Element
element.io
Privacy-focused messenger using the Matrix protocol. The Element client allows for group chat rooms, media sharing, voice and video group calls. End-to-end encryption by default for message content, but not metadata, which remains visible to the home server operator.
- Homepage:element.io
- GitHub:github.com/element-hq/element-web
- Privacy:element.io/privacy
- iOS App:apps.apple.com/us/app/element-x-secure-chat-call/id1631335820
- Android App:play.google.com/.../io.element.android.x
- Web info:web-check.xyz/check/element.io
Element Privacy Policy
Privacy Policy Summary
- This service collects your IP address, which can be used to view your approximate location
- The service provides information about how they intend to use your personal data
- The service is provided 'as is' and to be used at the users' sole risk
- This service does not force users into binding arbitration
- The court of law governing the terms is in a jurisdiction that is less friendly to user privacy protection.
- Instead of asking directly, this Service will assume your consent merely from your usage.
- You are solely responsible for claims made against the service and agree to indemnify and hold harmless the service.
- You can limit how your information is used by third-parties and the service
- The service has a no refund policy
- Users should revisit the terms periodically, although in case of material changes, the service will notify
- This services gives no guarantee regarding quality
- This service does not condone any ideas contained in its user-generated contents
- You authorise the service to charge a credit card supplied on re-occurring basis
- This service does not guarantee that it or the products obtained through it meet the users' expectations or requirements
- The court of law governing the terms is in location England and Wales
- You cannot distribute or disclose your account to third parties
- The service provider makes no warranty regarding uninterrupted, timely, secure or error-free service
- Users are responsible for any risks, damages, or losses they may incur by downloading materials
- The service does not guarantee that software errors will be corrected
- Tracking cookies refused will not limit your ability to use the service
- Invalidity of any portion of the Terms of Service does not entail invalidity of its remainder
- Other applicable rules, terms, conditions or guidelines
- User logs are deleted after a finite period of time
- Failure to enforce any provision of the Terms of Service does not constitute a waiver of such provision
- You can request access and deletion of personal data
- You are responsible for maintaining the security of your account and for the activities on your account
- This service allows you to retrieve an archive of your data
- The cookies used by this service do not contain information that would personally identify you
- Your personal data is used for limited purposes
- The service provides details about what kinds of personal information they collect
- Your personal data is aggregated into statistics
- The user is informed about security practices
- This service gathers information about you through third parties
- Third parties are involved in operating the service
- The service provides a complete list of all cookies set by its website
- A complaint mechanism is provided for the handling of personal data
- The service may use device fingerprinting on users.
- User accounts can be terminated after having been in breach of the terms of service repeatedly
- User-generated content is encrypted, and this service cannot decrypt it
- If you are the target of a copyright holder's take down notice, this service gives you the opportunity to defend yourself
- This service is only available to users over 16 years of age
- You maintain ownership of your data
- You must report to the service any unauthorized use of your account or any breach of security
- The service will only respond to government requests that are reasonable
- This service assumes no liability for any losses or damages resulting from any matter relating to the service
- This service provides archives of their Terms of Service so that changes can be viewed over time
- Provides instructions on how to submit a copyright claim
- The service can sell or otherwise transfer your personal data as part of a bankruptcy proceeding or other type of financial transaction.
- This service gives your personal data to third parties involved in its operation
- The service does not guarantee accuracy or reliability of the information provided
- Third-party cookies are used for statistics
Score
Documents
- Copyright PolicyCreated 04 Jan 21, Last modified 5 years ago
- Cookie PolicyCreated 04 Jan 21, Last modified 5 years ago
- Privacy PolicyCreated 04 Jan 21, Last modified 5 years ago
- Terms of ServiceCreated 04 Jan 21, Last modified 5 years ago
About the Data
This data is kindly provided by tosdr.org. Read full report at: #2498
Element Source Code
Author
Description
A glossy Matrix collaboration client for the web.
