What’s said here stays here
Your messages are locked before they leave you
The locking happens on your phone or laptop — not on a server. What travels is a sealed envelope.
We run a post office, not a reading room
Our server stores and delivers those envelopes. It has never held a key that opens one — not because we promise not to look, but because we cannot.
The keys live on your devices
Which is why only your friends' phones and laptops can open what you send — and why a break-in at our end yields nothing but noise.
That protection has a real price
Lose your recovery phrase AND every device you use, and your messages are gone for good. Nobody can restore them. That is the same fact as "nobody can read them", seen from the other side.
Who can read your messages
Including the answers that are not flattering to us.
| If someone has… | Can they read? | Why |
|---|---|---|
| Us — the server, the database, whoever hosts it | No | It stores sealed envelopes, public keys, and locked boxes it has no key to. |
| The server, when you preview a link | The URL only | Rich link previews for most sites are fetched by our server: it sees the URL you chose to preview (and does not log it) — never the message around it, or who it was for. Turn link previews off in your profile to keep even that. |
| Someone who steals your sign-in | No | Signing in opens the door to the building, not the safe. They would be handed gibberish. |
| Someone who finds your recovery phrase | Not on its own | Without also getting into your account, the phrase has nothing to open. |
| Someone with your phrase AND your sign-in | Yes, from that moment on | That is how adding a new device works — so guard the phrase like a key to your house. They still cannot read anything sent before then. |
| Someone with your unlocked laptop | Yes | The real risk is a device, not a server. Lock your screen; turn off “keep this device unlocked” if you share it. |
| A device you removed | Nothing new | The moment you revoke it, everyone rotates their keys. It keeps only what it already had. |
How it works in detail— the keys, the vault, and what happens when you hit send
Two doors, one room
Everything you hold comes down to two things: a 24-word recovery phrase and, optionally, passkeys. They are equal alternatives — neither wraps the other, and either alone opens everything.
The phrase is not stored anywhere: not on our server, not on your disk. It is a password, deliberately expensive to guess, and typing it re-derives a key that can only unlock other keys — it cannot encrypt a message itself. Passkeys do the same job by a different route, using a secret your password manager computes on demand.
This is why deleting a passkey never endangers your phrase, and adding one never weakens it. The phrase is the one door that can always be rebuilt from something in your head, so it can never be removed.
What a vault is
Each device you sign in on builds its own vault — an encrypted store in that browser, never synced anywhere. It holds keys, not messages: this device’s identity, your account key, the message keys for each pub, and the keys you have pinned for your friends.
Your phrase and passkeys do not encrypt your identity directly. Each of them holds its own sealed copy of a single vault key, which is what encrypts everything inside. That indirection is what lets you add a second unlock method without re-encrypting anything, and remove one without destroying anything.
Your messages are never in there. They are decrypted on demand and held in memory only — which is why clearing a browser costs you keys, not conversations.
Why every device has its own keys
Your phone and your laptop each generate their own identity, which never leaves them. Above those sits one account key that is you — it encrypts nothing, and its only job is to sign a list of the devices you own.
Splitting it that way buys three things:
- You can lose a phone without losing your identity. Revoke it, everyone rotates keys, and it can never read another message — while your friends see no change and are never asked to re-verify you.
- Our server cannot invent a device. Your device list is signed with a key we have never seen. If we tried to slip an extra “your” device into it to receive copies of everything, the signature would not verify and every friend’s app would reject it.
- A new device starts fresh. Keys are handed out from the moment it joins, so it can read what comes next — not what came before.
What happens when you hit send
- Your app re-checks who is actually in the pub. If someone was removed while you were typing, it makes a fresh key before encrypting — never after.
- Your message key is delivered to every device of every member who does not have it yet, each copy individually encrypted for that specific device.
- The text, any photos’ keys, and the message you are replying to are bundled and padded to a fixed size — so a thumbs-up and a sentence look identical to us.
- The bundle is sealed, with its own address baked inside it. Tamper with the envelope and it no longer matches its contents, so it is rejected rather than shown.
- We receive an opaque blob and a room to put it in. We give it a number, store it, and pass it along.
- Each recipient’s device opens it and verifies it genuinely came from the device that claims it. Anything that fails that check is shown as unverified — never as text.