Security
What this protects, and what it does not.
The audience for a product like this is exactly the audience that will check. So this page is written to be checked: the weaknesses are on it, in the same size type as the strengths.
What holds up
End-to-end encryption with forward secrecy
Keys change as the conversation moves, so compromising a device today does not hand over everything said before it. The message layer is a hybrid post-quantum key agreement — a classical curve and a lattice scheme together — chosen so that traffic captured today is not trivially decryptable by a future quantum computer.
Storage on your device is encrypted
The daemon’s database is encrypted at rest, and the demonstration script proves it the only honest way: it searches the receiving daemon’s raw files for the plaintext of a message that was definitely delivered, finds nothing, then runs the same search against a file that does contain the string to show the search itself works.
No account, no directory, no phone number
There is nothing to enumerate and no central list of who uses this. That also means there is no password reset: if you lose your keys and your recovery phrase, the data is gone. That is the cost of there being no escrow, and it is not recoverable by anyone, including us.
Automation is gated, and revocable instantly
An agent holds a scoped, expiring token that a human signed for, kept in memory and never written to disk. Revocation takes effect on the next call rather than at the next expiry.
What does not
None of these are things we intend to quietly fix and stop mentioning. Three of the four are permanent.
The cryptography has not been externally audited
It is original work — a hybrid post-quantum handshake and a ratchet written for this project, not a wrapper around an audited library. An external protocol review is planned and budgeted, and it has not happened. Until it does, treat the strength of the construction as unproven regardless of how carefully it was built or how many tests it passes.
A compromised device is game over
Encryption protects messages in transit and at rest. It does nothing about malware with your permissions, someone reading your unlocked screen, or a backup you made yourself. No design here changes that.
Metadata is reduced, not eliminated
When a mailbox is involved, its operator can see that a queue received something, how big it was, and when. The mitigations are real — padding, deletion on acknowledgement, a fourteen-day ceiling, no logging of queue identifiers — but "the operator learns nothing" would be false, so we do not say it.
Push notifications involve Apple
A phone cannot be woken without going through the platform’s push service. It learns that something arrived for a device, never what. That is unavoidable on iOS and it is stated here rather than buried.
If you run the default mailbox, we are your service provider
That comes with obligations, and pretending otherwise would be its own kind of dishonesty.
Operating a mailbox that accepts a stranger’s ciphertext makes the operator a service provider in the eyes of several regulators: a contact point for legal requests, a published risk assessment, transparency reporting, and a process for handling law-enforcement demands. The answer to most such demands is structurally the same — the content is sealed and is deleted on delivery, so there is nothing to produce. The levers that do exist are quota, expiry and blocking a queue. There is no content moderation, because content moderation would require being able to read the content.