If I log in and click the Messages button I can see all my messages. To do that they have to be on their server. There isn't an off-the-record button I missed is there?

Ideally Facebook would use public-key encryption for chats and allow each user to individually save the history with their own passphrase they input encrypting it client-side.

But hey, auto-saving history without prompting you is worth it, right? (Also figuring out what to advertise to a user.)

It seems like you're describing something completely different from FB chat. anyway you could just encrypt the text, base64-encode it, and paste it into the chat box. still more convenient than email.

FB chat to me is basically real-time private messages rather than more traditional instant messaging, but everything I described except securely archiving the history could be done by FB transparently to the user. Of course you can do the work yourself, I just think it would be a nice gesture if FB provided the option to do the work for you, a way for the user to conveniently make sure FB keeps their parsers off the user's chat data. (It could also be extended to other data.) Also with how frequently Amazon prompts me for my password, I don't think users would be incredibly turned off by FB prompting for a password when they start chatting, and their browsers can be made to remember it anyway.