Here we explain how we protect your conversations and our servers, the limits of that protection and what’s up to you. No promises we can’t keep.
In short
- Your 1:1 and group messages, files and calls are end-to-end encrypted on your device: our servers can’t read or hear them.
- Your 12-word key is created on your device and is never sent to our servers. Turn on the PIN to encrypt it in your browser too.
- Our server does see some metadata, such as your IP address and who writes to whom and when; public channels are public, and encryption has limits, which we explain below.
- The Terminal doesn’t hold funds: your wallet signs everything and shows you first what you’re about to sign.
- We will never ask for your 12-word key or your wallet’s seed phrase.
- Found a security issue? Write to us at info@radarcrypto.fun.
1. How we encrypt your conversations
Encryption happens in your browser before anything leaves your device, using well-known, widely used cryptographic algorithms. Here’s what we use in each case:
| What | How it’s encrypted |
|---|---|
| 1:1 messages | nacl.box (X25519 and XSalsa20-Poly1305) with your Chat IDs’ keys. Over a direct connection they also travel inside WebRTC’s DTLS encryption. |
| Group messages | Sender keys: each member encrypts their messages with secretbox and a key that changes with every message, and signs them with Ed25519. Those sender keys are shared with each member, encrypted with nacl.box. |
| Files | AES-256-GCM with a random key for each delivery, sent sealed with nacl.box. When a file arrives, its SHA-256 fingerprint is checked. |
| 1:1 calls | DTLS-SRTP, WebRTC’s mandatory encryption, directly between the two browsers. |
| Group calls | Every audio and video frame is encrypted in your browser with 256-bit AES-GCM before it reaches our media server, using a group key that server doesn’t have. If your browser can’t encrypt, it won’t let you join. |
| Private channels | secretbox (XSalsa20-Poly1305) with a key that only travels in the invite link. |
.rcbak backups and sync | Sealed for you alone, with a key derived from your 12-word key. |
| Push notifications | Encrypted all the way to your browser (RFC 8291). They don’t include the sender or the text anyway. |
| Your 12-word key, with a PIN | PBKDF2-SHA256 with 600,000 iterations and 256-bit AES-GCM. The PIN only encrypts the key, not your messages. |
2. Your identity and your keys
Your account is a 12-word key (using the BIP39 standard) generated in your browser. Your keys and your Chat ID, which is their public part, are derived from it. Your 12-word key and your private keys are never sent to our servers: to prove it’s you, your browser answers a challenge with your key, without revealing it.
They only leave your device if you copy or download them. The text file you can download with your key isn’t encrypted: keep it the way you’d keep your house key. If you forget your PIN, you can sign in with your 12-word key; if you lose the key, we can’t recover your account, because we don’t have it.
3. What our server can and can’t see
Our server can’t see:
- The content of your 1:1 and group messages.
- Your files, backups and sync envelopes.
- The audio and video of your calls.
- The content of private channels.
- The content of your push notifications.
- Your 12-word key or your private keys.
But it does see:
- Your Chat ID and IP address while you’re connected.
- Who you connect with, and who calls whom and when, although it doesn’t store this.
- The sender, recipients, time and size of envelopes and files waiting for someone, for 7 days at most.
- Your contacts and group mates, to show who’s online, only in memory.
- In group calls, who takes part, under what name and from which IP address, only in memory.
- Public channels, and the basic details of private ones (owner, authors, dates and sizes).
- What you look up in the market features and the URLs you request, which stay in the logs for about 15 days along with your IP address.
The details, with retention periods, are in the Privacy Policy.
4. Verifying your contacts
To make sure you’re talking to who you think you are, compare your safety number: 60 digits in 12 groups of 5, plus 6 emojis, calculated from your two Chat IDs and identical on both devices. You can compare it in person or over another trusted channel, or scan the other person’s QR code with your camera; if it doesn’t match, the app warns you of possible impersonation. It all happens on your device, without going through the server, and the “verified” mark is stored only on that device.
5. Our infrastructure
On our servers we apply these measures:
- Encrypted connections with TLS 1.2 and 1.3 (older versions are disabled) and HSTS, so your browser always uses HTTPS.
- A strict content security policy (CSP): the app only loads code from our own domain, with no third-party scripts, and it can’t load images or make requests to other domains; only WebRTC connections, such as those to STUN servers, fall outside that policy.
- Security headers that stop other websites from embedding the app and restrict the camera, microphone and screen sharing to our own website.
