In plain words: what is encrypted, what the server sees and what no one but the people in the chat can read.
A message travels from phone to phone through our server. On the way it's protected by three layers, and each one keeps working even if another is broken.
Text, photos and chat names are encrypted on the sender's phone and decrypted only on the phones of the people in the chat. The IETF MLS standard (RFC 9420), with a post-quantum hybrid ML-KEM-768 + X25519 by default. Keys never reach the server, and in groups they are refreshed automatically on a regular basis.
The app talks to the server only over TLS 1.3 and trusts only the Let's Encrypt root certificates built into the app. A forged or "corporate" certificate installed on the phone won't work: the connection simply won't open.
Before encryption, every message and attachment is padded to one of several standard sizes. The length of the ciphertext doesn't reveal what's inside — a "yes" or a long paragraph.
Times on the server are rounded, and the message server's logs contain no names, group IDs or IP addresses. We can't yet hide from the server who talks to whom — it's on our roadmap.
Your phone encrypts each file with a new random key (XChaCha20-Poly1305); only ciphertext goes to the server, and the key travels inside the encrypted message. Files are kept on the server for up to 30 days and then deleted automatically. Your name, job title and avatar are sent to your chats encrypted the same way.
Sound and video are encrypted on the phones (DTLS-SRTP, and in group calls also frame encryption with the group key). One-to-one calls go through our server's relay by default, so the other person can't see your IP address. In group calls, phones connect to the call server rather than to each other.
Keys and history are stored only on your phone, in a file encrypted with a key from the system's secure storage (Android Keystore, iOS Keychain). Google or iCloud cloud backup is turned off for this data. Your fingerprint or face is checked by the system itself — the app never receives biometric data.
On Android, notifications work without Google services (Firebase). The server only says "something new", and the notification shows a generic text. The sender's name and text appear only if you turn that on and your phone is unlocked.
There's no global directory. Only someone who knows your exact name or email can find you, and you can turn that off. Email addresses are compared via a keyed hash. Your phone book never leaves your phone.
Backups of your conversations are made automatically and encrypted with a recovery key that only you know — the server can't read them. Without that key no one can open a backup, not even us. For a company with its own storage, backups are kept in its S3.
A bot is a chat member with its own keys: it only sees chats it's been added to, and only from that moment on. Messages addressed to the AI assistant, together with up to 30 recent messages of the chat, are sent to the AI provider — Anthropic (USA). A banner is always shown in such a chat.
You can report or block a person right from the chat. A report is the only case in which messages can reach the server — and only if you tick "Add recent chat messages" yourself.
They see service data without message content, and email addresses only masked. The admin panel isn't reachable from the internet; sign-in requires a password and a one-time code. Admin actions are logged.
In a Hetzner data centre in Germany (EU). Emails with confirmation codes and invitations are sent by Brevo (France, EU). The server's state and its own backups are encrypted.
Intercepting a conversation in transit won't work: to read it, someone would need a participant's unlocked phone in their hands. So protect your phone with a PIN and compare security codes with colleagues by QR. No system offers absolute protection — we say plainly what the server sees and don't exaggerate.
The legally precise description of data processing is in the Privacy Policy.
