Account Security

Choosing a strong password

Use a strong, unique password combining uppercase letters, lowercase letters, numbers, and symbols. Never share your password with anyone.

Which security features should I enable?

Turn on every security feature available in your account settings. The two that matter most are passkeys and two-factor authentication, because together they mean a stolen password is not enough to get into your account.

Passkeys & Two-Factor Authentication

What are passkeys?

A passkey replaces your password with a biometric or device-unlock check, so there is no secret to steal, reuse, or phish. Set one up in Settings.

What does two-factor authentication add?

Two-factor authentication (2FA) asks for a second, time-limited code from your authenticator app after your password. It is a separate layer from passkeys: if passkeys are unavailable, 2FA still protects the account.

What if I lose access to my 2FA codes?

Use one of the backup codes you saved at setup. Each one works a single time. If you have used every backup code and lost the device, reach out to a moderator in the chat for help signing back in.

Sign-in Sessions & Devices

How do I review where my account is signed in?

Under Settings → Security you can review every active session — the device, browser or operating system, IP address, approximate location, and last activity.

How do I sign a device out remotely?

Use Sign out on any session you don’t recognize. That immediately ends that device’s access to your account; it cannot get back in until it signs in again.

Why did I get a new sign-in alert?

We alert you when your account signs in from a device or approximate location it hasn’t been used from before. If it wasn’t you, sign that session out, change your password, and review your other sessions.

How long are session records kept?

We keep only your most recent fifty session records. Older ones are removed automatically as new activity is added.

Phishing & Scams

Never paste code from strangers into the browser console

Legitimate services will never ask you to run developer commands in your browser console. This is the most common way accounts are stolen, because the commands are often disguised as a “fix” or a “verification step.”

Someone claiming to be staff asked me for my password

Report them immediately using the report flow. Staff will never ask for your password, your 2FA code, or your backup codes.

Data Protection

Is my data encrypted?

Your messages and personal information are encrypted in transit using industry-standard TLS. We follow security best practices to protect stored data.

What do you do with my data?

Collection, storage, and retention are covered in detail in our Privacy Policy, including what moderation screening does and does not keep.

Online Status & Privacy

Who can see my online status?

Your real-time online status (green dot) is only shown to users you mutually follow. If you want to control who can see when you’re online, adjust who you follow. Unfollowing a user immediately stops them from seeing your status.

How do I hide my online status from everyone?

Turn on Hide active status under Settings → Privacy. This hides your presence from everyone at once — and while it’s on, you won’t see anyone else’s online status either.

Blocking

What happens when I block someone?

They can no longer follow you or message you, and you no longer see their messages or online status. Blocking is a direct privacy and safety tool.

Does the person know they’ve been blocked?

No. Blocking is private — the other user is not notified.

How do I unblock someone?

Blocked users are listed under Settings → Privacy, where you can unblock at any time.

Profile Pictures & Media Security

What happens to my photo’s metadata?

Metadata is stripped. When you upload a profile picture we remove embedded metadata (EXIF, IPTC, and XMP) before storage, so hidden data such as GPS location and camera information is not exposed to other users.

How are images and messages screened?

Automated moderation. Profile pictures are screened by an automated system to block inappropriate or illegal imagery before it is published. Messages are screened in real time for toxic content such as profanity, hate speech, and threats — a flagged message is blocked and never delivered. This does not store your chat history beyond the blocked message, for abuse prevention only.

How are uploads secured?

Image uploads use signed, encrypted connections and are validated for type and size. We never ask for more access to your device than the image you choose. Supported formats include JPG, PNG, GIF, and HEIC (HEIC is converted automatically).

What about animated GIF avatars?

GIF avatars are chosen from the GIF picker — which applies its own content screening — and are saved by URL. GIF files are never uploaded directly.

Reporting Issues

How do I report a security vulnerability?

Contact a moderator in the chat and describe the issue. We take all reports seriously and will respond promptly.

What should I include in a report?

The account or message involved, what happened, and roughly when. For an urgent account-compromise situation, tell a moderator straight away.

Best Practices

• Log out from shared or public devices
• Keep your email account secure
• Be cautious of unsolicited links or downloads
• Review your account activity regularly
• Review your active sign-in sessions under Settings → Security and sign out anything unfamiliar
• Use a password manager for strong, unique passwords
• Set up a passkey and keep your backup codes somewhere safe
• Manage who sees your online status by controlling who you follow
• Block any user who makes you feel unsafe — blocking is private and immediate
• Never run commands someone pasted into your browser console