How your data is protected

When you send a one-to-one message, the text is scrambled inside your browser before it ever leaves your device, using a key that only you and the person you’re messaging can put together. What sits in our database is unreadable scrambled text. We can’t open it, and neither can anyone who somehow got a copy of the database.

What is not hidden is the wrapper around the message: who sent it, who received it, when, whether it was read, edited, or had a file attached. Files and photos you attach are also stored as-is, not encrypted — so treat attachments as “stored on our servers” and don’t send anything you’d regret leaving there.

Group posts, comments and likes are not encrypted either. A group is a shared space, so anything posted there is stored in plain text and visible to that group.

Floater asks for a username and a password. That’s it. No email address, no phone number, no contacts, no address book. We can’t leak what we never collected, and we can’t sell it either.

The trade-off is real and worth saying plainly: because there’s no email or phone on file, there is no “forgot password” link and no way for us to prove an account is yours. If you lose your password, that account is gone. Write it down somewhere only you can reach.

Your encryption key is itself locked with a 4-digit PIN you choose. The PIN never leaves your device — it’s used to unwrap your key in your browser, and the unwrapped key is held in memory only. Close the tab or reload, and it’s wiped; you’ll be asked for the PIN again next time.

Being honest about the limits: four digits is a short code. It protects your stored key from being read straight out of the database, but it is not a strong password, and it can’t protect you from someone who is already signed in as you on your own device. Lock your phone, sign out on shared computers, and don’t reuse a PIN someone can guess.

On sign-out you can choose to wipe your messages instead of leaving them behind. If you want them back later, Floater can stash an encrypted backup that only your PIN can restore — so signing back in and entering the right PIN brings the conversations forward.

If you change or regenerate your PIN, a new key is created and older material that was locked with the previous PIN can no longer be unwrapped. That’s intentional — nobody, including us, keeps a spare copy — but it does mean a forgotten or reset PIN is permanent for anything protected by it.

Any direct message can be sent with a self-destruct timer, anywhere from 30 seconds to a month, with a live countdown in the thread. When the timer runs out the message is removed from the conversation for both people, along with anything attached to it.

One thing a timer cannot do is control the other person’s screen. Someone can take a screenshot, photograph the screen, or simply remember what you wrote. Disappearing messages reduce what’s left lying around; they don’t take words back.

Floater has an admin account used to keep the place running — it can see accounts, activity records and delivery details, and can suspend or remove accounts that break the rules. It cannot read the contents of your encrypted direct messages, because the keys aren’t ours to hold. It can see unencrypted material such as group posts and attachments.

We won’t claim Floater is unbreakable — no service honestly can. What we can say is what we built: messages encrypted before they leave your device, per-person access rules on every record, keys locked behind a code we never receive, and no personal details collected at signup.

The rest is on you: keep your password and PIN private, don’t reuse them anywhere else, and remember there is no recovery path if they’re lost. If something looks wrong with your account, change your password from your profile straight away.