox does not require a Chat256 account, but it is not anonymous: the service applies an IP-derived abuse limit and its network and mail systems process connection and delivery details. The mailbox and its stored messages expire after 24 hours; an automated cleanup removes expired temporary mailboxes and their stored messages at intervals of up to 15 minutes.
A permanent mailbox is linked to an account, requires a paid plan and a verified contact, and stores messages on the mail server until you delete them. Outgoing mail is available only from a permanent account mailbox.
Plans and billing
Chat256 can associate accounts with plans, entitlements, storage limits and other purchased service capabilities. Payment events are processed through the payment flow selected for the account, while the application uses the resulting entitlement state to provide the purchased service.
Security controls
Chat256 combines browser cryptography with authenticated sessions, access controls, rate limiting, secure transport, protected media routes and a dedicated administrative security boundary. The platform is designed to reduce unnecessary exposure while maintaining the controls required to operate an internet communication service.
Usage and abuse-prevention data
To measure reliability and investigate abuse, the service records limited session and call events. These records can include an identity, session identifier, hashed room identifier, call identifier and type, visibility, event timestamps, duration and end reason. They do not contain message text or call audio/video. The identifiers are linkable to service activity, so this data is not anonymous.
A 30-day retention limit has been selected but an automated cleanup is not yet enforcing it. Existing telemetry has not been purged and may remain longer than 30 days while retention work is completed. The service connects browsers to authenticated endpoints and may use TURN relays for calls; encryption protects supported content but does not mean the service stores or processes no data.
Privacy does not mean metadata disappears
Internet communication still involves technical information needed for delivery, authentication, abuse prevention, connectivity and service operation. Privacy-focused application design protects the content it is designed to protect without pretending that network infrastructure stops existing.
VPN account and connection data
If you use the Chat256 WireGuard VPN, the service processes your account identity, verified email, plan, assigned tunnel address, client public key, provisioning status and an encrypted copy of the configuration needed to deliver your profile. A one-time profile link is sent to your verified email and expires after seven days.
VPN servers and network infrastructure can also process connection details such as source addresses, handshake times and traffic counters. We have not published a verified, complete inventory and retention schedule for every VPN and host-level log. The selected 30-day limit for application usage telemetry is not yet enforced, and infrastructure logs may have separate lifecycles. Chat256 does not claim that its VPN is anonymous or zero-log.
See the VPN feature and its current limitations. If you need a provider with a complete, independently verified no-logs policy or a self-service profile-revocation control, do not assume Chat256 currently provides those features.
Privacy requests
For privacy questions or requests, contact support@chat256.com. For security disclosures, contact security@chat256.com.
Do not send private cryptographic keys, recovery secrets, passwords or session credentials by email.
Updates to this privacy information
Chat256 may update this page as the service develops, features change or applicable requirements change. The published page describes the privacy model of the Chat256 service and the information associated with its communication features.