Media and disappearing messages

Since rChat 2.0.0 (protocol v3) the iOS app sends photos without their metadata by default, can send any file, saves copies to the phone when you choose, and can make a conversation’s messages disappear.

Sending a photo

The attach sheet offers three choices: Photo (the default), Send as file and File.

• Photo sends a smaller copy: at most 1600 pixels on the long side, about 150 KB, as HEIC (or JPEG when HEIC is not available). All metadata is removed: location (GPS), camera details, EXIF, TIFF, IPTC and XMP data, maker notes and dates. The picture is turned the right way up and its colours converted to sRGB, so nothing depends on the removed data.
• Send as file sends the original bytes and the original file name. Before it does, rChat warns: “This sends the original, including any location and camera details in the file.”
• File opens the system document picker and sends any file, up to just under 4 MiB (4 MiB − 128 KiB). A larger file is refused before anything is sent.

Every photo, file and voice message is end-to-end encrypted and padded like any other message. Photos, files and voice messages are larger than one steady traffic packet, so they are always sent outside that stream; the attach sheet says so when steady traffic is on.

Voice messages

Voice messages are recorded as AAC in an MPEG-4 audio file (.m4a), 44.1 kHz mono at a fixed 64 kbps, up to 60 seconds. Older voice messages still play.

Receiving files

• A received file is stored encrypted on the phone like other media and excluded from backups.
• rChat never opens a file by itself and never previews one automatically; images are the exception, shown through the app’s checked image decoder. Tap the file to open it through the system share sheet.
• File names are cleaned on both phones: path separators and look-alike characters, control characters and invisible formatting characters (including right-to-left overrides) become _, leading dots are removed, and Windows device names such as CON get a _ in front. The file type the sender declared is only a hint and never decides how the file opens.

Saving to the phone

• Save to Photos is in the menu of any photo, sent or received (touch and hold it). rChat asks only for permission to add photos, so it can never read your photo library.
• Save to Files and Share… are in the menu of files and voice messages. rChat writes a temporary copy under the cleaned name for the share sheet and deletes it when the sheet closes.
• The first time you save in a session, rChat says: “Saved copies leave rChat’s encrypted storage. They follow your Photos and iCloud settings, and a disappearing-message timer won’t delete them.” You can turn this off in Settings with Warn before saving copies. In a chat with a disappearing-message timer, the notice is shown every time.

Disappearing messages

Either person can set a chat’s timer: Off, 5 minutes, 1 hour, 1 day, 1 week or 4 weeks.

• The change is shared. It travels inside the conversation, end-to-end encrypted, and both chats show a line such as “You set messages to disappear after 1 day” or “Maya turned off disappearing messages”. If you both change it at almost the same moment, the later change wins on both phones.
• Each message keeps its own timer. A message carries the timer that was set when it was sent, and the other phone honours that, whatever its own setting is now.
• When the countdown starts. For your own messages, when the relay accepts them. For messages you receive, when you first see them in an open chat; if you never open the chat, 7 days after they arrived.
• What is deleted. When the timer runs out, the message, its photo or file, and its notification are deleted from the phone, and the chat list updates. rChat deletes database rows with SQLite’s secure delete and then truncates its write-ahead log.
• When. Each phone deletes messages while rChat is open, when it starts, and during its background checks.
• First messages in requests carry no timer, so rChat does not let you attach one while a timer is on.

What disappearing messages don’t do

• The other person can still take a screenshot, photograph the screen, or save a photo or file.
• Copies saved to Photos or Files are not deleted.
• A message is deleted from a phone only when that phone next runs rChat.
• Copies waiting at the relay for a contact who is offline are encrypted, and the relay deletes them within 72 hours.
• iOS flash storage may keep deleted data, still encrypted under the file’s key, until it is reused.
• Moving the phone’s clock back delays deletion.
• There is no “delete for everyone” for single messages, and no screenshot detection (it is unreliable on iOS and would give false assurance).