A fresh key for every message you send.

Undelivered messages: ciphertext blobs plus routing metadata under the published retention ladder. Delivered messages: gone from the relay database once the purge has run, about 25 minutes after the delivery receipt, leaving a destruction receipt with a hash of the message’s id and its times for thirty-seven days. A group message, sealed to each member by default, and a message read with Stealth Mode on or read receipts off are retired without a receipt the relay can match, so their ciphertext waits for the offline horizon. Photos, videos and files: each stays stored apart, encrypted, with an upload record that names its uploader, until its own expiry, up to 45 days after upload, even after its conversation is destroyed, unless its sender deletes it sooner. Destroyed conversations: the rows the relay can tie to the conversation are deleted, and where the relay’s own at-rest envelope wrapped them, that envelope’s epoch is retired; a one-to-one message, sealed by default, names neither its sender nor its conversation, so the destroy does not reach it, and one still waiting, or read with Stealth Mode on or read receipts off, stays to the offline horizon. A database backup taken before a purge still holds the rows as they were. Reading content requires breaking both X25519 and ML-KEM-1024.

No. The server is a dumb encrypted blob relay. It cannot read messages. Keys exist only on your devices.

Yes — the seal needs both ends. The hybrid handshake runs between two QERYX devices, and the keys exist nowhere else; there is no SMS bridge and no gateway into other networks. Once QERYX arrives, your public Profile ID is how you will bring someone in.

We cannot recover your messages or your account if you lose your device and your Secret Phrase. There is no key-escrow and no master reset.

Constant-time performance on every device, with or without AES hardware, and a smaller side-channel surface. The standards posture, stated whole:

CNSA 2.0 — asymmetric core conformant (ML-KEM-1024 + ML-DSA-87 at Category V; SHA-512 at or above the hash floor). The AEAD is ChaCha20-Poly1305 (RFC 8439), a documented deviation; the AES-256-GCM NSS suite is implemented and reserved as suite 0x0002. Pre-evaluation checklist (internal self-assessment against the NIAP Common Criteria bar, latest pass 2026-06): 0 algorithm-layer non-conformances, 5 documented deviations; no accredited-laboratory evaluation has begun.

For recorded traffic, they already do: harvest-now-decrypt-later is a present-tense collection problem, and the CNSA 2.0 national-security gate lands 2027-01-01. The hybrid ML-KEM-1024 floor answers the deadline, not a mood.

One device per identity at first; linked devices are on the roadmap. The carrier model makes multi-device harder on purpose — recovery state cannot be centralized server-side.

There is no lawful-access endpoint because there is no plaintext or metadata store to endpoint. Formal posture: NIAP READY WITH DEVIATIONS on our own pre-evaluation — not a completed EAL 4+ certification. The deviations are enumerated; no accredited-laboratory evaluation has begun, and the evidence bundle is being completed for one.

The outer envelope is addressed to the recipient alone; the sender's identity is readable only after decryption. Sender identifiers are stripped from the stored message row (sealed sender), though the relay authenticates the sender at send time; the relay routes by opaque identifiers. Undelivered messages queue with routing metadata under a published retention ladder.

Deleting a one-to-one chat, or a group for everyone as its admin, deletes the rows the relay can tie to the conversation, and the caches purge; a member who deletes a group leaves it, and the relay keeps the group’s rows for the members who remain. A one-to-one message, sealed by default, names neither its sender nor its conversation, so the delete does not reach it: it leaves on its own clock, within about 25 minutes of its delivery receipt, or at the 30-day horizon if it is still waiting or was read with Stealth Mode on or read receipts off. Each photo, video or file stays until its own expiry, up to 45 days after upload, unless its sender deletes it sooner. Nothing on the relay’s disk is overwritten, so a backup of it still holds those rows as they were: end-to-end ciphertext the relay never had a key to, beside the routing columns that say who wrote to whom. Where the relay’s own envelope wrapped a row, that residue was never readable to anyone without the operator’s master key, and destroying the conversation retires the envelope’s epoch; against someone who holds the master, that retirement is policy, not mathematics. Every destruction emits an ML-DSA-87-signed Merkle root you will be able to verify. Details on Disappearing & Sealed.

Yes. The crypto library beneath every platform, crypto-core, is source-published for review, and the protocol parameters are published; a peer is verified once, in person, through the Entangled pairing. Claims anchor to artifacts, not adjectives: read the security spec.