Stoat

Stoat says what it is in three words — find your community — and describes itself as the open-source group chat app for friends and communities. It is the product that used to be called Revolt, though its own website never says so: no page read for this review mentions the old name, and the only trace of it is the company behind the platform, which is still Revolt Platforms Ltd, registered in England. Its promises are made in the negative — no ads, no data mining, no shady partnerships — and it commits to being free and open source now and forever, on the grounds that it has no board to please and no advertising revenue to protect. It runs on desktop, mobile and the web, and the source is public, which is the claim the rest of its positioning rests on.

The shape is servers and channels with role-based permissions and moderation tools, and the company says the same tools work whether you are talking with a handful of friends or running a large community. Voice and video are both part of the product even though the front page only mentions voice chat, group messages hold up to 50 people with bots working inside them, and a public API is offered for custom clients and for the bots communities tend to want. Nothing is required of you to host: self-hosting is offered rather than expected, and the company says it is free and open if you want it. That choice carries a consequence the privacy policy states rather than buries — an instance someone else runs is not operated by the company, so its terms, guidelines and privacy policy do not apply to it, and the policy's own advice is to visit one at your own discretion.

There is nothing to buy. No price, subscription, tier or donation link appears anywhere in the pages the company publishes, and its terms contain no money clause at all — no fees, no billing, no refunds, no payment terms anywhere in the document. Features that would be sold elsewhere are simply given: custom emoji, an upload limit of 20MB, animated avatars and a profile banner, which the company notes it has solved the age-old problem of letting users set without being charged for it. It says the platform is free and open source now and forever, and that it has no advertising revenue to protect. The one limit on this is about users rather than the operator: buying and selling accounts, buying and selling servers, and anything that artificially inflates a server are all prohibited outright.

The age floor is 13 by default with a published table of exceptions that raises it — 16 in Germany, the Netherlands, Poland and several other countries, 15 in France and the Czech Republic, and 14 in Italy, Spain and Austria among others — and the company says it collects a date of birth for that purpose and uses it for nothing else. The community guidelines are detailed, covering violent extremism, hate speech with a long list of protected characteristics, harassment and doxxing, malware and impersonation, and the scraping of member lists; two rules are worth singling out, that sexual content has to be age-gated and kept out of open areas, and that sexual conduct involving a minor is prohibited and reported to the authorities. Enforcement works by strikes, which the guidelines describe as irreversible, with a suspension liftable only by a successful appeal and no warning step promised anywhere, and the terms allow the company to terminate access immediately and without notice. Reporting is in the app, with a support address as a fallback. On data the supplement is specific rather than general: it stores account details, the names of the servers you create or join, your date of birth, and, in its own words, your messages and any content such as attachments and reactions, because storing them is what providing the service requires; it also records your IP address and a short device description for each session. Two things are left open. No retention period is given for any category of data, and nothing in the terms, the guidelines or the policy says what the owner of a server can see of a member's messages, which is the question someone choosing a server would most want answered. Processing is mostly in the European Union and the United Kingdom, the processors are named, and the policy promises that data will never be sold, while noting that providers can be added or changed without advance notice, including where they operate.

Communities that want this shape of product without this shape of company: a guild, a study group, a club, a circle of friends, or anything in between, as the guidelines put it. Developers are addressed directly, through a public API and bots that run in servers and in group messages. It suits anyone who wants to host the thing themselves, and anyone who cares that they are not being sold to, since neither advertising nor a paid tier exists to sell. It is not for people looking for a feed or for strangers: there is no discovery or matching anywhere in the product.

The most complete set of policies in this batch and the only platform in it with nothing to sell, which makes the two omissions stand out rather than blend in. The processors are named, the jurisdictions are listed, the age table is published in full with its reasoning, the strikes-and-appeals process is written down, and the privacy policy says outright that messages are stored — a sentence several competitors leave vague. Against that, a reader cannot find out how long anything is kept, or what a server's owner can see, and those are the two questions the platform's own design makes most pressing. The rebrand is a quieter omission of the same kind: the product has a new name, the company does not, and the site mentions neither. What is left is a platform whose promises are unusually checkable — open source, no advertising, no paid tier — run by a company that has not yet explained what it used to be called.