AryanHubAryanHub
Safety & Security at AryanHub
How AryanHub protects your account, your chats and your calls — written plainly, including the one thing it does not do.
In one paragraph. Every connection is encrypted. In the database, a message can be read only by the members of its chat — a rule the database enforces itself. Passwords are stored only as salted hashes. You get an in-app alert when your account is signed in on a new device, and you can log other devices out. You decide who sees your last seen and your profile photo, and you can block anyone. Real people moderate reports. AryanHub is not end-to-end encrypted: its servers can technically read messages, which is what makes search, notifications, Alexa and moderation work.
Encrypted connections
The site, the API, media and call setup all travel over HTTPS (TLS). AryanHub’s services sit behind Cloudflare and Vercel, which terminate those connections with current TLS versions and certificates.
Access rules in the database
AryanHub runs on PostgreSQL with Row-Level Security. Every read of the messages table is checked by the database against the membership of that chat: if you are not a member, the rows do not exist for you. The same applies to the list of members, reactions and read receipts. This holds even for a request that bypasses the app and talks to the API directly.
Calls
Voice and video calls use WebRTC. The audio and video stream goes directly between the two devices whenever the network allows, and through a relay (TURN) when it does not — in both cases the stream is encrypted with DTLS-SRTP, which is built into WebRTC. AryanHub’s servers only exchange the signalling needed to start and end a call. Group calls connect participants to each other the same way.
Your account
- Passwords are handled by a dedicated authentication server and stored only as salted bcrypt hashes — never in plain text.
- Login alerts: a sign-in from a device AryanHub has not seen before sends you a message in the app, and the device is added to your known-devices list.
- Active sessions: see every session, log out the ones you do not recognise, and set old sessions to end automatically after a period of inactivity (Settings → Privacy and Security → Active Sessions).
Privacy controls
- Last seen & online: everybody, my contacts, or nobody — with exceptions in either direction. The choice is applied on the server before a row leaves it, so it holds everywhere: chat list, chat header, group member lists.
- Profile photo: choose who can see it.
- Blocking: a blocked person cannot message you or see your presence.
- Notes and Stories: show them to your contacts or only to close friends.
- Groups: admins can restrict forwarding and saving of content, hide the history from newcomers, limit who can post, and revoke invite links at any time.
Moderation
Reports go to real people. AryanHub has moderators and admins — they carry a staff badge next to their names and are listed in Settings → Developers — with tools to restrict or ban accounts. Staff see a message only when it is reported; AryanHub does not scan chats for moderation. (What Alexa reads, and where, is described in the table below.)
Guest (temporary) chats
A guest who opens your /tc link gets a temporary account that can only talk to you. Guests cannot see any other chat, and a guest session that stays away for an hour is ended and cleaned up automatically.
What AryanHub can and cannot see
| Who | Can see |
|---|---|
| Members of a chat | The messages, media, reactions and read status of that chat. |
| Other users | Nothing from chats they are not in. Your presence and photo only as your settings allow. |
| Guests | Only the temporary chat they were invited to. |
| Alexa (AI) | The message that calls it and the recent context of that chat, sent to Google’s Gemini API to write the reply — and, in a group where Alexa has been used, the group’s recent messages every few dozen messages to refresh its memory. Never a group it has not been used in, never a private chat between two people. |
| Moderators | A message only when someone reports it. |
| AryanHub’s servers | Messages are stored encrypted in transit and under access rules, but the server itself can technically read them (no end-to-end encryption). |
Where your data lives
The database runs on AryanHub’s own server in Mumbai, India (Oracle Cloud). Photos, videos and files are stored on Cloudflare R2. The app is served by Vercel from its Mumbai region, and traffic passes through Cloudflare. Details of what is stored and for how long: Privacy.
Questions
Is AryanHub safe to use?
AryanHub protects your data with encrypted connections (HTTPS/TLS), database rules that let only the members of a chat read its messages, hashed passwords, login alerts for new devices, a list of your active sessions, privacy controls for your presence and photo, and human moderators you can report to. It is not end-to-end encrypted — see the next question — but your messages are never readable by other users, by guests, or by anyone outside the chat.
Is AryanHub end-to-end encrypted?
No. Messages are encrypted between your device and AryanHub’s servers, and stored under access rules — but AryanHub’s own server can technically read them. That is what makes search, notifications, Alexa and moderation possible. Staff look at content only when it is reported.
Who can read my messages?
Only the members of that chat. The rule is enforced by the database itself (Row-Level Security), not just by the app. Moderators see a message only when someone reports it. Nobody else, including guests in temporary chats, can read your other chats.
Does Alexa read everything?
No. Alexa answers only when a message mentions “alexa” (or you message @alexaai). To answer, it sends that message and the recent messages of that chat to Google’s Gemini API and keeps a memory of that chat. In a group where Alexa has been used, it also refreshes that memory in the background every few dozen messages, reading the group’s recent messages to do so. It never reads a group where it has never been used, and never a private chat between two people. A group admin (or you, in your own Alexa DM) can wipe the memory by telling Alexa to forget — for example “alexa sab bhool ja”.
Are calls private?
Call audio and video go peer to peer between the two devices whenever possible, or through a relay when the network requires it — and are always encrypted (WebRTC uses DTLS-SRTP). AryanHub’s servers only carry the call setup.
What happens when someone signs in to my account from a new device?
You get a message inside AryanHub straight away, and your list of known devices is updated. In Settings → Privacy and Security → Active Sessions you can log the other device out.
How do I report someone?
Open the ⋮ menu on a message, a profile or a story and choose Report. A human moderator reviews it; the team’s moderators and admins are listed in Settings → Developers and carry a staff badge next to their names.
Where is my data stored?
The database runs on a server in Mumbai, India (Oracle Cloud). Photos, videos and files are stored on Cloudflare R2. The app itself is served by Vercel from its Mumbai region, behind Cloudflare.
How do I delete my account?
Message the team inside the app (Settings → Developers lists the moderators and admins, or write to @aryanhub) and ask for deletion — the team removes accounts by hand.
Found a security problem?
Please tell us before telling anyone else: security@aryanhub.in, or message @aryanhub inside the app. Our contact and policy are also published at /.well-known/security.txt. Please don’t test against other people’s accounts or data.