Terms & Conditions

These terms apply when you install or use the application, or connect to a Benda relay. If you do not accept them, do not use the service.

Benda is a relay for encrypted messages, and a client for reading them. It is not an identity provider, not a storage service, and not a telecommunications provider.

The relay carries ciphertext it cannot read. We cannot decrypt your traffic, recover your data, reset your credentials, or identify who you are talking to. That is a property of the design, not a policy we could change on request.

Benda is a non-profit project. There are no fees, no subscriptions and no paid tiers; voluntary donations fund the relay.

You confirm you may lawfully use strong encryption where you are. You are responsible for complying with the laws that apply to you.

Security here happens on your device, so the following are yours to keep:

• Your PIN. It is the only thing that unlocks your key. There is no reset, no recovery phrase, and no server-side copy.
• Your device. Benda cannot protect you from a compromised handset, a hostile keyboard, or someone reading your screen.
• What you install. Install Benda only from an official source. A modified build is not Benda, and we cannot vouch for what it does with your messages.

Do not attack the service or use it to attack others. Specifically: no denial-of-service against relays, no attempts to corrupt or exploit the protocol parsers, and no automated mass account or room creation.

Relays apply rate limits and block abusive addresses in order to stay available for everyone else. See Privacy 05 for what is kept when that happens.

Mathematics is not subject to appeal. If you lose your key or your PIN, your messages become undecryptable and stay that way. There is no master key, no escrow, and no override that we or anyone else can use.

Message confidentiality

Encrypted end to end, X25519-XSalsa20-Poly1305

Plaintext recovery by us

Not possible — no key is held

Data available to disclose

Ciphertext and timestamps, nothing readable

Account recovery

None — losing the key loses the data

Service availability

Best effort. No uptime guarantee

The software and relays are provided "as is" and "as available", without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

We do not warrant that the service will be uninterrupted, that messages will always be delivered, or that traffic analysis cannot reveal that you are using it. No uptime is promised.

To the extent permitted by law, the authors, maintainers and relay operators are not liable for any claim or damages arising from the software or your use of it, whether in contract, tort, or otherwise.

These terms may change. When they do, the effective date at the top of this page changes with them and the new version applies from that date. Continuing to use the service after a change means you accept it.

Questions about these terms, or security reports, go to TODO@TODO.