Privacy

Last updated: 14 September 2026

This says what Hashti stores, why, and what you can do about it. It describes what the software actually does — it was written against the database, not from a template.

What an account holds

• A username, and a password or a phone number (or both). The password is stored as a scrypt hash. Nobody, including whoever runs this server, can read it back.
• A phone number, if you sign in with one — but not the number itself. What is stored is a keyed fingerprint of it (an HMAC), enough to find your account when the same number signs in again, and its last two digits so you can see which number is on the account. The six-digit code texted to you is stored the same way, works once, and expires after ten minutes. To send the text, the number and the code go to the text-message provider the server's operator uses.
• If you continue with Apple or Google: the private id that company gives Hashti for you, and the email address it confirms (with Apple that can be a private relay address). Not your password there, and nothing else from that account. Taking Apple or Google off in Settings deletes it.
• A two-step PIN, if you turn one on, stored as a scrypt hash like a password.
• The devices you are signed in on: a name like "iPhone 17" or "Web browser", when it signed in and when it was last used — so you can see them and sign any of them out. Not your IP address. A device unused for 31 days is forgotten.
• Your date of birth, to check you are 17 or older. The date itself is kept so the check can be re-run; it is never shown to anyone else.
• An email address, if you give one. Optional. Used for confirming your account and nothing else. It is never shown to other people.
• What you choose to put on your profile: display name, picture, bio, status, interests, theme.

Your identity document

Verifying ties an account to one government document — a passport, a driving licence or a national ID card. On most servers it is your choice: without it an account can talk with its friends, chat in rooms and listen, and it cannot reach strangers, host, speak on voice, move money or post for everyone. A server's operator can also require it before an account does anything. Either way it is what makes one person one account, and what stops somebody who has been removed from coming back tomorrow with a new email address.

The document itself is not kept. What is stored for good is a one-way fingerprint of it: an HMAC of its type, the country that issued it and its number. That is enough to recognise the same document if it turns up again, and no use to anybody who steals the table — the number cannot be worked back out of it.

Alongside the fingerprint we keep the name and the date of birth printed on the document, and which country issued it, so a person reviewing it can see whether it matches the account. Nothing about the document is ever shown to another member.

If a server is configured to use an identity provider, the document goes to that provider and only their yes or no comes back here.

If it is not, an administrator of that server checks it by hand, and for that they need to see it — so you send a photo of the document. The photo is re-encoded on arrival, which strips anything your phone wrote into it (including location), and stored apart from everything else on the server, where only an administrator can open it. It is deleted the moment they decide, approve or refuse, and if a submission is never sent it is deleted within the hour.

If the name and date of birth on your document match an account that was closed for good, a person is asked to look before your account opens, even if the document itself checks out.

The fingerprint outlives the account. When an account is closed for good the row stays, because it is the thing that stops a new account being made with the same document. That is the point of it, and it is the one piece of this that deleting your account does not remove.

What using it creates

• Messages, posts, guestbook entries and questions you write, with the time you wrote them. Direct messages are private to the people in the conversation.
• Delivery and read receipts in private conversations: when each person's device received messages and when they last read them. Turn read receipts off and nobody sees when you read their messages — and you do not see when they read yours.
• Reactions and replies to messages, and for a forwarded message how many times it has been forwarded — never who wrote it first.
• Calls: who called whom, when, whether it was answered and for how long. The sound and pictures of a call are never recorded or stored anywhere.
• Walkie-talkie: nothing said on it is recorded or stored. While yours is open the server knows it is open, to tell the others in the chat that you can hear them, and forgets it when it closes. Switch walkie-talkie off in Settings and nobody can talk to you with it.
• When you were last connected, shown to others only as your settings allow.
• Voice notes and files you send, stored on the server that runs this app.
• Scheduled messages you write to send later wait on the server until they go. One you cancel is deleted at once; the record of one that was sent is removed after 30 days.
• A live location you share moves on the server while it is live, and stays as the last place it showed once it stops. Only the people in that chat can see it.
• Call links you make, and the requests to join a call through one. A link works until you switch it off.
• A browser you link to your account with a QR code or a code: the code works for three minutes, and the browser then shows up with your other devices, where you can sign it out.
• Photos you upload are re-encoded, which removes their metadata — including the GPS coordinates a camera writes into a photo. Photos sent in HD keep more of their size (up to 4096 pixels) but are re-encoded just the same.
• Videos and video notes you send are rewritten without their metadata, including where they were filmed, and a still from the start is kept as the picture shown before one plays. A video recorded in a browser is converted to MP4. A video note is recorded only while you are recording it, and nothing leaves your device until you send it.
• Who you are friends with, who you follow, and who you have blocked.
• Which rooms you are in, whether you are connected right now, and when you entered and left a room. That last part is kept for 90 days so a host can see how busy their room gets and how long people stay — as totals, never as who was there when.
• Coin transactions, if the server has payments switched on. For coins bought through the App Store or Google Play: the store's id for the purchase, which pack it was and when — kept so a purchase counts once, and so a refund takes its coins back.
• Reports you send, including what you reported and why. A report on a message, a post or a private message keeps a copy of what it said, and any picture in it, so the moderator sees what was reported even if it is edited or deleted afterwards. The same is true of anything of yours that somebody reports.
• Strikes, when something you wrote was refused by the filter: which tier it fell in, when, and in which room. They stop counting after 90 days; the row is kept as the record of what happened.
• An appeal, if you send one: the name you gave, an address to reply to, and what you wrote. Anyone can send one without signing in, which is the point — a closed account cannot.

