Trust

How are the servers structured?

Pointless Talk runs primarily on Cloudflare’s serverless infrastructure.

Instead of putting every function on a single fixed server, the service divides account management, real-time conversations, file delivery, and data storage among several services.

Data needed to operate the service, such as account information, friendships, and group information, is stored in a database.

Real-time conversations are handled in separate server areas for each chat room, while attachments such as photos and videos are temporarily kept in separate private storage.

Attachment storage is not public. Files are delivered only after checking that the person requesting them has permission to access the conversation.

Pointless Talk does not directly operate a single central server in a particular country.

Where are messages stored?

Pointless Talk uses servers, but aims not to turn them into a permanent store of chat histories.

When a message is sent, the server identifies the devices that should receive it and delivers it to each device.

Once successful storage on users’ devices is confirmed, temporary server copies that are no longer needed for delivery are cleaned up.

Undelivered data is not kept indefinitely either.

Messages and attachments are retained on the server for a maximum of 72 hours.

Pointless Talk’s servers are therefore closer to a temporary stop on the way to delivering messages to the recipient than a place for long-term conversation storage.

Actual chat histories are stored mainly on each user’s devices.

However, information needed to operate the service, such as friendships, group membership, login state, delivery status, and read status, may be retained for different periods than message bodies.

How far does encryption extend?

Communication between Pointless Talk and its servers uses encrypted connections over HTTPS.

In ordinary network conditions, this makes it harder for a third party to simply intercept and read communications between your device and the Pointless Talk server.

When you use a passkey, your private key is not sent to Pointless Talk’s servers.

The server stores only the public authentication information needed to verify login. Biometric information, such as your fingerprints or facial data, is not sent to Pointless Talk’s servers either.

Pointless Talk is not an E2EE messenger.

Messages are not end-to-end encrypted.

As messages pass through the server, Pointless Talk’s server systems can process their contents to deliver them.

We therefore do not claim to offer an E2EE architecture designed to prevent even the service provider from accessing message contents, as Signal does.

Instead, Pointless Talk uses a structure in which servers retain messages only for as long as delivery requires, rather than keeping them as permanent chat histories.

Our current design is closer to “reducing the data the server needs to hold, and the time it needs to hold it” than to “making it impossible for the server to see anything.”

Why are there ads?

Pointless Talk is run as a personal project.

Even a serverless service incurs costs for server execution, databases, file storage, and network usage as its user base grows.

Advertising revenue from Pointless Talk is used to cover the operating costs of Pointless Talk and Pointless.chat.

We do not want to build a system that analyzes messages for advertising or uses conversations for ad targeting.

The current mobile apps do not pass the following Pointless Talk data as ad-targeting information.

• Message contents
• Photo or video contents
• Usernames or nicknames
• Search terms
• Friendships
• Chat room or message identifiers
• Login information

Ads use non-personalized settings.

However, non-personalized ads do not mean that no information is sent to the ad provider.

In providing their services, ad providers may process IP addresses, approximate location, device and app information, ad impressions and interactions, and diagnostic information.

We also provide privacy choice screens as required in applicable regions.

Analytics and error diagnostics

Pointless Talk may use Firebase Analytics and Crashlytics to improve the service and identify errors.

We restrict the analytics information that Pointless Talk records directly so that it does not include message contents, usernames, nicknames, account, chat room or message identifiers, search terms, or login information.

We also do not directly link Pointless Talk accounts to Firebase user identifiers.

However, Firebase itself may process diagnostic data such as app installation information, device and operating system information, app versions, and crash information.

We therefore do not describe Pointless Talk as “a service that collects no data.”

The goal is not the complete absence of data collection, but reducing the collection of unnecessary data.

What Pointless Talk cannot protect against

A compromised device
Messages are stored on users’ devices, so local chat histories may be exposed if malware or an attacker takes control of the device itself.

Compromised servers or service infrastructure
Because the service is not E2EE, we cannot completely eliminate the possibility of messages being exposed as they pass through the server.

A compromised external service provider
Pointless Talk relies on external infrastructure and platforms such as Cloudflare, Google, and Apple. We cannot defend those services themselves against compromise.

Metadata such as connection information
Not retaining message bodies for long periods does not mean that information such as IP addresses, connection times, or traffic volume does not exist.

Recipients saving conversations themselves
Once a message reaches the recipient’s device, we cannot technically prevent them from taking screenshots or preserving the contents in other ways.