Security

1. Our approach

ReTalkia is built privacy-first. We collect the minimum needed to run the service, we do not sell personal data or share it with third parties for advertising or tracking purposes, and we do not use third-party analytics, advertising or tracking scripts.

Security and privacy are not add-ons here — they shape how the service is designed.

2. Transport and infrastructure

All traffic to ReTalkia is encrypted in transit using TLS (HTTPS), and we send HSTS (Strict-Transport-Security) so browsers only connect over HTTPS.

Application servers and the database listen only on the local machine and are not directly reachable from the internet. Public web traffic is handled by Caddy, with Cloudflare providing the public edge, DDoS protection and WebSocket proxying.

We trust the visitor IP supplied by Cloudflare only when it comes from Cloudflare's published network ranges.

We do not load third-party fonts, analytics or advertising from external providers.

3. Passwords and accounts

Passwords are never stored in plain text. They are hashed with Argon2id, a memory-hard password hashing function designed to resist brute-force attacks.

Accounts are activated with a code sent to your email. A phone number is not required.

When a password is reset, all active sessions for that account are revoked and you must sign in again.

4. Sessions and cookies

Signing in uses a single essential first-party cookie (rt_session). It is HttpOnly, SameSite=Lax, and Secure in production.

We do not use advertising, analytics or third-party tracking cookies. The only other browser storage we use contains a local cookie-notice preference and the identifiers of voice messages already played. It does not contain message content.

5. What we store, and for how long

Account data: display name, email address, an Argon2id password hash, and an optional short bio.

Messages: only the newest messages per channel are kept (currently 50); older messages are permanently deleted.

Voice messages: audio files are removed after 24 hours. After that, the message shows as not available.

Private one-to-one conversations: removed shortly after both participants go offline, with a short grace period (currently about one minute) for reconnects.

IP addresses: recorded when you register and when you successfully sign in. Sign-in IP records are deleted after 90 days; the registration IP is kept with the account until the account is deleted.

No phone number is required, and we do not build advertising profiles.

6. Access control and moderation

Moderation is enforced server-side. Room operators can remove members or ban users from channels they manage, and platform administrators can act across the service. Administrative access is limited to platform administrators and requires signing in.

Bans are permanent and there is no unban function.

Private circles are invite-only, and membership is checked on the server for every action.

The PostgreSQL database listens only on the local machine and is not reachable from the internet.

7. Service providers

We use a small number of infrastructure providers to operate ReTalkia:

• Cloudflare: edge network, DDoS protection, CDN and WebSocket front;
• our hosting environment: servers and PostgreSQL database;
• Gmail SMTP: delivery of transactional emails such as activation, sign-in and password-reset codes.

We do not use advertising networks, analytics providers or data brokers. We do not sell personal data.

Links sent in chat are kept as plain text: we do not fetch or preview third-party pages, so nothing about you is sent to the sites people link to.

8. Backups and availability

We keep database backups (pg_dump) and a copy of the project, stored separately from the live service.

We monitor availability and aim to keep ReTalkia running smoothly, but we cannot guarantee uninterrupted or error-free operation.

9. Reporting a vulnerability

If you believe you have found a security issue, please email us at:

[email protected]

Include what you found, the steps to reproduce it, the affected address, and any impact you can see. Please give us reasonable time to investigate and fix the issue before disclosing it publicly.

We do not currently run a paid bug bounty, but we are grateful for responsible reports and can credit you if you wish.

Machine-readable contact details are published at /.well-known/security.txt.

10. Changes to this page

We may update this page as ReTalkia changes. The Last updated date at the top shows when it was most recently changed.