COMPAX01
The short version
Messages and calls are end-to-end encrypted with MLS. The server carries ciphertext it cannot read, and it does not hold the keys that would let it. Your wallet keys are made on your device and never leave it.
This website sets no cookies, stores nothing in your browser, loads nothing from anybody else’s server, and runs no analytics. That is measurable rather than promised: open the network panel and count.
02
What the delivery server necessarily knows
To deliver a message to the right devices it has to know some things, and those things are: the public identity key of an account, the devices registered to it, which groups a device belongs to, the size and timing of what passes through, and the address a connection comes from.
It also holds a push token if you have notifications on, so a device that is not connected can be woken — and what is pushed is a knock, not the message.
03
What it does not know
The contents of messages, files and calls. The names of groups and the names you have given your contacts — those are yours alone and stay on your own devices. Your balances, your addresses, your transactions and your keys.
There is no phone number and no email address, because the account is a key pair rather than a registration. Nothing here is tied to a legal identity by us.
04
How long any of it is kept
The log a device reads to catch up is bounded: whole partitions older than the window are dropped, and a device that was away longer than that re-joins instead of catching up. Uploaded files are encrypted blobs and expire.
Deleting a device takes its sessions, its key packages, its wrapped keys, its push token and the blobs it uploaded with it. A revocation that left any of those behind would not be a revocation.
05
The wallet
Keys are derived from your recovery phrase on your device and are not stored anywhere else. To show a balance or send a transaction, the application talks to public nodes for those chains.
Those nodes are not ours, and they see the addresses you ask about and the address you connect from. That is true of every wallet that reads a public chain; running your own node is the way around it.
06
Bots, sites and other providers
A bot in a group is a member of it and reads what the group says. A site opened in the wallet’s browser sees the address you connect and whatever you agree to sign. Another provider you federate with sees what its own members are sent.
None of them are us, and what they keep is described by their own policies, not by this one.
07
This website
The pages are static files, rendered ahead of time in seventeen languages. They set no cookies, keep nothing in local storage, and load no fonts, scripts, images or frames from anybody else.
The host that serves them keeps ordinary access logs — the request, the time, the address it came from — as any web server does. We do not join those to anything.
08
If you run it yourself
The delivery service and its gateway are in the repository and are meant to be run by other people. When you run them, you are the operator: what your deployment logs, how long it keeps things, and what it tells anybody who asks are your decisions and your obligations.
09
Children
Compax is not aimed at children, and nothing here is designed to be used by somebody who cannot be responsible for a recovery phrase and money on a public chain.
10
Changes, and getting in touch
This document changes when the software does; the date above says when it last did, and the repository keeps the history. Questions, and anything that looks like a privacy or security problem, go to the repository.