NOIR CHAT — cPanel Shared Hosting
=================================

INSTALL
1. Upload the ZIP contents into a folder on your HTTPS website, e.g. public_html/privatechat/
2. Ensure PHP 8.0+ is selected in cPanel (PHP 8.1 or newer recommended).
3. The included data/ directory must be writable by PHP. Start with permissions 755; if your host requires it, use 750 or ask hosting support. Avoid 777.
4. Visit https://yourdomain.com/privatechat/
5. Click Create private room and send the invitation link to one person via WhatsApp.

HOW IT WORKS
- Chat text is sent through a WebRTC DataChannel directly between browsers.
- WebRTC uses DTLS encryption for the peer connection.
- PHP endpoints exchange only WebRTC signaling data (SDP and ICE candidates), temporarily in data/*.inbox files.
- The room metadata contains token hashes and expiry time, not chat text.
- Rooms expire after 2 hours. The End room button removes signaling inboxes and marks the room ended.
- The data directory is blocked from direct web access by its .htaccess file.

IMPORTANT PRIVACY / LIMITATIONS
- This is a starter implementation, not a professionally audited secure-messaging product.
- Signaling metadata is temporarily stored on your hosting server. Chat messages are not intentionally sent to PHP or saved by this application.
- Browser memory, screenshots, notification previews, browser extensions, hosting/server access logs, backups, and the other participant's device are outside this app's control.
- Direct WebRTC connectivity depends on both networks. Some restrictive networks may need a TURN server; this version uses a public STUN server only and does not configure TURN.
- Do not use this for highly sensitive or legally privileged conversations without a security review.
- A copied invitation link can be used by whoever obtains it. Share privately and end the room after use.
- HTTPS is required for WebRTC and clipboard features.

CLEANUP
Expired room and inbox files are cleaned opportunistically when a new room is created. For tighter housekeeping, add a cPanel cron job to run api/cleanup.php every 10 minutes.

This package does not include analytics, ads, user accounts, or a message database.
