Element

SOCIAL & MESSAGING

LAST UPDATED 4 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Element is an open-source messenger built on the decentralised Matrix protocol, developed by UK-based Element Creations Ltd, with the default matrix.org homeserver governed by the Matrix.org Foundation's separate privacy policy. Private conversations are end-to-end encrypted by default since May 2020, and Element states neither it nor its processors can access encrypted content. The homeserver still processes metadata — room membership, devices, IP logs kept up to 180 days — and stores unencrypted-room content as received; federation replicates data to homeservers outside Element's control. App analytics are opt-in and self-hosted (PostHog); push notifications route via Apple and Google. Track record includes a 2019 infrastructure breach and 2022 academic E2EE vulnerability disclosures, alongside published third-party audits and detailed public post-mortems.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

19 ON FILE

[2020-05-06] · COLLECTION

On 2020-05-06 Element (then Riot) announced that, as of Riot 1.6, end-to-end encryption is enabled by default for all new non-public conversations, together with cross-signing device verification.

element.io ↗

[2021-02-04] · COLLECTION

The service's policy indicates the cookies used by this service do not contain information that would personally identify you.

element.io ↗

[2021-03-10] · COLLECTION

As assessed by PrivacySpy on 2021-03-10 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.

privacyspy.org ↗

[2025-02-24] · COLLECTION

Element's privacy policy, last updated 2025-02-24, names Element Creations Ltd and its French, US and German subsidiaries as data controller, lists collected data including account details, IP address logs kept 30 days for customers and 180 days for Element chat app users, and optional location data, and states that nobody at Element or its processors can access end-to-end encrypted data.

element.io ↗

[2025-08-25] · COLLECTION

The Matrix.org Foundation privacy policy for the default matrix.org homeserver, effective 2025-08-25, states that messages and files in rooms are stored in the format they were received — plaintext for unencrypted rooms — and that server logs are kept for no longer than 180 days.

matrix.org ↗

[2021-03-10] · OWNERSHIP TRANSPARENCY

As assessed by PrivacySpy on 2021-03-10 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.

privacyspy.org ↗

[2021-07-27] · OWNERSHIP TRANSPARENCY

Element announced on 2021-07-27 that it raised $30M of Series B funding led by Protocol Labs and Metaplanet (Jaan Tallinn's fund), with existing investors Automattic and Notion also participating, publicly documenting its investor base.

element.io ↗

[2023-04-17] · OWNERSHIP TRANSPARENCY

In a 2023-04-17 blog post, UK-based Element publicly opposed the UK Online Safety Bill, arguing it could break end-to-end encryption and enable scanning of private messages on encrypted services — a public stance against surveillance mandates in its own home jurisdiction.

element.io ↗

[2021-02-04] · SHARING

The service's policy indicates a list of all cookies used by the service is provided.

element.io ↗

[2021-03-10] · SHARING

As assessed by PrivacySpy on 2021-03-10 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow third-party access to private personal data? — Yes, not all parties specified (but only to critical service providers).

privacyspy.org ↗

[2025-02-24] · SHARING

Element's privacy policy, last updated 2025-02-24, discloses processors including Amazon Web Services for hosting (noting Amazon employees may have access to some data), Cloudflare for DDoS mitigation, Stripe for payment processing, and Twilio, which receives users' phone numbers when 2FA over SMS is enabled.

element.io ↗

[2025-08-25] · SHARING

The Matrix.org Foundation privacy policy, effective 2025-08-25, states that data in federated rooms is replicated to other homeservers participating in those rooms, and that while forget requests are forwarded, federated homeservers are outside its span of control so deletion cannot be guaranteed.

matrix.org ↗

[2019-05-08] · TRACK RECORD

Matrix.org's post-mortem of 2019-05-08 details the April 2019 compromise of its production infrastructure via an outdated Jenkins server (CVE-2019-1003000) and a forwarded SSH agent, in which the attacker gained access to the production database, exfiltrated password hashes, and exposed release-signing keys; end-to-end encrypted message content was not compromised.

matrix.org ↗

[2021-02-04] · TRACK RECORD

The service's policy indicates you must report to the service any unauthorized use of your account or any breach of security.

element.io ↗

[2021-02-04] · TRACK RECORD

The service's policy indicates your account may be suspended and/or terminated for breaching the Terms of Service.

element.io ↗

[2022-05-16] · TRACK RECORD

Least Authority published a security audit, announced 2022-05-16, of vodozemac — the Rust implementation of the Olm/Megolm end-to-end encryption ratchets that has since replaced libolm across Element's clients — with the full audit report made public.

leastauthority.com ↗

[2022-09-28] · TRACK RECORD

Academic researchers Albrecht, Celi, Dowling and Jones disclosed practically-exploitable cryptographic vulnerabilities in Matrix's end-to-end encryption as implemented by matrix-js-sdk/matrix-react-sdk (the basis of Element), disclosed to developers between 2022-05-20 and 2022-07-06 with coordinated public disclosure on 2022-09-28; most attacks were fixed at disclosure, while homeserver control of room membership was acknowledged as a longer-term fix.

nebuchadnezzar-megolm.github.io ↗

TRACKING TECH

Element's support documentation explains that mobile push notifications are delivered via a push gateway (Sygnal) which forwards notification requests to Apple Push Notification service or Firebase Cloud Messaging using a per-device push key, meaning Apple and Google handle notification delivery metadata for Element apps.

docs.element.io ↗

[2025-10-09] · TRACKING TECH

Element's cookie and analytics policy, last updated 2025-10-09, states that app analytics run only if the user opts in, are powered by a self-hosted PostHog instance using a unique anonymous Analytics ID per Matrix account, and that analytics data is not shared with third parties.

element.io ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

PrivacySpy

CC BY · PRIVACYSPY.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7