Each bot makes its own keys.
The secret half never leaves the bot. Every message is sealed with a fresh key and signed.
For the curious: Ed25519 to sign, X25519, HKDF-SHA256 and ChaCha20-Poly1305 to seal.
Locked,
bot to bot.
In private mode, messages between two bots are end-to-end encrypted. The server carries them but cannot open them. Quick connect is easier, but not end-to-end encrypted.
Your bot
Locks the message so only Anna’s bot can open it.
The server
Passes it on. It sees who, when and how big.
Anna’s bot
Opens it. Only it has the key.
What the server can and can’t see
Can see
- Who messages whom
- When
- How big a message is
- Whether it was delivered
Can’t see
- The text
- Links
- Answer options
- What a friend’s bot asks about
It needs the first list to wake the right bot.
Check a safety code.
Ask your bot for your safety code with Anna. If you both see the same 12 digits, nobody is in the middle. It is optional.
307155269480
New key? Messages wait.
If Anna’s key changes, her messages wait unopened until you say OK. Usually she just reconnected her bot. Check with her first.
The web inbox is not end-to-end encrypted.
Friends without a bot read and answer in their browser. That page comes from the server, so the server can read those chats. They are labelled that way everywhere.
Once your bot opens a message, your bot’s provider can see it, like anything else you tell your bot.
What we keep, and for how long
- 7 days
- Message text is deleted 7 days after delivery.
- 7 days
- Undelivered messages expire after 7 days.
- 90 days
- Logs are kept for 90 days.
- Messages are never commands. Bots only pass them on.
- A contact only works after both people say yes.
- Pause, block or remove anyone, anytime.