Homepage
https://element.ioRepository
- LicenseAGPL-3.0
- Created22 Jul 15
- Primary languageTypeScript
- Size620,892 KB
- Stars13,545
- Forks2,789
- Watchers13,545
Top Contributors
@t3chguy (9113)
@dbkr (7694)
@RiotRobot (5075)
@turt2live (4778)
@ara4n (2881)
@bwindels (2822)
@jryans (2703)
@renovate[bot] (2538)
@SimonBrandner (1836)
@richvdh (1570)
@lukebarnard1 (1336)
@germain-gg (833)
@kegsay (751)
@florianduros (740)
@rxl881 (588)
@szimszon (496)
@s8321414 (473)
@andybalaam (473)
@JorikSchellekens (471)
@robintown (437)
@luixxiul (436)
@Half-Shot (417)
@wmwragg (394)
@poljar (326)
@weeman1337 (307)
@ujdhesa (300)
@jaiwanth-v (270)
@waclaw66 (254)
@Johennes (237)
@MidhunSureshR (236)
@aaronraimist (195)
@foldleft (176)
@novocaine (166)
@krombel (164)
@uhoreg (161)
@osoitz (155)
@david-langley (152)
@aviraldg (151)
@IhorHordiichuk (148)
@Palid (146)
@a22sc (132)
@LinAGKar (130)
@Linerly (130)
@t1011 (129)
@dependabot[bot] (128)
@spantaleev (127)
@RiotTranslateBot (119)
@jaywink (118)
@jelv (117)
@RiotTranslate (114)
@toger5 (109)
@kittykat (103)
@pvagner (100)
@libexus (99)
@psrpinto (90)
@Studinsky (88)
@erikjohnston (86)
@pafcu (83)
@weblate (83)
@tulir (82)
@anoadragon453 (81)
@justjanne (77)
@bamstam (76)
@langleyd (74)
@awesome-michael (73)
@NegativeMjark (71)
@resynth1943 (69)
@dodog (68)
@Glandos (67)
@tjhietala (64)
@MamasLT (62)
@iapellaniz (61)
@rkfg (60)
@rbozhkova (58)
@hayaksi1 (57)
@SongTaeSeop (57)
@ZacksBot (56)
@rbondesson (56)
@MTRNord (56)
@nadonomy (55)
@strixaluco (55)
@AndrewFerr (53)
@artcodespace (48)
@BillCarsonFr (48)
@xmgz (45)
@kenneth-larsson (45)
@krkk (43)
@skolmer (43)
@tubitubitubi (42)
@catborise (42)
@manuroe (41)
@akissinger (39)
@nykula (38)
@exyi (38)
@superdump (37)
@panagiotis-c (37)
@nurjinjafar (37)
@kostich (36)
@dtygel-git (35)
@ysccsyysc (35)
Recent Commits
Bump shared components to 0.2.1 (#35378)
Codeowners device listener -> crypto team (#35377) * Add CODEOWNERS entry for device-listener Added new CODEOWNERS entry for device-listener directory. * remove break
Switch audio-player.spec.ts to using a retrying assertion (#35373) To deflake some tests
Open renovate PRs for testcontainers digests on a schedule (#35369)
Allow module dialogs without a title (#35362) Make DialogOptions.title optional and add ariaLabel so a dialog with no title keeps an accessible name.
Refactor hooks to use React 19's `useEffectEvent` (#35368) Can in theory avoid some race conditions in renders
Offer 'Sign out' on the identity reset page if there is no other option (#35307) * Offer 'Sign out' on the identity reset page if there is no other option * Fix incorrect prop documentation after review * Update comments to reflect the 'Sign out' variant
Update dependency stylelint to v17.16.0 (#35352) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Add AI assistance checkbox to PR template (#35363)
Improve Synapse test run performance (#35099) * Fix sliding sync invite flake * Reduce Synapse `synapse.storage.SQL` logs to INFO * Disable push and debug logs for further speedups * Remove overwritten synapse log consumer from playwright-common testcontainers keeps only the last log consumer, so the `homeserver` one always replaced it and the "synapse" buffer stayed empty. * Set up vitest unit tests in playwright-common The build uses a separate tsconfig so test files are not compiled into lib/. * Add PLAYWRIGHT_CAPTURE_LOGS to save container logs for passing e2e tests Writes each container's logs to <container>.log in the test output directory, for analysing homeserver performance. * Re-enable push in Synapse for e2e tests Disabling it meant opting many specs back in. Keeps the INFO root log level from 0b8294cbc2. * update lock * temp synapse image * Remove temp synapse image * fmt
Update testcontainers docker digests (#35365) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update dependency unplugin-dts to v1.1.2 (#35367) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update dependency @sentry/browser to v11 (#35355) * Update dependency @sentry/browser to v11 * Update Sentry inboundFiltersIntegration to eventFiltersIntegration --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Michael Telatynski <[email protected]>
Update dependency eslint-plugin-storybook to v10.6.1 (#35346) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Paul Chobert(07 Oct 26)
