How a Dato Room keeps things private, and what it can’t promise

Nothing you do in DatoMark is sent anywhere, apart from a Dato Room. A room needs something to carry messages between people, called a relay. This is what it does and doesn’t know.

• Marks, chat, names, files and the drawing are sealed (encrypted) on your computer before they’re sent. The relay carries sealed messages it can’t read.
• The key is in the link, after the #. A browser never sends that part anywhere, so the relay never sees it.
• The relay can see that a room exists, how big the sealed messages are, and roughly when they were sent. It can’t see what’s in them.
• It forgets the room when its days run out or the host ends it.
• The door is the relay's to keep. When the host lets people in one at a time, the relay doesn’t send the marks, the drawing, the files or the list of people to anybody who hasn’t been let in, and lets them do nothing but chat and say who they are. A person at the door can read the room's name and who hosts it (the host seals that for the door) and nothing else.

What this means for you

• The link is the key. Anyone who has it can join. Send it only to the people who should be in, and treat a link you have pasted into a shared chat as shared.
• Not an account. Nobody signs in; there’s no one to ask for a password. That keeps things simple and means a lost link can’t be reset.
• A mark-up link and a view-only link are different. Only people with the mark-up link can draw.
• Your copy is yours. Joining and leaving don’t take your drawing or marks away.