Terms of service · 摘自 Sotto 既有项目文档 / excerpted from existing Sotto documentation
这是可运行原型，不是经过审计的安全产品。协议实现为独立编写，不与 Signal 客户端互通。
This is a runnable prototype, not an audited security product. The protocol is an independent implementation and does not interoperate with Signal clients.
TTL 是发送后硬截止 + 已读倒计时，到期记录与密钥同时销毁；接收方离线超过 TTL 时，该条不会送达，发送方显示为未送达·已销毁。
TTL is a hard deadline after sending plus a read countdown; the record and its key are destroyed on expiry. If the recipient is offline longer than the TTL, the message is not delivered and the sender sees “not delivered · destroyed”.
中继侧的未送达信封最长保留 7 天，送达后立即删除；路由元数据随信封一起删除。你自己设备上的聊天历史不受这 7 天限制，直到你主动删除、单条删除或自毁到期。附件分块与自同步槽目前依赖"下载后删除/下次同步覆盖"，没有自动过期时间。
On the relay, undelivered envelopes are kept for at most 7 days and deleted immediately after delivery; routing metadata is deleted with its envelope. Chat history on your own device is not bound by that 7-day cap and remains until you delete the chat, delete a message, or its self-destruct timer expires. Attachment chunks and SelfSync slots currently rely on recipient-side deletion or the next sync overwrite and have no automatic expiry.
举报入口：1:1 会话菜单与单条消息长按；频道与账户资料页的入口在 Roadmap 中。举报证据在中继保留 90 天，或结案即删（取早）。我们无 SLA，尽力在 72 小时内完成初查；当前版本不提供处理状态回执，如需跟进请邮件 abuse@。申诉同样无 SLA。举报不会延长普通消息的保留期。
Report entry points: the 1:1 chat menu and long-press on a single message; entries on channels and profile pages are on the roadmap. Report evidence is kept on the relay for 90 days or until the case is closed, whichever is earlier. We offer no SLA and aim to triage within 72 hours on a best-effort basis; this version provides no status receipt, so follow up by email to abuse@. Appeals have no SLA either. Filing a report does not extend the retention of ordinary messages.
备份/多设备未实现；用助记词在新设备恢复后，旧设备签发过的邀请码不在新池里，会被拒绝。
Backup and multi-device sync are not implemented. After restoring a mnemonic on a new device, invites issued by the old device are not in the new pool and will be rejected.
远程删除/已读回执在频道侧仅本机生效；20 万人规模是纯 Dart 扇出模型验证，不是真实并发压测。
On channels, remote deletion and read receipts are local-only. The 200k-member figure is a pure-Dart fan-out model test, not a live concurrency test.
未经过独立安全审计；请自行评估风险，不要用于高风险场景。
Not independently security-audited. Assess the risk yourself and do not use it for high-stakes scenarios.