Short version
Nothing you post in Waystation is private from the operator of this Waystation server or from the people who run the Spaces servers. Do not post personal information, or anything you need to stay private.
What the operator of this Waystation server can see
Your browser talks only to the Waystation server, and the Waystation server makes every Spaces call for you. To do that it holds your OAuth session (tokens and signing key). Sessions are encrypted in Waystation's database, but the key that decrypts them is on the same server. The operator of this Waystation server can therefore read every space that a signed-in user belongs to. Messages and files also pass through the server in plain form on their way to your browser.
What Waystation stores
- Your signed-in session, encrypted, until you sign out or it expires.
- A directory of spaces created through Waystation: space names, owners, and the accounts (DID and handle) added as members.
- The spaces you opened from an invite link, so they stay in your sidebar.
- A server log with sign-ins, spaces created, members added or removed, and the type and size of each file posted, identified by account and space. The log does not contain message text.
Messages are not written to Waystation's database. Waystation keeps them in memory while a space is open and reads them again from the Spaces servers when needed.
Your browser keeps a session cookie and, if you pick one, your theme choice.
Who else can read your posts
- Everyone who is a member of the space.
- The people who run the Spaces sandbox and the servers that host members' accounts. Spaces content is not end-to-end encrypted.
Permanence
Your messages, reactions and files are records in your own account's repository. Waystation has no edit or delete. Being removed from a space does not erase what you posted there, and the space being deleted does not remove members' records.
Status
Waystation is alpha software running against the Spaces alpha sandbox. This page describes how this version works and will change as Spaces does. See About for who runs it.