Follow the message.
See the boundaries.

Only the endpoints can read a message.

Every box between two people carries sealed envelopes. Plaintext exists only on user devices.

L2. Encrypted attachments also travel through the Cloudflare proxy on their way to file storage. The server code does not contain the message-content format at all.

An account is a random number and 12 words.

No phone, no email, no real name on the account.

L2. A deleted username is never issued again. A display name exists only inside the encrypted profile (section 19). Each linked device has a name that the server can see — on Android it is the phone model by default.

One phrase grows every key — on the device.

Each key has one job, so a key made for one purpose is never reused for another.

L2. The identity key is derived deterministically, so it is the same on every device of one account; each device still has its own device ID and its own prekeys.

Creating an account proves you hold a secret — without sending it.

The server receives a signature and public keys. The words stay on the phone.

Sign a challenge instead of sending a password.

Each challenge works once, so a signature cannot be reused.

L2. The same challenge-and-signature step protects linking a device, listing and removing devices, and deleting the account.

A message is sealed before it leaves the phone.

From “Send” to “Read”. The server only ever holds the sealed envelope.

L2. Delivery is at-least-once; duplicates are dropped by message ID. Chat order follows server time; a message that arrives much later than it was sent is marked late.

The outside of the envelope is not the letter.

Three nested layers — each with a different audience.

L2. Layer 2 is readable by anyone with access to the server’s database — it tells who sent a message to whom, never what it says. The server code cannot decode layer 3: the content format is not part of it.

Far more than the text is sealed.

Everything people associate with a conversation travels inside the encrypted envelope.

L2. Envelopes are not padded to a fixed size, so the server sees approximate message size. Group membership is also known to the server (section 11).

Content is private. The fact of communication is not.

Every observer, every kind of data. Read across a row to see what one party learns.

L2. “—” marks a cell this atlas does not assess. IP addresses are not stored in the database or in the web access log; some error logs can still contain them.

The first exchange starts a chain of fresh keys.

Bob can be offline: he left public “locks” on the server in advance.

L2. A new key for every message gives forward secrecy and recovery after compromise: a stolen key opens one message, not the ones before or after.

Group keys go to the members the server lists.

The server keeps the member list. The group name and the messages stay on devices.

L2. Up to 128 members. Alice’s own other devices get a separate “sent” copy, not the group copy.

The file key travels inside the encrypted message.

Storage holds a locked box; the key goes separately, sealed.

L2. Re-encoding covers camera formats (JPEG, HEIC). PNG, GIF and WebP images are sent unchanged, so check what such files contain before sending.

Call set-up is encrypted; media goes through a relay by default.

The relay hides the two callers’ IP addresses from each other — while it works.

L2. The relay sees both IP addresses and the callers’ account IDs, not the media. Relay credentials are temporary. The code is derived from the call and from both sides’ encryption certificates.

The media server never gets the room key.

Every frame is encrypted with a key the members hand to each other.

L2. Up to 8 video streams and screen sharing. Asked who is in a call, the server tells group members only the number of participants. The media server itself sees which accounts joined, when and from which IP — not the media.

A new device gets your account, not your history.

Up to 10 devices per account. Each one is vouched for by the account key.

L2. Contacts’ apps may automatically re-send their own recent messages to a new device. A forged device is caught once a contact remembers your account key; the very first sighting is trust on first use.

Check the first contact once — then a change raises an alarm.

The app remembers a key the first time it sees it. Comparing a number proves nobody is in between.

L2. Available on web, Android and iOS. The “verified” mark is not synced to your other devices.

A stolen phone shows locked files — if it has an app lock.

Data at rest is encrypted; the app lock decides who can open it.

L2. A PIN is a convenience barrier; the strong secret is the 12-word phrase. In a browser there is no hardware key store, so someone with a copy of the browser’s data can try PINs offline.

Your settings sync, but the server sees only random names.

How contacts, chats and folders reach your other devices.

L2. This is not a message backup: history does not travel this way.

Your name and photo are locked with their own key.

The profile is encrypted; the key is handed out inside encrypted chats.

L2. The server sees that a profile exists, its size and when it changed. A username, if you set one, is separate from the encrypted profile.

A push wakes the app; it does not carry the message.

Google, Apple and browser push services learn that something happened and when — not what or from whom.

L2. New messages, calls and account notices (new device, added to a group) wake the phone; reactions, receipts and edits do not. Message previews are off by default. Muted chats are not woken — for that, the server keeps the list of chats you muted. Wake-up timing for two people can statistically suggest they talk.

Messages and files are short-lived on the server.

Maximum lifetimes on the server.

Queued messages are deleted as soon as they are acknowledged — 7 days is the ceiling, not the norm.

Stored metadata is part of the security model.

The kinds of records the server keeps — and what is deliberately absent from them.

L2. IP addresses are not stored in the database or in the web access log; some error logs can still contain them. Service logs exclude message content and tokens but can contain account and device IDs, so “no logs” is not claimed.

The server cannot read messages — end-to-end encryption, not a promise.

Automated checks in our development process flag server code that would cross a privacy boundary.

L2. These checks enforce the boundary in code. They are not an independent security audit.

Deletion is immediate and final — on the server.

Copies already on your contacts’ phones stay there.

L2. No waiting period and no restore.

A mini-app sees a stranger, not you.

Each app gets its own identity, unlinkable to your account and to other apps.

L2. Reports use VOPRF tokens (RFC 9497).

A blocked person is not told they are blocked.

The server gives them the same answer as a successful send.

L2. Blocks are temporary: the app shows when a block will end, and you can renew it.

Every defence has an edge.

What each attacker can try, what stops them, and what is left.

Know where the protection ends.

Encryption hides what you say. It does not hide that you are talking.

The cryptography behind the boundaries.

One table for the technical reader.

L2. The system as a whole is not claimed to be post-quantum.