Dewrito.net is a community-run Matrix homeserver and Fluxer instance. We are volunteers, not a company, and we keep only what is needed to run the services and keep them safe. Questions go to support@dewrito.net.
1. What we store
Account data
- Your username, a hashed password, and the email address you registered with. The email is used for verification, password resets and, rarely, to contact you about your account.
- Session records: the devices you are signed in on, their IP addresses and user agents, and when they were last seen. You can view and remove sessions in your client's settings.
Content
- Matrix: messages, files, reactions, room state and membership for every room you take part in. In encrypted rooms we store the encrypted payload and cannot read it. In unencrypted rooms, and for all metadata (who, when, which room), we can.
- Fluxer: messages, uploads, voice and video session metadata, server and role membership. Fluxer does not encrypt messages end to end.
- Uploaded media is stored on our servers until you or a room moderator deletes it, or we remove it for a policy reason.
Technical logs
Our web servers and homeserver write access logs containing IP addresses, timestamps and requested URLs. We keep them for a short period for debugging and abuse handling, then delete them.
2. Federation
Matrix is federated. When you join a room that has members on other homeservers, your messages, profile name, avatar and Matrix ID are sent to those servers so their users can see them. Those copies are governed by the other servers' policies, and we cannot delete them. The same applies to direct messages with users elsewhere. Fluxer does not federate; its data stays on our hardware.
3. Services we rely on
- Hosting and management: our Matrix homeserver runs on infrastructure managed with etke.cc tooling. Their staff may access server data when we ask for support.
- Voice and video calls on Matrix go through a LiveKit service we host at matrix.dewrito.net. Call media is relayed, not recorded.
- Identity server: clients are pointed at vector.im for contact discovery. It only receives data if you explicitly choose to share your email or phone number in your client settings.
- Community directory: listings you submit on the Boosted Communities page are stored in a Supabase database and are public. Boost payments are recorded on the public Stellar ledger, which is permanent and visible to anyone.
- Donations: handled by Ko-fi and NOWPayments under their own policies. We receive the amount and whatever name or message you choose to attach, not your payment details.
- This website: loads fonts from Google Fonts, the Ko-fi widget on the home page, and Google reCAPTCHA on the directory page. These providers see your IP address and browser details when those resources load. The site sets no cookies of its own. If we enable usage analytics, we will use a cookie-free, self-hosted tool and name it here.
4. How we use the data
To run the services you signed up for, to keep them secure, to enforce the Terms of Service, to respond to abuse reports, and to meet legal obligations. We do not sell data, run advertising, or profile users.
5. Moderation
Volunteer moderators can read unencrypted rooms they are in, see membership of any room on our server, and view reports you submit. A moderation bot (Draupnir) acts on bans and redactions. Details are on the moderation page.
6. Retention and deletion
- Deactivating your account (in your client's settings, or by emailing support) removes your profile, ends all sessions and stops the email being used. Messages you sent remain in rooms unless you also ask for them to be erased; most Matrix clients offer this at deactivation.
- Erased messages are redacted on our server and a redaction is sent to federated servers, which usually honour it but are not obliged to.
- You can request a copy of your data, or deletion, by emailing support@dewrito.net from your registered address. We answer within 30 days.
7. Your rights
If you are in the EU, UK or another jurisdiction with data-protection law, you have the right to access, correct, export and erase your data, and to object to processing. The section above is how to exercise them. You can also complain to your local supervisory authority.
8. Age
Our services are for adults. We do not knowingly keep accounts for anyone under 18 and will remove them when identified.
9. Changes
We will post changes here and update the date at the top. Significant changes are announced on the status page and in the Dewrito space.