[{"data":1,"prerenderedAt":28},["ShallowReactive",2],{"$f1tptgxyclsxsn":3},{"html":4,"toc":5,"minutes":9},"\u003Cp>QxChat is a messenger. You chat in rooms or one to one, call people, share your screen and send files. Messages are encrypted on your device before they are sent, and the server only passes them along.\u003C\u002Fp>\n\u003Ch2 id=\"the-account\">\u003Ca class=\"anchor\" href=\"#the-account\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>The account\u003C\u002Fh2>\n\u003Cp>You choose a username and a password. When you sign up you also get \u003Cstrong>12 recovery words\u003C\u002Fstrong>: write them down, they are the only way to set a new password. QxChat never asks for a phone number or an email address, and has nowhere to store one.\u003C\u002Fp>\n\u003Ch2 id=\"rooms-and-keys\">\u003Ca class=\"anchor\" href=\"#rooms-and-keys\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>Rooms and keys\u003C\u002Fh2>\n\u003Cp>Each room has its own key, shared by its members and never sent to the server. Every message is encrypted with AES-256-GCM under a key derived from the room key, and signed by the sender. The server checks sizes and routing, then forwards ciphertext it cannot read.\u003C\u002Fp>\n\u003Cp>The server keeps the \u003Cstrong>last 150 messages of each room in memory\u003C\u002Fstrong> so someone who just joined can catch up. They are never written to disk and disappear when the server restarts. Your full history stays on your devices.\u003C\u002Fp>\n\u003Ch2 id=\"friends\">\u003Ca class=\"anchor\" href=\"#friends\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>Friends\u003C\u002Fh2>\n\u003Cp>Adding a friend uses QXP-PHANTOM. Requests are sealed with ML-KEM-768 and dropped into a blind mailbox that only the two of you can compute. The server holds the sealed envelope for at most 24 hours and cannot tell who sent it or who picked it up, so it never holds a map of who knows whom. Details in \u003Ca href=\"\u002Fwiki\u002Fphantom-protocol\">QXP-PHANTOM\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2 id=\"your-devices\">\u003Ca class=\"anchor\" href=\"#your-devices\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>Your devices\u003C\u002Fh2>\n\u003Cp>QxCloudSync keeps your rooms, keys and settings in step across your devices. The server relays the encrypted sync frames without storing or reading them. See \u003Ca href=\"\u002Fwiki\u002Fqxcloudsync\">QxCloudSync\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2 id=\"where-it-runs\">\u003Ca class=\"anchor\" href=\"#where-it-runs\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>Where it runs\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Web:\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fqxch.at\u002Fapp\u002F\" target=\"_blank\" rel=\"noopener\">qxch.at\u002Fapp\u003C\u002Fa>, nothing to install.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Desktop and mobile:\u003C\u002Fstrong> Windows, macOS, Linux, Android and iOS builds on the \u003Ca href=\"\u002Fdownload\">download page\u003C\u002Fa>. The apps use Tauri, so they ship the system's web view instead of a whole browser.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Your own server:\u003C\u002Fstrong> one Rust program with SQLite or PostgreSQL. See \u003Ca href=\"\u002Fwiki\u002Fself-hosting\">Run your own server\u003C\u002Fa>.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Ch2 id=\"what-the-server-still-sees\">\u003Ca class=\"anchor\" href=\"#what-the-server-still-sees\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>What the server still sees\u003C\u002Fh2>\n\u003Cp>Encryption hides what you say, not everything about how you use the service. While you are connected the server knows which account is online, which rooms it joined and when messages pass through. It keeps no IP address or user agent in its logs. The full list of what is stored, and for how long, is in \u003Ca href=\"\u002Fwiki\u002Farchitecture\">Architecture\u003C\u002Fa> and the \u003Ca href=\"\u002Fprivacy\">privacy policy\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch2 id=\"open-source\">\u003Ca class=\"anchor\" href=\"#open-source\" aria-hidden=\"true\" tabindex=\"-1\">#\u003C\u002Fa>Open source\u003C\u002Fh2>\n\u003Cp>Everything is MIT licensed: the server (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Flqxp\" target=\"_blank\" rel=\"noopener\">lqxp\u002Flqxp\u003C\u002Fa>), the web client (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Fclient\" target=\"_blank\" rel=\"noopener\">lqxp\u002Fclient\u003C\u002Fa>), the apps (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Fapp\" target=\"_blank\" rel=\"noopener\">lqxp\u002Fapp\u003C\u002Fa>) and this site (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Fsite\" target=\"_blank\" rel=\"noopener\">lqxp\u002Fsite\u003C\u002Fa>). Bugs go to \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Flqxp\u002Fapp\u002Fissues\" target=\"_blank\" rel=\"noopener\">GitHub issues\u003C\u002Fa>; people hang out on \u003Ca href=\"https:\u002F\u002Fdiscord.wf\u002Fqxchat\" target=\"_blank\" rel=\"noopener\">Discord\u003C\u002Fa>.\u003C\u002Fp>\n",[6,10,13,16,19,22,25],{"id":7,"text":8,"depth":9},"the-account","The account",2,{"id":11,"text":12,"depth":9},"rooms-and-keys","Rooms and keys",{"id":14,"text":15,"depth":9},"friends","Friends",{"id":17,"text":18,"depth":9},"your-devices","Your devices",{"id":20,"text":21,"depth":9},"where-it-runs","Where it runs",{"id":23,"text":24,"depth":9},"what-the-server-still-sees","What the server still sees",{"id":26,"text":27,"depth":9},"open-source","Open source",1793535120937]