Things it deliberately does not do

• It does not read your address book. Contact matching hashes each contact on your own device and sends only the hashes. Your contacts' addresses never leave your phone, and only people who explicitly opted in can be matched at all.
• It does not track your location. Your position is used once, in the moment you ask for nearby rooms, and is not stored. If you host a room and switch on "Findable nearby", the room keeps where you were at that moment, rounded to about a kilometre, with the name of the area; switching it off removes it. Nobody is shown the coordinates — only the area name and a rounded distance.
• It does not record anything quietly. A room recording can only be started by a host, everyone in the room is told the moment it starts, and a permanent line goes into the room's history naming who started it.
• There is no advertising and no ad tracking, so there is nothing to sell.

Encryption

• On the way. Everything between the app and the server travels encrypted, over HTTPS and secure WebSockets, and the store versions of the app refuse to talk to a server any other way.
• On the server's disk. The database — accounts, messages, everything above — is encrypted with a key kept apart from it, so a copied disk or a stolen backup cannot be read. Photos, voice notes and files are stored as files; the operator is expected to keep them on an encrypted disk.
• Private pictures and files. Something sent in a private conversation, in a room that is not public, or on a post that is not for everyone is only ever handed out through a link that stops working within two days. A copied link goes dead on its own.
• Calls are encrypted between each device and the voice server.
• Ordinary chats are not end to end. The server has to be able to read a message to run the word filter, count strikes, and let a moderator see what was reported — which is how harassment is stopped here. So whoever runs the server, and a moderator looking at a report, can see what was sent in an ordinary chat or group.
• Secret chats are end to end. Two friends can open a secret chat, and it starts only once both say yes. Each message is sealed on the sender's phone for each of the other person's devices and the sender's own (with keys that never leave those devices), so the server stores only sealed envelopes it cannot open, and a device added later cannot read what was sent before it. Secret chats carry text only. The same word filter runs on the phone before a message is sealed, and the other person can still report a message: the report includes what it said, and a cryptographic tag the server made when it was sent proves that is really what was sent, so a secret chat is private but not lawless. You can compare a sixty-digit security code with the other person to check nobody is in between, and the chat tells you when their security code changes. The AI helpers never see a secret chat.
• App lock and locked chats. The app can ask for Face ID, a fingerprint or your phone's passcode when it opens, and a chat can be locked behind the same. On a web browser the account password or PIN is checked by the server instead. A secret code that hides the Locked chats row is kept only on that device, as a salted hash.

