9.1 Shadow ID
An identity that answers to no directory.
A second identity, minted at random inside the sealed compartment, that no directory ever links to your first — because no directory holds it.
Arrives in a later update, after the messenger.
- Profile ID SHA-256 · qeryx.identity.profile.v1
- Shadow pair keys HKDF-SHA-256
- Domain qeryx.identity.profile.v1
01 / THE DERIVATION — LETTERED
Follow one secret through two one-way doors.
One secret. Two worlds. Neither door opens backwards.
9.1 / A
Minted, never registered
A Shadow ID is 128 bits drawn fresh from the device's secure random generator every time you open the compartment. It is not derived from anything, so there is no secret it can be walked back to; it is filed nowhere, so there is nothing to look up. Close the compartment and the identity is gone — the next one shares no bytes with it.
SHA-256 · qeryx.identity.profile.v1
HKDF-SHA-256 · per-pair, per-direction
9.1 / B
Lives only in RAM
The Shadow ID surface keeps every piece of view state in RAM — no persisted state, no app storage. Close it and the surface forgets, and so does the identity: the next activation mints a new Shadow ID and drops every peer root agreed under the old one. Forgetting is the feature, and it is not reversible.
01
bytes the Shadow ID surface writes to app storage, the keychain, or disk
9.1 / C
Reached through the seal
Shadow ID renders as an overlay above the QSeal compartment — you reach it only through the sealed space, never from the regular app.
Nothing registers, so nothing can be looked up.
02 / THE VERDICT — CATEGORY COLUMNS
Set it against an alt-account and a second SIM.
| QERYX Shadow ID | Alt-account on classical E2E | Second SIM | |
|---|---|---|---|
| Real workloads | |||
| Linkability | Fresh random per session — no registration | Same phone number or account graph | Carrier links both |
| Persistence on device | RAM-only surface | Second profile persisted | Physical artifact |
| Directory lookup | Nothing to query | Discoverable by identifier | Number is public |
| Setup trail | None — nothing is filed | Signup metadata | Purchase trail |
03 / THE HARD QUESTIONS
Ask what can still be linked.
Is a Shadow ID an account?
No. It is 128 random bits minted on your device when you open the compartment. Nothing registers, so nothing can be looked up.
Can the two identities be linked?
Not by the directory — there isn’t one. The public handle is never an input to the shadow identity; nothing links them but you.
What persists on my phone?
Nothing. The surface keeps its state in RAM only, and closing it ends the identity as well as the view — the next session is a new Shadow ID with new keys.
What can be handed over under subpoena?
No shadow directory exists to query. Relay traffic is sealed blobs and opaque routing identifiers, and where a group roster exists the relay holds it under the published retention ladder — and Ghost Serpent is the pattern defense on the wire.
What is this for?
Work and relationships that must not enter your visible graph — sources, casework, second lives that stay second.