Data, security and privacy
Who holds the keys, what the cloud stores and how to revoke access.
End-to-end encryption
Pairing uses X25519, HKDF and AES-GCM to establish key material. Application traffic uses fresh, directional AEAD keys with replay protection. Pairing private keys remain on your devices.
Signaling coordinates connections; relay carries ciphertext. The service does not hold the pairing private keys needed to decrypt sessions or persist plaintext chats and attachments. Authorized controllers can still read data, so manage device trust carefully.
Cloud metadata
The open-source service stores device public keys, credential hashes, names, IDs, pairing relationships, temporary encrypted envelopes and service signing identity. Connection handling also exposes necessary network information. The official business layer adds sign-in information, device ownership, plans, orders and entitlements.
Self-hosted operators manage this metadata. Limit administrative access and keep backups private.
Controller caches
Native clients store SQLite data and local attachments; Web uses IndexedDB. A previously authorized device can read its cached content. Revocation does not remotely erase those files.
After using a shared computer, clear site data and revoke the controller on the host. Revoke lost or replaced phones rather than only signing out of the cloud account.
Reporting security issues
Do not post exploit details, pairing keys, credentials or private conversations in public issues. Follow the private reporting channel in SECURITY.md.