Your machines. Anywhere. Nobody in between.

#What the relay sees

Type on the left. On the right is everything a relay sees: the one we run, one you run, your ISP, the café wifi. It's sealed in this tab, with a key that never leaves it.

to 9f3c…e1a2  n 41
33dd4fbf01e7e197fa2ff968e6d4cd1e
e746934c2a771bdde7ae4ed7a1f712be
2b93ae910cff6a5dc8bb2a46cff02a57

#What it promises

• You decide where it lives. Each note, file and secret lives on the machines you choose, and nowhere else until you move it.
• Relays see ciphertext. Whatever forwards your traffic, ours included, carries sealed bytes it has no key for.
• The machine with the data decides. It checks every request itself, against grants you signed. No server is asked, so it works offline.
• Post-quantum from the first release. X25519 with ML-KEM, and ML-DSA on keys that live long, so what is sealed today stays sealed.

#Everyone is a key

People, laptops, browser tabs, agents and our own servers are all the same thing: a key holding grants you gave it. Let an agent into one folder on one machine until Friday. Revoke a lost phone from any other device. There is one model, so there is nothing special to get wrong.

• 5842f593Youeverything, from any device
• bb3c95b1Laptopholds ~/notes, ~/code
• 2d2799f7This tabcan open a terminal on Laptop
• 80df1b09Research agentreads ~/notes/papers until Friday
• e3117d05Old phonerevoked
• 5572c50bRelayforwards sealed bytes

#What we won't claim

• Un-reading. What someone already read, they keep. Revoking decides what happens next.
• Search on our servers. We can't index what we can't read. Search runs on your machines.
• A browser tab as safe as a laptop. Any script on a page can read that page's key, so a tab is your least trusted device and is granted the least.

#How early

Very. The core seals, the sessions survive network changes, and both are tested. The rest is being built in the open, and every promise above is a requirement that only a passing test can mark done.