Solutions · 01
Privacy you would want for your family.
On by default, at maximum, for everyone you talk to. A fresh key for every message you send — and a relay that cannot read a single one.
01 / A DAY YOU ALREADY LIVE
Walk one ordinary day, sealed end to end.
-
07:42
ChaCha20-Poly1305
You send the school-run photo.
Sealed on your phone under a fresh Q-Ratchet key before it leaves your hand. The relay carries ciphertext it cannot open.
-
13:05
ML-KEM-1024 + X25519
You call your mother.
The call is keyed by the same hybrid handshake as your messages and routed through the relay, so your home address is not handed to the network.
-
19:30
Q-GROUPCIPHER
The family group plans the weekend.
Group name, description, and every word are end-to-end encrypted — the relay never receives them; the member roster it delivers to, the admin list and the avatar are held for routing.
-
22:15
ERASURE
You delete a message you regret.
Deleting it removes it from your phone. Our relay deletes its copy of a delivered message within about 25 minutes of the delivery receipt; a group message, sealed to each member by default, or one read with Stealth Mode on or read receipts off, waits for the 30-day horizon.
02 / THE ENVELOPE — WHAT THE RELAY HOLDS
Read everything the relay holds of that photo.
- payload
- ciphertext — ChaCha20-Poly1305, sealed on your device
- route_id
- opaque identifier — maps to no name, no number
- sender
- stripped from the stored row (sealed sender); authenticated at send time
- your phone number
- never collected — identity keys are generated on your device (ML-DSA-87)
- after delivery
- the message row is deleted within about 25 minutes of the delivery receipt, or at the 30-day horizon for a group message, sealed to each member, and for one read with Stealth Mode on or read receipts off; the photo itself is stored apart, encrypted, with an upload record that names your account, for up to 45 days after upload unless you delete it for everyone or a chat timer purges it sooner; undelivered messages queue with routing metadata under a published retention ladder
The server is a dumb encrypted blob relay. It cannot read messages.
Take a fresh key for every message
Q-Ratchet advances the key with every message you send. A key stolen today opens nothing you said yesterday, and the conversation heals forward on its own — the stolen key goes stale in your next breath.
Make today’s recording worthless in ten years
Adversaries already record encrypted traffic to decrypt later, once quantum computers mature — the migration deadlines in national standards exist because of it. Every QERYX session is keyed by hybrid ML-KEM-1024 (FIPS 203) + X25519, so reading a recorded session requires breaking both.
Know what we cannot do — on purpose
We cannot recover your messages or your account if you lose your device and your Secret Phrase. There is no key-escrow and no master reset. That limit is the design: a recovery door for you would be a recovery door for anyone.
06 / THE HARD QUESTIONS
Ask the two that decide it.
Can QERYX read my messages?
No. Messages are sealed on your device before they travel; the relay holds ciphertext and opaque routing identifiers. There is no plaintext on our side to read, hand over, or lose.
Do I need a phone number?
No. Your identity is a keypair (ML-DSA-87) generated on your device. It says nothing about who you are.
Your people will be at the same floor.
Maximum for you is maximum for them — the floor is universal.