Your account and your conversations, kept safe.
What we do to protect you, in plain words. We also tell you what we do not do.
Signed in devices
Chrome on WindowsThis device
Safari on iPhoneYesterdaySign out
Edge on WindowsLast weekSign out
How we protect you
Your account
- A one time code confirms your email when you sign up
- Passwords are stored as salted hashes, never in plain text
- Wrong password and wrong code attempts are limited and locked
- We email you when your account signs in on a new device
Your devices
- See every device that is signed in
- Sign out one device or every other device in a tap
- Changing your password signs out everywhere else
Messages and media
- Everything travels over HTTPS and secure web sockets
- Chat media sits in a private store and opens through short lived links
- Photos lose their location and camera details before upload
- Uploads are checked by their real file type, not just their name
Against abuse
- Rate limits on sign in, search, friend requests and messages
- Every action is checked on the server, never only in the app
- Strict content security rules in the browser
What we do not claim
Gistroom does not use end to end encryption yet, so we do not describe it that way. We can read message data on our servers when we need to act on a report. Do not share anything you would not want a moderator to see in a report.
How safety works
Found a problem?
Write to security@gistroom.ng with what you found and how to repeat it. Please do not post it publicly first. We reply within three working days.
Email usSafe, and easy to start.
Make an account in a minute. You choose who can reach you.
