ChatNode is peer-to-peer software that runs on your own device. We do not operate servers that store your messages, and we do not hold accounts.
This policy explains what that means in practice — including the places where information is still exposed, because a decentralised design does not make everything private.
ChatNode has no account system. There is no sign-up, no email address, no password and no profile held by us. We do not collect:
We could not hand over your message history if asked, because we do not have it.
Your data lives on your device, in ChatNode's data folder. That includes your identity key, your conversations, your contact list, your notification and privacy settings, and any files you have received.
Anyone with access to your unlocked device, or to a backup of it, can read that data. Encryption protects messages in transit between devices; it does not protect them from someone holding your device. Protect the device itself.
You can delete this data at any time by deleting the data folder or uninstalling the application. Doing so also destroys your identity key — see the Terms regarding key loss.
Direct messages are end-to-end encrypted. Each conversation uses a key derived from the two participants' cryptographic identities, so only the two endpoints can decrypt the content. Messages that are not encrypted are rejected rather than displayed.
Two limits are worth stating plainly:
Public rooms are not private. Anything posted in a room is visible to everyone in that room.
This is the most important section for anyone relying on ChatNode for privacy. Encryption protects what you say; it does not by itself hide who you are or that you are talking.
By default your node is open to the network: any peer may connect to it. Your peer identifier is public by design — it is how others reach you. A peer that connects to you can observe:
.chat name you have registered, which is recorded publicly on a blockchainA peer you connect to directly learns your IP address. This is inherent to peer-to-peer networking rather than a defect, and it is true of the person you are messaging as well as of anyone who simply dials your node.
ChatNode includes a private peers mode that narrows this considerably. When you enable it, you supply a list of peers you are willing to talk to, and your node:
It also stops using bootnodes altogether. Rather than contacting the network's discovery servers, your node connects directly to the addresses you listed and nothing else. No third-party infrastructure is involved in finding your peers, and no bootnode operator sees your address or knows you are online.
This is the strongest privacy configuration ChatNode offers: a closed group whose members reach each other directly, with no third party carrying your traffic or able to observe who is talking to whom.
To be precise about one detail: the node still performs a DNS lookup for bootnodes at startup, before determining it does not need them. That discloses nothing about your conversations, but it is not literally zero contact with project-controlled infrastructure. The mode also requires at least one peer to be listed — enabling it with an empty list falls back to normal behaviour.
It comes with a practical cost, which is why it is not the default. Because there is no discovery infrastructure, each member must be reachable at a known, stable address — in practice a static IP address, or a hostname that tracks one, together with a forwarded port on their router. Members behind ordinary home connections that change address, or behind carrier-grade NAT, will not be reachable this way. Setting this up requires some networking knowledge.
One thing remains true in every mode: your peer identifier, and any .chat name you have registered, are public. A registered name is recorded on a blockchain and cannot be withdrawn. Private mode controls who can connect to you, not whether your identifier exists.
Your node uses bootnodes to find peers and to carry the first message to somebody you have not contacted before. A bootnode can observe that a node with a given peer identifier and IP address is online, and can see that traffic passed between two peers and when — it cannot read any of it.
After that first exchange your nodes connect directly and subsequent traffic does not pass through a bootnode at all, so it observes nothing further about that conversation. The exception is a network on which a direct connection cannot be established — some mobile carriers — where traffic continues to be relayed.
Anyone may run a bootnode. In default mode you should assume that the operators of the bootnodes your node uses can build a picture of when you are online and which addresses you connect from. Private peers mode removes this exposure entirely, at the cost of the network setup described above.
There is one case in which a bootnode stores something rather than only passing it along. If you send a message to a contact who is offline, the app offers to hold it for them; if you accept — for that message, or for that conversation until you turn it off — the message is queued on the bootnode your node relayed through and delivered when the recipient next comes online.
This never happens on its own. Nothing is stored unless you choose it at the moment of sending.
What is stored is ciphertext only. The message is encrypted on your device before it is handed over, and the queue rejects anything that is not already encrypted, so the operator holds a blob they cannot open. What an operator can see is the same metadata they see for any relayed message: that something addressed to a particular peer identifier is waiting, and its size and timing.
A queued message is deleted as soon as it is delivered, and in any case after 24 hours. A recipient who does not return within that window never receives it, and nothing remains on the operator's disk.
ChatNode does not route your traffic through an anonymising network such as Tor. Peers connect to each other directly, so the people you talk to always learn your IP address, in every mode. Private peers mode limits that to the group you chose; it does not hide you from within the group.
If concealing your IP address from the people you communicate with is essential to your safety, ChatNode alone does not achieve that. Combine it with a tool designed for that purpose, and understand that tool's own limits.
Registering a .chat name writes your name, your peer identifier and your wallet address to a public blockchain. This information is permanent, publicly readable by anyone, and cannot be deleted or amended by us or by you.
Registering a name links your identity to a wallet address and to any transaction history that address has. Consider whether you want that link to exist before registering.
Calls are established directly between participants where the network allows it. When a direct connection cannot be made — commonly because of restrictive home or mobile networks — call media may be relayed through a server so the call can connect at all. Relayed media passes through that server; the parties to the call can see each other's network addresses in either case.
If you enable the remote access feature, traffic between your authorised peer and the target device travels inside your node's encrypted connection. We do not see that traffic.
Be aware that enabling it on a machine grants the peer you authorise access to devices on that machine's local network, within the restricted set of addresses and ports the feature permits. Enable it only for a peer you trust with that access.
This website is separate from the application. It is served by a conventional web server, which keeps standard access logs — including IP addresses — for operational and security purposes. If you contact us, we will hold whatever you send us for as long as needed to respond.
Downloading the software from this site reveals your IP address to the web server, as with any download.
ChatNode is not directed at children under 13, and we do not knowingly collect information from them. Since we operate no account system, we have no means of verifying any user's age.
Data protection law gives you rights over personal data a company holds about you. In our case, we hold almost nothing: there is no account to access, correct, export or erase, because your data is on your own device and under your own control.
Data already published to the blockchain, and data other participants have received from you, is outside our control and cannot be recalled. For website server logs and any correspondence you send us, contact us through the support channel linked in the footer.
We may update this policy. The date at the top shows when it last changed. Material changes to how the software handles data will be described in the release notes for the version that introduces them.
Privacy questions can be raised through the support channel linked in the footer of this site.
See also our Terms & Conditions.