What this server can and cannot see

Being honest about this is more useful than a promise, so this page is a list rather than reassurance.

It cannot see

• The contents of messages, files, pictures and voice notes. They are sealed to their recipients' keys before they leave the sender's browser.
• What is said on a call. Calls go directly between the two browsers where the network allows; where it does not, a relay forwards encrypted media it cannot open.
• Your passphrase, or any key that would open the above. It holds your public key and — with sync on — a sealed blob and a hash of a verifier.

It can see

• Usernames, display names, public keys, and which devices exist.
• Who is online, and when an account was last seen.
• That a message went from someone to a conversation, when, how large the sealed blob was, and how many devices it was delivered to.
• Room names and membership for rooms that are not private to you.
• The address you connect from — kept for a limited window, and shown only to administrators.

Taken together that is metadata, and metadata is not nothing: who talks to whom, how often, and when, is real information. Yeetline does not pretend otherwise. What it guarantees is that the contents are not part of it.

What staff can do

Moderators can kick, suspend and delete accounts and remove messages. None of that lets them read anything: deleting a message removes the sealed envelope from the server, it does not open it first.

Administrators can additionally see the deployment itself — its settings, its health, its logs — and can reach every piece of metadata above.

The honest limit

A server can always be replaced by whoever runs the deployment. You are trusting the operator with the code that is served to your browser. A deployment that wanted to could ship a page that keeps a copy of your keys, and no amount of encryption inside that page would stop it.

That is true of every web application. It is why, if the contents matter, the answer to "how do I know?" is a client you installed rather than one you were served.

What is kept, and for how long

This deployment sets its own retention: how long messages, files and the audit log are kept before they are deleted. /privacy on this server is generated from those actual settings rather than from a template, so it is true of this deployment specifically.

Deleting a message removes it here. Everyone who already received it has a decrypted copy on their own device, and nothing on this server reaches that.

Last changed 2026-09-12