1.3 Disappearing & Sealed
Messages that leave on your schedule and leave nothing behind.
Disappearing messages, sealed sender (v2, rolling out), panic wipe, and a decoy PIN. Deletion is a true erasure, and screenshots are blocked at the surface.
- FIPS 204
- Destruction receipts ML-DSA-87
- Envelope wrap keys HKDF-SHA-512
- At-rest envelopes ChaCha20-Poly1305
01 / THE DEFENSES — FIVE, TAPPABLE
Five defenses. Tap through them.
Messages leave on your schedule. Expiry is enforced on the device and backed by a server purge horizon — media included.
The timer is a contract, not a suggestion: when it fires, the erasure path below runs.
The outer envelope is addressed to the recipient alone; who wrote it is readable only after decryption. Sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time.
The relay routes by opaque identifiers. Undelivered messages queue with routing metadata under a published retention ladder.
One gesture erases local key material and state on your device. Honesty note: it cannot un-send what a recipient already holds.
What it destroys, it destroys completely — the keys go first.
A duress PIN opens a believable synthetic vault. Once duress fires, the real compartment is cryptographically out of reach — not hidden, unreachable.
A coerced unlock yields the decoy. Activation is quorum-gated.
Surface capture is blocked on shielded surfaces: stream shield, scrim, and overlay. Screen shares and recordings of shielded views capture black.
Scope, stated: a camera pointed at the glass is out of scope — no software defends against optics.
02 / ERASURE — LETTERED
Destroy a conversation and follow the key that dies.
True erasure
Destroying a conversation advances its envelope epoch: the prior wrap key — derived from an environment-only master that is never persisted — is zeroized. Whatever bytes survive in a WAL or backup are locked under a key that no longer exists anywhere.
- Wrap key
- HKDF from FSOR_MASTER_KEY · env-only · never persisted
- Residue
- envelope-locked · key destroyed
- Source
- backend/src/services/fsor.rs · SPEC/06
The receipt
Every destruction emits a Merkle root over the erased messages, signed under ML-DSA-87. The operator is cryptographically committed to the destruction, and you can verify the receipt against the TOFU-pinned operator key.
- Receipt
- ML-DSA-87 · ctx QERYX-FSOR-ROOT-v1
- Verify against
- TOFU-pinned operator key
- Source
- SPEC/06 §8.9
The catch-net
A database trigger fans the purge out to the cache and file store in the same window — the path that catches anything a handler missed. Defense in depth applies to deletion too.
- Fan-out
- GlyconCache entries + QSFS blobs purged in-window
- Source
- SPEC/06 §8.7
Sealed sender v2 · rolling out
The outer envelope names only the recipient; the sender's identity sits inside the seal and is readable only after decryption. On delivery, the relay's copy of the row is nulled — sender, recipient, and content — with a 10-minute hard-purge grace we publish rather than hide.
- On ack
- sender_id, recipient_id nulled · content emptied
- Grace
- 10 minutes to hard purge · 7-day offline horizon
- Source
- q_sealed_sender.rs · QERYX_STACK carrier invariants
Duress
A decoy PIN opens a believable synthetic vault; the real vault is cryptographically inaccessible once duress fires. Activation is quorum-gated — duress PIN or remote, nothing quieter.
- Decoy
- synthetic vault · opens under the duress PIN
- Real vault
- unreachable after duress activation
The surface
Screen Shield blocks surface capture on shielded views — stream shield, scrim, and overlay. The scope is bounded and we state it: a camera pointed at the screen is out of scope, and the live-coercion shadow-copy risk is a policy-and-audit contract, not a cryptographic one.
- Shipped scope
- stream shield + scrim + overlay · surface capture only
Deleted means the key no longer exists. Anywhere.
The pill is the proof surface
When the relay erases its copy, the app shows it: the “Server-erased” pill renders from the relay's own 410 answer, and the signed destruction root sits beneath it, checkable against the pinned operator key.
During the 10-minute delivery grace, ciphertext still exists — we say so, because the caveat is the credibility engine.
03 / THE RETENTION LADDER — FOOTNOTED
Read the retention ladder in the open.
10 min1
delivered-message hard-purge grace — during it, ciphertext still exists; we say so
7 days2
offline queue horizon for undelivered ciphertext, env-tunable
ML-DSA-87
the signature on every destruction root you can verify
| Parameter | Value | Source |
|---|---|---|
| Destruction receipt | ML-DSA-87 Merkle root, ctx QERYX-FSOR-ROOT-v1 | SPEC/06 §8.9 |
| Wrap key | HKDF from FSOR_MASTER_KEY — env-only, never persisted | fsor.rs |
| Delivery erase | sender, recipient, content nulled on ack | handlers.rs |
| Grace window | 10 minutes to hard purge | backend env |
| Offline horizon | 7 days, env-tunable | SPEC/06 |
| Re-fetch of erased | HTTP 410 FSOR_ERASED | handlers.rs |
| Cache + file purge | trigger fan-out, same window | SPEC/06 §8.7 |
04 / THE VERDICT — CATEGORY COLUMNS
Set true erasure against a delete button.
| QERYX | Classical E2E | SMS-tier | |
|---|---|---|---|
| Real workloads | |||
| Deletion trace | Cryptographic erasure plus a signed receipt | Delete-flag rows and backups persist | The carrier retains |
| Coerced unlock | Decoy PIN and duress paths | Not included | Not included |
| Sender metadata | Stripped from the stored row; authenticated at send | Sender visible to the server | The sender is the routing key |
| Backup residue | Envelope-locked — the key is destroyed | Restorable from backup | Plaintext backups |
| Screenshot attempt | Shielded surfaces block capture | Not included | Not included |
05 / THE HARD QUESTIONS
Ask what survives a delete.
Is deleted really gone?
The row is deleted, the caches purge, and the at-rest envelope key for that epoch is destroyed — bytes left in any backup are locked under a key that no longer exists. During the 10-minute delivery grace, ciphertext still exists; we say so.
What can be handed over under subpoena?
Undelivered ciphertext plus routing metadata under the retention ladder; for destroyed conversations, envelope-locked residue no key can open. Reading content requires breaking both X25519 and ML-KEM-1024.
Can the server see who I message?
Sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time; the relay routes by opaque identifiers. Undelivered messages queue with routing metadata under a published retention ladder.
What does panic wipe do?
It erases local key material and state on your device in one gesture. It cannot un-send what a recipient already holds — that is physics, and we put it in writing.
What does the decoy PIN show a captor?
A believable synthetic vault. The real compartment is cryptographically out of reach once duress fires.
Do screenshots work?
Surface capture is blocked on shielded surfaces — stream shield, scrim, overlay. A camera pointed at the screen is out of scope; no software defends against optics, and we will not claim otherwise.
Can I verify a destruction?
Yes. Every destroy emits an ML-DSA-87-signed Merkle root you can check against the pinned operator key.