Privacy by design
Chat256 puts the conversation first. The core experience does not require a phone number or public profile to start a private conversation. Direct invitations can use QR codes, private links or chat keys.
Supported private message data is protected with client-side authenticated encryption. Secure HTTPS/WSS transport protects communication between the browser and the service, while authenticated sessions and service controls protect the application around the encrypted payload.
Messages and encrypted content
Supported private messaging uses ECDH P-256 for shared key agreement, HKDF-SHA256 for key derivation and AES-256-GCM authenticated encryption for protected message data. The browser performs the protected-content encryption before the encrypted envelope is sent through the service.
This architecture separates protected message content from the ordinary routing and authentication functions required to operate a communication service.
Identity and sessions
Chat256 uses browser-based cryptographic identity and authenticated sessions for supported account and private communication flows. Public-key material can be used to establish and verify identity, while private cryptographic keys remain under client-side control.
Users should protect their device, browser profile, recovery material and credentials. A secure application cannot compensate for a private key or account secret being deliberately shared.
Encrypted files and media
Supported file and media transfers are protected on the client before transmission and can use chunked transfer, authenticated transfer controls, expiry, deletion and quota management. Workspace provides a separate area for working files so material does not have to become part of the ordinary conversation stream.
Expiry and deletion controls reduce availability inside the supported service. They cannot erase a copy already saved by a recipient.
Private voice and video
Chat256 voice and video calling uses WebRTC media with application signalling, ICE and STUN/TURN network traversal support. WebRTC provides encrypted media transport between supported participants while the Chat256 application protects signalling and session establishment.
Calling still requires normal internet connectivity and browser microphone or camera permissions.
Notifications and local browser data
Chat256 keeps operating-system notification text generic so private message content is not copied into notification bodies. Browser storage is used for supported local identity, encrypted contacts, preferences and application state.
Clearing browser storage can remove local application state without automatically deleting service-side records.
Disappearing messages
Supported conversations can use message-expiry controls. Expiry is a retention feature, not a guarantee that a recipient has not copied the information. Screenshots, photographs, downloads and other recipient-controlled copies remain outside the application's control.
Workspace
Workspace is designed for organised encrypted working material. Files can be uploaded and managed separately from the main chat stream, with storage, transfer and deletion controls applied by the service.
Forum
Forum brings organised community communication into the Chat256 platform. Sections, threads, posts, reactions and community controls are handled by the application, with supported content protected by the platform's encrypted content model.
Marketplace communication
Marketplace provides a private communication path between buyers and sellers. It is useful for discussing products, asking questions and coordinating transactions without making a personal phone number the centre of the conversation.
Plans and billing
Chat256 can associate accounts with plans, entitlements, storage limits and other purchased service capabilities. Payment events are processed through the payment flow selected for the account, while the application uses the resulting entitlement state to provide the purchased service.
Security controls
Chat256 combines browser cryptography with authenticated sessions, access controls, rate limiting, secure transport, protected media routes and a dedicated administrative security boundary. The platform is designed to reduce unnecessary exposure while maintaining the controls required to operate an internet communication service.
Privacy does not mean metadata disappears
Internet communication still involves technical information needed for delivery, authentication, abuse prevention, connectivity and service operation. Privacy-focused application design protects the content it is designed to protect without pretending that network infrastructure stops existing.
Privacy requests
For privacy questions or requests, contact support@chat256.com. For security disclosures, contact security@chat256.com.
Do not send private cryptographic keys, recovery secrets, passwords or session credentials by email.
Updates to this privacy information
Chat256 may update this page as the service develops, features change or applicable requirements change. The published page describes the privacy model of the Chat256 service and the information associated with its communication features.