Who can see what

• Messages in a public room are visible to anyone who can open that room.
• Messages in a private room are visible to its members.
• Direct messages are visible to the people in that conversation.
• Moderators and admins can see reported content, and can see who asked an anonymous question in their room — anonymity is from the room, not from moderation. There is no way to say something that a moderator could never trace.
• Anyone you block loses the ability to message or call you, see your posts, or find you.
• When you are online, and when you were last here, is shown to everyone, to friends only, or to nobody — your choice in Settings. Choose nobody and you do not see anyone else's last seen either.
• Who can add you to a group is everyone, friends, or nobody. Anyone else can only send you an invitation, and you are in the group only if you accept.
• Disappearing messages, when a conversation has them on, are deleted from the server — the words, reactions and any file — when their time is up. Anyone in the conversation can still screenshot or forward a message before then, and a message somebody has reported is kept in the report until a moderator decides. Anyone in the chat can keep a message so it does not disappear, and everyone sees who kept it.
• Who can message you is everyone, friends, or message requests (the setting a new account starts with). A request from somebody you do not know waits in its own inbox: they cannot see whether you read it, whether you are online, or call you, and they can send five messages until you accept. Photos in a request stay covered until you tap them.
• Your profile picture and your about can be shown to everyone, friends, or nobody. Moderators can always see them, because a report has to show who it is about.
• Groups a stranger puts you in show you who added you, how long they have been on Hashti and whether you share any other group, until you choose to stay or leave. To do that, the server remembers who added each person to a group.
• Recent messages shared with somebody new. Whoever adds a person to a group can let them read up to the last 100 messages from the past two weeks — never further back than the person adding them can read — and everyone in the group is told it happened.
• Group admins can remove anybody's message in their group. Everyone sees that an admin removed it and which admin; a copy of what it said goes into the moderators' log, so a later report about its writer is not left empty.
• Reporting a group sends the moderators its name and description, who made it and who runs it, and the last ten messages you could see in it. A group report does not count against any one person on its own.
• Replying privately to a group message shows the quote in your one-to-one chat only while you can both still see it in the group — delete it there and the quote goes too.
• Status is shown to your contacts, your contacts except people you pick, or only people you pick. Mentioning somebody in a status tells only them — nobody else who sees it is shown who was mentioned — and they can add it to their own status, with your name on it.
• Channels are public: anyone signed in can find one and read its posts. Nobody can see who follows a channel, who reacted or how anyone voted in a channel poll — not even its admins; they see counts.
• Communities show everyone in them the community's other groups, and put everyone in the community's announcements group, where only its admins post.
• Nicknames, private notes, saved replies, chat lists and chat wallpapers are yours alone. They are stored with your account so your devices share them, and nobody else sees them. A nickname or a saved reply still passes the filter.
• View-once photos, videos and voice notes open once for each person they were sent to, through a link that works for two minutes, and the file is deleted from the server once everyone has opened it (or after two weeks). If a phone reports a screenshot of one, the sender is told in the chat.

Optional services

Some features only work if the operator of a server configures an outside service. When one is not configured, the feature says so rather than silently doing nothing:

The website

Leave your email address on hashti.app to hear when Hashti opens, and that address is stored — with the time and the country it was sent from, nothing else — in Cloudflare Workers KV until the one email announcing the launch has gone out, and deleted after it. Write to hashti.app@gmail.com to have it removed sooner. The website itself sets no cookies and runs no analytics or tracking scripts.

The filter

Everything you write is read by an automatic filter before it goes anywhere, to decide whether it is delivered, covered up or refused. It runs on the server, on that message alone, and nothing about it is stored except the strike when something is refused. It is a word list, not a profile of you, and it is not used for anything else.

How long things are kept

Content stays until you delete it or delete your account. Deleting a message, a post or a picture removes the file as well as the words, so an old link stops working; so does replacing your profile picture. Deleting your account removes your profile, rooms you own, messages, posts, pictures and transactions. It cannot pull back a message someone else already received a copy of, and it does not erase a moderation record of a serious rule breach.

The one wait: a picture in something that has been reported and not yet decided is kept until a moderator decides, and then deleted if nothing else still shows it.

Some things go on their own: a disappearing message when its time is up, a texted code after two days, a signed-in device after 31 days unused, the record of exactly when a message was delivered and read after 45 days, and an unanswered group invitation after three days.

Two things outlive the account on purpose, and both are about somebody else's safety rather than yours:

• The fingerprint of your document, if the account was closed for breaking the rules. Without it, a removal lasts as long as it takes to make another email address.
• The record of why it was closed. A closed account keeps its username so that nobody else can take it and be mistaken for you.

You cannot delete the account while enough people have reported it that it is being looked at — otherwise deleting would be the way out of a decision rather than a way of leaving. Appeal instead.

What you can do

• Take everything with you. Settings → Safety → Download my data returns everything the account holds, as JSON.
• Delete the account. Settings → Delete my account, confirmed with your password — or, for an account made with a phone number, a code texted to it. It is immediate and permanent. It is refused while there are enough reports against the account for it to be under review.
• Appeal a removal. At /appeal, without signing in, because a closed account cannot. A person reads every one.
• Ask what is held against you. Settings → Safety shows every strike on the account, when each one was recorded and when it stops counting.
• Stop being findable. Contact matching is off unless you turn it on, and turning it back off deletes the stored hashes.
• See and sign out your devices, add a two-step PIN, and choose read receipts, who sees when you are online, and who can add you to groups — all in Settings.