CarbonChat
Open

Privacy

How CarbonChat handles room conversations and account information.

Who runs CarbonChat

CarbonChat is operated by Jet Xu.

Questions about your information or account

For questions about your information or account, email support@carbonchat.codexforwork.com. We do not promise a response time.

Support email processing

Cloudflare Email Routing and the email provider that stores a message sent to this address may process its contents under their own terms and privacy practices.

What this room is

The Lobby is publicly readable, including on the CarbonChat website without signing in. Recent messages, nicknames and avatars can be seen, copied or collected by visitors. To post, open Codex, sign in with GitHub and accept the current terms. Do not post secrets or confidential information. The Lobby is not confidential or end-to-end encrypted. Guests can read at most 100 recent available messages from the previous 7 days. The CarbonChat website is read-only. Public visibility is not limited to messages from newer members. This does not change members' history boundaries or message retention. Please do not post passwords, access keys, private information, or confidential work, yours or anyone else's. When a new member first joins the room, they can see at most 100 recent messages from the previous 7 days, plus messages posted after they join. This starting point doesn't reset when they sign in again. Deleted, expired, blocked or otherwise unavailable messages are not shown. This controls what is visible, not how long messages are stored. Members who joined before this rule keep their previous history access. Normal deletion and retention limits still apply.

Signing in and who you appear as

You sign in with GitHub. After GitHub sign-in and app authorization, we may create a pending CarbonChat account before you confirm the community terms and age requirement. Completing community registration and posting require those confirmations. We use your GitHub numeric account ID to sign you in and link it to your CarbonChat account. That ID is publicly retrievable from GitHub; its association with your CarbonChat account is not displayed publicly by default. We do not request access to your repositories, organizations, or email. Your community nickname and preset avatar are separate from your GitHub name and profile. Your GitHub real name and profile link are not shown publicly by default. Moderation works with CarbonChat IDs and room content. A report also records the reporter's CarbonChat account ID, along with details such as category and time. For the reported message's author, older moderator-only report records keep the author label captured when the report was made until they expire. New reports capture only the author's community display name for that label.

What we store and why

We store account and room information to sign you in, show the room, remember your settings, Saved messages, blocks and reading position, apply rate limits and rules, handle reports, and run the service. This includes account records, your community nickname and avatar, messages and their times and reply references, reactions, Saved and block state, settings, and the accepted policy-bundle version and timestamp.

Infrastructure, logs, recovery and processing locations

CarbonChat uses Cloudflare Workers and SQLite-backed Durable Objects. Cloudflare Workers Logs are enabled for this service, and query strings are redacted in them. Traces are disabled. Logs are a diagnostic tool and may not capture every event. CarbonChat's Cloudflare account is on the Free plan, for which Cloudflare currently lists a three-day Workers Logs retention period; Cloudflare has scheduled a pricing change for December 1, 2026. Cloudflare supports point-in-time restore of SQLite-backed Durable Objects to any point in the previous 30 days. CarbonChat has not tested a restore. Restored data may include information deleted after the restore point, so deletion records must be reconciled before the service is reopened. Cloudflare's placement hints are not guarantees, and its jurisdiction setting applies only to Durable Objects, not to all Worker and log processing. CarbonChat cannot confirm the physical processing location of every service component or that all processing occurs in one country.

AI and Add to Agent

Ordinary room chat does not require an AI model turn. If you choose Add to Agent, CarbonChat sends the messages you selected, with their text, author label, reference, time and source, plus any request you type, to your current host Agent conversation. Your host's own terms and settings apply to how it processes them. An Agent-assisted post stays a private draft until you review the exact text and confirm separately. The via Agent label describes how the message was sent; it does not verify accuracy or authorship.

Private translations

Translate is optional and manual. When you choose it, CarbonChat sends the selected message text as quoted content, without author or time labels, with translation instructions and a job reference to your linked current Agent. This adds a visible message to that conversation and uses its allowance. You can change the target language in Settings. The host controls the destination conversation and model; CarbonChat cannot guarantee a dedicated conversation or choose or verify a model. The Agent handles it as part of its normal usage, and your host's terms apply. CarbonChat and its infrastructure providers store and process the completed translation. It appears only in your own app views; it is not posted to the room and is not end-to-end encrypted. A request expires 10 minutes after it is created, not after it completes. The result becomes unavailable at that point, or sooner if the job is cancelled or the source or your access is lost. Background cleanup removes stored result text. Body-free request records become eligible for removal 24 hours after the request's original expiry, though cleanup may not occur at exactly that time. Original room messages keep their existing retention rules. Copies already held by the host or elsewhere are not erased.

Safety review and Highlights

For community safety and moderation, the operator's OpenAI assistant, dot, may automatically review necessary new messages in The Lobby and evidence from member reports through administrator-only tools. This can include message text, CarbonChat author IDs, community nicknames, message references and times, report categories and reporter notes. New-message review is limited to messages from the previous 24 hours. The operator's OpenAI assistant, dot, may also review necessary new Lobby messages from the previous 24 hours, using the same message information listed above (not report evidence), to choose and maintain up to five editorial Highlights. Highlights link to original room messages; they are selections, not endorsements, verification or paid placement. This editorial review is only for CarbonChat and does not change deletion, access restrictions or retention. Report evidence remains limited to safety review. These reviews are separate from your optional Add to Agent and manual translation features and do not depend on you turning them on. Ordinary members do not receive administrator access. CarbonChat uses these reviews only for community safety, moderation and editorial Highlights, not for marketing or other projects. OpenAI processes material sent to dot under the terms and settings that apply to the operator's account. CarbonChat's stated retention periods for its own records are unchanged; deleting content here does not automatically erase copies already sent to dot. Automated review can miss or misjudge content and is not continuous monitoring.

How long things last

Live message text becomes unavailable after 90 days. Background maintenance then removes the stored text; a body-free reference can remain. Room-change events and most action receipts expire after 7 days. Message-send receipts that prevent duplicate sends are not included in that 7-day cleanup. A moderator-only report evidence copy of the reported text, its captured author label and the reporter's note is cleared at the 30-day case expiry, even if the case is still open or the room message was removed sooner. Older report evidence may preserve the author label recorded at the time; for new reports, the author label records only the reported message author's community display name. Report records include the reporter's CarbonChat ID, category, status and timestamps. Open report records can remain while a case is unresolved. A closed report record is deleted 90 days after it is resolved. Reports you filed are removed during your account cleanup. Moderator action audit records expire 90 days after they were created. Pending Agent drafts on our server expire after 10 minutes.

Drafts in your browser

Local draft recovery expires after up to 7 days. Expired copies are removed when the app next accesses local storage; they may remain in browser storage until then. You can clear this site's data to remove them yourself. Account deletion cannot clear them remotely.

Deleting your account

Access is revoked immediately. Account and message cleanup continues in the background. Your message text is removed during account cleanup. Body-free references can remain, attributed to a deleted account. Separate report evidence may be retained until its 30-day expiry. Deletion cannot recall copies visitors or other members made, content already sent to a host Agent conversation, or provider backups. It does not remotely clear drafts stored in this browser.

Policy changes

We've updated our policies. Please review the current Terms, Rules and Privacy Notice before posting in The Lobby.