- Isolated services: the app’s services run under a user without administrator privileges and inside a restricted system environment (sandbox), and their data is stored with restricted access permissions.
- Anti-abuse limits per IP address and per Chat ID on connections, requests and upload sizes, and safeguards so our link previews can’t be used to reach internal networks.
- The Chat ID key challenge: the relay, the group call server, channels and statistics ask you to prove with your key that you control your Chat ID. That way, without your key, nobody can impersonate you to our servers to receive what’s meant for you, call in your name or kick you out of a call.
- Automatic security updates for the server’s operating system.
- Received files are handled with safe types, so a file can’t open as if it were a page of the app, and with size limits.
6. Wallets and the Terminal
RadarCrypto doesn’t hold funds or have your wallet’s keys. To show your balance, the app only reads your public address and doesn’t sign anything. In the Terminal, our server requests the transaction from Jupiter and hands it to you unsigned; your wallet (Phantom or Solflare) signs it and sends it to the network, and shows you first what you’re about to sign.
- Always check what you sign in your wallet: the token, the amounts and the fees. If something doesn’t add up, cancel.
- Priority fees are capped at 0.001 SOL per trade. RadarCrypto doesn’t add any fee, but the network and, where applicable, the market or your wallet may charge their own.
- Before trading, you confirm that you understand the risk, and if the price impact exceeds 15%, the app asks you to tap twice.
- We will never ask for your seed phrase or private key. Don’t type them into RadarCrypto or any chat, and don’t use a wallet’s seed phrase as your RadarCrypto key.
The risks of trading memecoins are explained in the Risk Disclosure.
7. What’s up to you
- Keep your 12-word key offline, for example on paper in a safe place. Don’t keep it in screenshots, in the cloud or in chats.
- Turn on the PIN on every device where you use RadarCrypto.
- Verify your important contacts with the safety number or the QR code.
- Be wary of anyone claiming to be RadarCrypto. We will never message you to ask for your key, your PIN or your seed phrase. Bot notices arrive as “Radarcrypto Bot,” and the app flags as “Aviso falso” (“Fake notice”) any that claim to come from it but don’t.
- Share your Chat ID only with people you want to be able to message you.
- Keep your browser and operating system up to date.
- Protect your device with a screen lock, and don’t install extensions you don’t trust.
8. Limits you should know about
No system is 100% secure, and we’d rather you know the limits of ours:
- Your device: if it’s compromised (malware, an extension or someone with access to your browser), encryption can’t protect you, because messages are stored unencrypted on the device.
- What others do: whoever receives your messages can take screenshots, copy them or forward them. Disappearing messages are deleted on each device, but they don’t prevent that.
- Metadata: our server sees who communicates with whom, when and from which IP address, and your contact can see your IP address over a direct connection.
- Public channels: they’re public. Anyone can read them, including our server.
- Direct connections: they’re negotiated through our server, and for now the app doesn’t check those connections’ fingerprints. What’s sealed with
nacl.box, such as the text of your messages or your file keys, stays protected even if the server behaved maliciously; but what travels only over that connection (your profile, reactions, edits or receipts) and 1:1 calls depend on the server not tampering with it. The safety number verifies your Chat IDs, not that connection. - Fixed keys in 1:1 chats: your 1:1 messages are always encrypted with your Chat IDs’ keys, so anyone who gets your 12-word key could decrypt any of your messages they had captured earlier.
- Group calls: the key is held by the members and also by invitees who haven’t accepted yet, and it changes when someone leaves the group or is removed.
9. Reporting a vulnerability
If you think you’ve found a security flaw in RadarCrypto, write to us at info@radarcrypto.fun with a description, the steps to reproduce it and, if you can, its possible impact.
Rules
- Don’t run denial-of-service attacks or tests that degrade the service for others.
- Don’t access, modify or delete other people’s data. If you come across it by accident, stop, don’t keep it and let us know.
- Use your own test accounts.
- No social engineering, phishing or spam against anyone.
- Give us reasonable time to fix it before making it public.
Safe harbor
If you research in good faith and within these rules, we’ll consider your research authorized and won’t take legal action against you for it. This commitment is ours and doesn’t bind third parties, such as our providers.
What to expect
We’ll try to confirm we’ve received your report within a few days and keep you posted on the fix. We don’t have a bug bounty program but, if you like, we can thank you publicly.
Our security contact details are also available at radarcrypto.chat/.well-known/security.txt.