Stop writing removed legacy mention rules from the Labs notification settings (#35035) * Stop writing removed legacy mention rules from labs notification settings Matrix v1.17 removed the legacy text-matching mention push rules (.m.rule.contains_display_name, .m.rule.contains_user_name, .m.rule.roomnotif) from the base rule set (MSC4210), and Synapse is about to stop serving them by default. The labs notification settings page wrote those three rules on every save regardless. Against a server that no longer serves them the page never converges: Synapse currently accepts the writes with 200 without serving the rules, so the "Update" banner never clears and the page stays locked, and once the server answers 404 as the spec requires every save fails. The reconciler now only writes the legacy rules when they are present in the rules fetched from the server, the same way the intentional rules are gated on supportsIntentionalMentions. Adds reconciler tests with the legacy rules absent and present, and Playwright specs that run against Synapse with msc4210_enabled both off and on. * Split the labs mention rules e2e helper into explicit steps Replace the shared parameterised test with small helpers that each spec calls in order, so neither spec branches on the server mode. Each spec asserts its own precondition and its own final state of the legacy rule. Clicking "Proceed" is now unconditional and waits for the banner. Every fresh account shows it, and the old one-shot presence check raced the push rules fetch. * Update copyright holder in labs mention rules e2e tests * Cover all legacy mention rules in the labs notification e2e tests * Keep proceeding until the labs update banner is gone in e2e tests While the server serves the legacy mention rules, one click on "Proceed" does not always unlock the labs notification settings page. The page writes a legacy rule and its intentional counterpart in parallel, and monitorSyncedPushRules copies the legacy rule's actions onto the intentional one whenever a sync shows them out of step. When that sync lands between the two writes, the monitor puts the old actions back, the page re-reads the rules, still sees a difference and keeps the banner until the user proceeds again. That race is in the app and predates these tests, which are about which rules get written. It made the served-mode spec flaky, so the helper now proceeds until the banner is gone. * Give the labs update banner click a timeout in e2e tests click() waits for the "Proceed" button to be visible. On a retry the banner may already be gone, which is why the helper checks for it before clicking. A banner that goes away between that check and the click would still make click() wait until the test times out, so the click now gives up after a second and the next attempt finds the banner gone.
Update dependency postcss-preset-env to v11.6.0 (#35350) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update dependency motion to v14 (#35357) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update electron (#35335) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update testcontainers docker digests (#35333) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update dependency @element-hq/element-call-embedded to v0.26.1 (#35334) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Clean up leftover bits relating to the React SDK Module API (#35332) * Clean up leftover bits relating to the React SDK Module API * Whoops and the .gitignore
Fix sliding sync invite flake (#35342)
Revert "Do not allow skip device verification by default (#35259)" (#35343) This reverts commit 789de241d393aca31e3168ebf715f1d9f3689583.
Ellipsise long names in widget picture-in-picture view (#35329)
Fix Debian control file Maintainer field (#35338) Ubuntu upgrade got stricter on the format
Update electron-builder to v26.17.0 (#35336) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update rust:bookworm Docker digest to fbc3a35 (#35341) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Update nginxinc/nginx-unprivileged:alpine-slim Docker digest to 1517d8c (#35340) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Put user status below the avatar (#35328) * Put user status below the avatar * Update screenshots
Merge remote-tracking branch 'origin/master' into develop # Conflicts: # apps/web/package.json # pnpm-lock.yaml
Element Security
Security Advisories (8)
- mediumPatched
GHSA-wqmv-r2qj-2j9pXSS in HTML chat export via unsanitised attachment filenames and MXIDs
- lowPatched
GHSA-9r5h-8m2x-w7q6Bundled URL preview links are not sanitized
- mediumPatched
CVE-2026-55850A malicious homeserver can inject HTML in Element Web using its homepage
- mediumPatched
CVE-2025-59161A malicious room can hide an unrelated room and cause it to be left when the malicious room is left
- mediumPatched
CVE-2025-32026Element Web could load a malicious instance of Element Call leaking media encryption keys
- highPatched
CVE-2024-51750A malicious homeserver can modify events leading to unrenderable events or rooms
- lowPatchedCVSS 3.5
CVE-2024-51749Thumbnails can be abused to misrepresent the content of an attachment
- highPatched
CVE-2024-47779 Potential exposure of access token via authenticated media
Element Website
Website
307 Temporary Redirect
Redirects
Redirects to https://element.io/en/
Security Checks
All 65 security checks passed
Server Details
- IP Address172.66.165.154
- LocationSan Francisco,California,United States of America,NA
- ISPCloudFlare Inc.
