Privacy

The short version

• No advertising, no third-party analytics, no tracking pixels, no profiling.
• Your account, contacts, and messages are stored on this server so your chat works across devices.
• Direct messages can be end-to-end encrypted; open rooms are public to their occupants by design.
• You can ask us to export or delete your data at any time.

What we store

Account data. Your username, a salted hash of your password (we never store the password itself), and your roster (contact list).

Message archives. XMPP servers keep a server-side archive (MAM) so you can scroll back and sync across devices. Our archive retention is 1 year; older messages are deleted automatically.

Group chat. The six public rooms are persistent, so their history is archived. These rooms are public and open — anything posted there can be read by every occupant, and room history may be shown to people who join later.

File uploads. Files you share through the server are stored and automatically deleted after 30 days.

Bot memory. The Azarath assistant keeps short notes to remember context. Those notes are wiped completely every 30 days. When you talk to Azarath, your message is sent to a third-party AI provider to generate a reply (see below).

Technical logs. Standard server logs record connection metadata (such as IP addresses and timestamps) for security, abuse prevention, and rate limiting. They are not used to build profiles.

Encryption, honestly

Direct messages can be end-to-end encrypted with OMEMO. When both sides use it, the server cannot read the message content. End-to-end encryption protects the message in transit and at rest on the server.

Group rooms are not end-to-end encrypted. Our public rooms are open to join, which is incompatible with the strict membership model that room encryption requires. Room messages are protected in transit (TLS) but are readable by the server and archived. Treat them as public.

AI caveat. Azarath decrypts messages it receives in order to answer them, and sends the plaintext to its AI provider. OMEMO protects the transport and the server, not the AI provider. Do not share secrets with the bot.

Who can see your data

The server operator can access stored data (accounts, archives, logs) in order to run and maintain the service. We do not share data with third parties except:

• where required by law;
• with the AI provider, when you choose to talk to the Azarath bot;
• with push providers, if you enable push notifications — and only a wake-up signal, never the message body or sender.

Federation

Zinthos is part of the federated XMPP network. Messages you send to people on other servers are delivered to those servers and are subject to their policies.

Your choices

• Export: ask us and we will provide a copy of your account data.
• Delete: ask us and we will delete your account and its archives.
• Stay private: use OMEMO for direct messages and keep sensitive material out of public rooms.

Contact

Questions or requests: abuse@zinthos.dev or XMPP rose@zinthos.dev.

Changes

If this policy changes, we will update this page and its date. Continued use after a change means you accept the updated policy.