Frequently Asked Questions
Direct answers to common questions regarding Privatera's security architecture and mechanics.
Can anyone, including Privatera, read my messages?
No. Text, signalling and Room Call audio are encrypted between the two devices. WebRTC calls require DTLS-SRTP and additional media encryption. The relay does not hold the keys needed to decrypt this content.
Where are my messages and contacts stored?
They live encrypted inside your browser's local database on your device. Routing state is released on disconnect, with no stored message content on the relay (encrypted deletion markers may be held up to 24 hours for offline peers).
What happens if I lose my device or clear browser data?
Because Privatera is accountless — with no centralized accounts, emails, or cloud backups — clearing your browser storage permanently deletes your device-bound identity, contacts, and chat history.
How do I verify my contact with the safety code?
Both you and your contact derive an identical 9-digit safety code, formatted into three groups (e.g., 123 456 789), from your authenticated public keys and session parameters. Verified out-of-band, a network attacker gets a single attempt per pairing with a 1 in 10⁹ success probability. On mismatch, do not proceed.
Why does Privatera run in a browser instead of an app store?
A browser-based application requires no installation or account registration, loads zero third-party client trackers, and executes cryptography via the browser Web Crypto API under Strict CSP and Trusted Types.
How does the bilateral wipe work?
Either participant can trigger a bilateral wipe at any moment. A deletion request is sent to the peer and honored by compliant clients (with an encrypted deletion marker held up to 24 hours if the peer is offline); it cannot be enforced against modified clients or copies already made.