Who sees what
| your data | who talks to whom | can act for you | |
|---|---|---|---|
| A relay (ours or yours) | no | yes, by key, and when and how much | no |
| Your ISP, the café wifi | no | that you use a relay | no |
| A machine you granted | what you granted | its own sessions | within its grant |
| An agent you granted | what you granted | its own sessions | within its grant, logged |
| A stolen device | what it held | until revoked | until its revocation arrives |
| A script in your tab | what the tab can reach | yes | as the tab, so tabs get the least |
The cryptography
- Handshake: X25519 and ML-KEM-768 together. Both would have to break.
- Signatures: Ed25519 and ML-DSA-65 together on keys that live long. Classical signatures on short-lived proofs.
- Messages: ChaCha20-Poly1305. Every message is numbered and sealed on its own, with a replay window for datagrams.
- The core depends on crypto crates only, does no IO, and builds without an operating system, so it is small enough to audit.
Checked by tests
Each promise is a requirement with an id. A requirement is only marked done when a test passes, and one test reads every byte a relay forwarded and fails if it finds anything you typed.
Not promised
- Un-reading. What someone already read, they keep.
- Search on our servers. We can't index ciphertext.
- The last hop to a device that can't hold a key (a router, a TV) is only as safe as your network or the cable.
- A browser tab's key is safe from its own page. A tab is your least trusted device.
Found something? Tell us before anyone else. Responsible disclosure details will be here before the first release.