transient.chat/README.md

# Transient Chat

> Everything is ephemeral. Encryption first.

**Transient.chat** is a lightweight, encryption-first in-memory chat platform designed for real-time, impermanent conversation.

There are no profiles. No feeds. No tracking. No persistent databases.  
Just on-demand private encrypted rooms, zero plaintext in server memory, message expiration, and integrated toggleable watch parties.

---

## About

- **Encryption-First:** Client-side zero-knowledge E2EE using AES-256-GCM and PBKDF2 (100,000 iterations). All text and voice messages are encrypted in browser before sending.
- **Encrypted In-Memory Storage:** The server only ever holds ephemeral ciphertext and IVs in memory. No plaintext or raw audio is ever stored in memory or written to disk.
- **On-Demand Private Rooms:** Rooms are created on demand and protected by passwords.
- **Active Server Browser:** The server browser exclusively lists active rooms currently occupied by users.
- **Integrated Watch Party:** Any room can toggle YouTube synchronized playback on and off in real time.
- **Ephemeral Voice Notes:** Record and send encrypted voice messages with optional autoplay.
- **1-Hour Expiration & Room Purge:** Messages expire after 1 hour. When all users leave a room, the room, its password, video state, and messages vanish completely.

---

## Features

- Zero-knowledge end-to-end encryption without complicated keyring management
- Ephemeral in-memory ciphertext storage (zero plaintext)
- On-demand room creation and password verification
- Active-only server browser
- Integrated YouTube Watch Party toggle in all rooms
- Ephemeral audio notes (WebM / Opus) with optional autoplay
- Room owner moderation (kick users)
- Admin dashboard for IP/username bans and system notifications
- Pure Vanilla CSS and lightweight modern architecture

---

## Deployment

This app is intended to be deployed on **[DigitalOcean App Platform](https://www.digitalocean.com/products/app-platform/)** or any container/PaaS as a Python Flask application.

Set environment variables for admin login:

```env
ADMIN_USERNAME=your_admin_name
ADMIN_PASSWORD=your_secure_password
```

---

## Project Structure

```
transient.chat/
├── app.py             # Flask app factory and launcher
├── config.py          # Loads environment variables
├── models/
│   ├── state.py       # In-memory shared state & password hashing
│   └── cleanup.py     # Background cleanup thread for empty rooms & expired msgs
├── blueprints/        # Modular route definitions
│   ├── auth.py        # Handle registration and token validation
│   ├── chat.py        # Encrypted message relay and polling
│   ├── rooms.py       # Active rooms browser and password join/create
│   ├── admin.py       # Admin dashboard endpoints
│   ├── watchparty.py  # YouTube synchronized playback control
│   └── static_routes.py
├── static/
│   ├── index.html     # Landing page & handle registration
│   ├── chat.html      # Unified encrypted chat & watch party interface
│   ├── server_list.html # Active rooms server browser & room creation
│   ├── faq.html       # Frequently asked questions & security details
│   ├── admin.html     # Admin dashboard interface
│   └── assets/        # Frontend resources
│       ├── css/       # Vanilla CSS stylesheets
│       │   ├── styles.css
│       │   ├── chat.css
│       │   ├── watchparty.css
│       │   └── admin.css
│       ├── js/        # Frontend JavaScript
│       │   ├── crypto.js      # Web Crypto API (PBKDF2 + AES-GCM)
│       │   ├── chat.js        # Unified encrypted chat & watch party
│       │   ├── server_list.js # Active rooms & password join modal
│       │   ├── index.js
│       │   └── admin.js
│       ├── sounds/    # Notification audio clips (.wav)
│       └── images/    # Logos and branding
└── requirements.txt   # Python dependencies
```

---

Nothing is archived.  
Nothing is retained.  
**Everything is ephemeral.**