- ASNAS13335
Associated Countries
US
CA
Safety Score
Website marked as safe
100%
Trackers
No known trackers found
Blacklist Check
element.io was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Element Android App
APK Info
- AppElement X
- Creation Date18 May 24
- Last Updated14 Jul 24
- Current Version0.4.12
- Privacy ReportView on Exodus →
De-Googled Compatibility
- CalyxOSmicroG3.7 / 4(6)
- GrapheneOSNative4.0 / 4(4)
- LineageOSmicroG4.0 / 4(3)
- Project Infinity XmicroG4.0 / 4(2)
Permissions
- Access Coarse Location
- Access Fine Location
- Access Network State
- Access Wifi State
- Camera
- Foreground Service
- Internet
- Modify Audio Settings
- Post Notifications
- Record Audio
- Request Install Packages
- Use Biometric
- Use Fingerprint
- Vibrate
- Wake Lock
- Receive
- Dynamic Receiver Not Exported Permission
Element iOS App
App Info
Element X - Secure Chat & Call
Freedom to communicate on your own terms For individuals and communities - private communication between family, friends, hobby groups, clubs, etc. Element X gives you fast, secure and private instant messaging and video calls built on Matrix, the open standard for real-time communication. This is a free and open-source app maintained at https://github.com/element-hq/element-x-ios Stay in touch with friends, family and communities with: • Real time messaging & video calls • Public rooms for open group communication • Private rooms for closed group communication • Rich messaging features: emoji reactions, replies, polls, pinned messages and more. • Video calling while browsing messages. • Interoperability with other Matrix-based apps such as FluffyChat, Cinny and many more. Privacy-first Unlike some other messengers from Big Tech companies, we don’t mine your data or monitor your communications. Own your conversations Choose where to host your data - from any public server (the largest free server is matrix.org, but there are plenty of others to choose from) to creating your own personal server and hosting it on your own domain. This ability to choose a server is a large part of what differentiates us from other real time communication apps. However you host, you have ownership; it’s your data. You’re not the product. You’re in control. Communicate in real time, all the time Use Element everywhere. Stay in touch wherever you are with fully synchronised message history across all your devices, including on the web at https://app.element.io Element X is our next-generation app If you’re using the previous-generation Element Classic app, it’s time to try Element X! It’s faster, easier to use, and more powerful than the classic app. It’s better in every way and we’re adding new features all the time.
Rating
Version Info
- Current Version26.08.2
- Last Updated17 Aug 26
- First Released06 Jul 23
- Minimum iOS Version18.5
- Device Models Supported127
App Details
- IPA Size304.74 Mb
- PriceFree (USD)
- Age Advisory17+
- Supported Languages38
- DeveloperVector Creations Limited
- Bundle IDio.element.elementx
Screenshots
Element Reviews
More Team Collaboration
Self-hostable Slack alternative with native desktop, mobile and web apps, and many integrations. There's no end-to-end encryption, so the server can read all messages, and telemetry is on by default. The open source edition caps at 250 users.
Easy-to-deploy, self-hosted Slack alternative with polished cross-platform apps. End-to-end encryption is supported, but off by default - without it, workspace admins can read all messages. Usage statistics are sent by default.
A decentralized, encrypted P2P friend-to-friend app for chat, forums, channels, boards, voice calls and anonymous file sharing. Best for trusted contacts, as it isn't anonymous unless you route it through Tor (off by default).
Open source team chat organized around topic-based threading, which keeps busy conversations easier to follow than channel-only tools. Can be self-hosted, or used as a paid cloud service. The threading model takes some getting used to.
About the Data: Element
Change History
- Amended (androidApp, description, icon, iosApp, openSource, securityAudited) #770
- Amended (androidApp, iosApp)
Edit Element Data
You can edit Element's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Element's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/elementThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Element
Help your friends compare Team Collaboration, and pick privacy-respecting software and services.
Share Element and Awesome Privacy with your network!