Closed by design. Honest about the rest.

The mathematics

Direct threads

A direct message exists between exactly two files. The database refuses every read that does not come from the sender or the recipient, and either of them may delete a line at any time.

Place threads

Each place carries one thread, opened with the place itself. It is readable by any signed-in member, so it is meant for the venue and the hour, nothing more.

Presence

Location sharing is opt-in and unencrypted by design, because members need to read it at a glance. You choose the label, coordinates are rounded to roughly a city district, an expiry is set by you, and switching it off deletes the row.

Access control

Row-level rules in the database refuse every read of member data from a lapsed or withdrawn account. Membership standing can only be changed by the club, never by the member.

Identity

Inside the club you are your ZC VIP ID. Your legal name is never required on a shared list. Your email address is held by the authentication system so you can sign in.

Referrals

Each member may issue three referral codes, ever. A code records who issued it and who claimed it, so every file in the circle is attached to the member who introduced it.

The limits, stated plainly

Any club that tells you a web application is unbreakable is either careless or lying. Here is the truthful version.

This is a website, so the code is served by us

Every line of this application is delivered from our servers on each visit. Anyone who could change what we serve could change what it does. This is true of every browser-based product without exception; only an audited native app avoids it. We do not claim otherwise.

We could read a message only by changing the app

A direct thread is closed to everyone but its two members, and a place thread to those signed in. That access is enforced by the database, not by mathematics: as operator we hold the keys to our own infrastructure. Judge us on conduct, not on a slogan.

Messages are stored as written

We no longer run browser encryption on messages, because a shared passphrase was never per-member key exchange and we will not dress it up as one. Threads are closed by access rules; treat anything you write as readable by whoever administers the infrastructure.

Metadata is kept

We can see which files wrote to each other and when, presence rows, and who joined which table. Keep anything you would not want recorded to a face-to-face conversation.

Deletion is final

A deleted message is gone; there is no archive to restore it from, and closing a file removes its correspondence with it. This is not a defect we intend to repair.

The manners

1. 01

   No photography inside a room a member has named. None, at any hour.

2. 02

   Nothing said in the room is attributed outside it. Chatham House rule, absolute.

3. 03

   No press, no publicists, no recording devices.

4. 04

   You are answerable for anyone you refer. Three, ever.

5. 05

   Screenshots of member correspondence are grounds for immediate and permanent removal.