Matrix
- The policy says your content is not used for AI training.
- The policy rules out using your data for targeted ads.
- Data is shared with partners and affiliates; you can opt out.
- The policy describes staff access for safety and legal checks.
A federated chat server: your messages copy to other servers, deletion is limited, and they can cut access without notice.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, messages and files, plus device IDs, IPs, and session logs.
Read the exact line
Privacy policy
“When you access the Service, we record the device identifier, the IP address it used to connect, user agent, and the time at which it last connected to the service.”
Training
They use data to run chat, security, and improvements; they say they do not profile you.
Read the exact line
Privacy policy
“The information we collect is purely for the purpose of providing your communication service via Matrix. We do not profile users or their data on the Service.”
Sharing
Other homeservers, bridges, bots, hosts, and sometimes Element staff can see unencrypted data.
Read the exact line
Privacy policy
“If these participants are on remote homeservers, your username, display name, messages and files may be replicated across each participating homeserver.”
Kept
Forget-your-account can wipe your copy in 30 days, but usernames and others’ copies can remain.
Read the exact line
Privacy policy
“Any messages or files that were only accessible by your account will be deleted from our servers within 30 days.”
Controls
You can manage devices in a Matrix client and request a data copy or account forget.
Read the exact line
Privacy policy
“You can access all the information we collect about you by using any compatible Matrix client and managing your User Settings.”
Fine print
They can block you without notice; the site is as-is; you them; English courts apply.
Read the exact line
Terms of service
“We may block, restrict, disable, suspend or terminate your access to all or part of the Service at any time in our sole discretion, without prior notice or to you.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Deactivate and choose to forget messages
A Matrix client such as Element: deactivate account and select the option to forget your messages
Request a copy of your data
Send a request over Matrix to [email protected]
Review and remove devices
User Settings in a Matrix client such as Element
Avoid bridged or world-readable rooms if you need privacy
Check each room’s history visibility and bridging before you post
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
When you chat, copies of your messages can live on many other people’s servers around the world.
Read the exact line
Privacy policy
“If these participants are on remote homeservers, your username, display name, messages and files may be replicated across each participating homeserver.”
For example, a message in a public room can be stored on servers you never signed up for.
Even after you ask to be forgotten, your username can still show up in rooms you joined.
Read the exact line
Privacy policy
“this means that your username will continue to be publicly associated with rooms in which you have participated, even after we have processed your request to be forgotten.”
For example, leaving and deleting your account may still leave your handle on a room’s member history.
They can shut you out whenever they want and do not have to warn you first.
Read the exact line
Terms of service
“We may block, restrict, disable, suspend or terminate your access to all or part of the Service at any time in our sole discretion, without prior notice or to you.”
For example, you could lose website or shop access overnight with no email.
If someone sues them because of what you did on the site, you may have to cover their costs.
Read the exact line
Terms of service
“You agree to protect, , and hold the Foundation and its guardians, officers, co-branders, other partners, contractors, and employees harmless from any claims, demands, or legal fees brought by third parties because of your actions on the Website.”
For example, a comment you posted that sparks a lawsuit could leave you paying their lawyers.
Bots and mini-apps in a room can read everything in that room.
Read the exact line
Privacy policy
“Bots and Widgets currently have access to all the messages and files in any room in which they participate, although we are adding a more sophisticated access control system.”
For example, adding a weather bot could let that bot see private chat files in the same room.
If they change the privacy rules, keeping using the service counts as saying yes.
Read the exact line
Privacy policy
“By continuing to use the Service, you will implicitly accept the changes we make.”
For example, a new logging practice could apply just because you kept logging in.
Private-to-you content can be wiped from their servers within a month after you ask to be forgotten.
Read the exact line
Privacy policy
“Any messages or files that were only accessible by your account will be deleted from our servers within 30 days.”
For example, notes only you could open should be gone from matrix.org within 30 days after deactivation.
They say they are not building ad or marketing profiles from your chats.
Read the exact line
Privacy policy
“The information we collect is purely for the purpose of providing your communication service via Matrix. We do not profile users or their data on the Service.”
For example, they claim they will not use your rooms to target ads at you.
They say the service is not for people under 18.
Read the exact line
Privacy policy
“We never knowingly collect or maintain information in the Service from those we know are under 18, and no part of the Service is structured to attract anyone under 18.”
For example, a 16-year-old is told not to create a matrix.org account.
They give a way to report security bugs.
Read the exact line
Privacy policy
“If you have discovered a security concern, please email us at [email protected].”
For example, a researcher can email that address instead of posting an exploit publicly.
Words to know
Legal words from the lines above, in plain English.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
How we got here · grade A+ · score 73/100 · 15 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect account info, your messages and files, plus device IDs, IPs, user agents, session times, and some analytics.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
They say they do not profile users and do not describe using chats to train AI models.
Can employees or contractors read your conversations, and when?
Staff access is limited to roles that keep the service healthy; they also share data for law, security, harm, or emergencies.
Are you profiled or tracked for advertising?
They say they do not profile users; website analytics are cookie-free Plausible and aggregate PostHog for performance.
Do they sell or share your data, and can you opt out?
They share with suppliers and, by design, federated servers, bridges, bots, and widgets; you cannot opt out except by not using those rooms.
What rights do they take over what you type and what the AI makes?
On the website you keep IP but grant a worldwide royalty-free license to use your posts as part of running the site under CC BY-SA.
How long do they keep your data after you delete it, and can you delete it in the app?
You can deactivate and choose to forget messages in a Matrix client; copies only you could see are deleted within 30 days, but usernames and others’ copies can remain.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They say they do not profile users or their data on the service.
Do they commit to basic security, and have they leaked data?
They describe hashing, HTTPS, 2FA, access limits, and a security@ email for vulnerability reports.
Is there a real age gate, and are teens protected?
They say not to use the service if you are under 18 and they do not knowingly collect from under-18s; no age-proofing is described.
Will they tell you when the rules change, and is the policy specific?
Policies are dated. Privacy says continued use accepts changes; they will notify for significant data-processing changes. Terms give 14 days for important changes.
Can they close your account without warning, and can you get your data out first?
Website terms let them block, suspend, or terminate access at any time without prior notice.
If something goes wrong, who pays?
The website is as-is with broad disclaimers, and you must indemnify the Foundation for claims from your use.
Do subscriptions renew on their own, and can you get a refund?
Donations are not refundable once processed; shop orders are charged at purchase via a third party. Paid-plan auto-renew details are thin.
The privacy policy is 4,915 words at a fairly hard level (Flesch reading ease 51.7); the terms are 2,259 words at a fairly hard level.
