Not sketchy, not creepy. Secure and confidential.
Said on the homepage: “Built in Europe under some of the strictest data protection laws in the world… We don’t sell your data and we never will.” Community members were told the product was “Secure and Confidential.”
Found: the Stoat privacy supplement stores your messages and attachments, your date of birth, your IP address, and a short device description for every session. Login, register, and password-reset flows send behavior data (IP, dwell time, mouse movement) to hCaptcha / Intuition Machines, Inc., a Delaware US corporation. Voice and video “may also be processed or stored on servers located in other countries.” GitHub discussion #1050: a user wrote that everything is stored plaintext in the database. A May 2024 team write-up on the licensing fight said they had already stripped privacy-oriented branding because they still do not have E2EE. Discussion #597, October 2025: E2EE starts “after we release video chats,” still no ETA. PrivacyTools: “it is not end-to-end encrypted… do not treat it as a privacy messenger.”