Messages that no server ever holds.

When both devices are online, a message goes straight from yours to theirs. There is no server in the middle to store it, because there is no server in the middle at all.

When the other person is offline, the sealed message waits in a mailbox — and only there. It is deleted the moment their device confirms it arrived, and it expires after fourteen days if nobody ever collects it.

Whoever runs that mailbox can see that a delivery happened. They can never see what was said, or read it later, because they never had it in a readable form in the first place.

Exactly what the operator can and cannot see

Give an assistant access to your messages and you have usually given it everything, for as long as it likes. Nex does not have a setting for that.

An agent, a script or a CLI has to ask for specific permissions — read this, send that — with an expiry attached. A human then signs for it, and can hand back less than was asked for. The token lives in that process’s memory and is never written to disk, so closing it ends the access.

Change your mind and the next call the agent makes fails. Not the next session — the next call.

Real transcripts: asked, narrowed, refused, revoked