Solutions · 02
Protect the source, the story, and yourself.
A compelled-production order resolves against ciphertext and opaque identifiers. Your source's name is not in our records, because it never entered them.
01 / THE ORDER — WHAT IT FINDS
Read the order, then read what it yields.
- your messages
- ciphertext only — sealed under ChaCha20-Poly1305 on your device; the relay holds no key
- who you talked to
- sender identifiers are stripped from the stored row (sealed-sender v2); the relay authenticates the sender at send time and holds the conversation roster for routing
- your phone number
- never collected — identity is a keypair (ML-DSA-87) generated on your device
- undelivered queue
- routing metadata under a published retention ladder — stated, bounded, expiring
- group rosters, names, subjects
- end-to-end encrypted — the relay routes by opaque identifiers
Breaking a recorded session instead would require breaking both X25519 and ML-KEM-1024.
Plan for the day the device leaves your hands
A checkpoint, a raid, a stolen bag — the device is the real attack surface, so the app carries surfaces built for exactly that hour:
-
01
ERASURE
Panic Wipe
One deliberate action erases the local store — a true erasure, not a hidden flag.
-
02
DECOY
Decoy PIN
A second PIN opens a believable decoy surface while your real store stays sealed behind your real credential.
-
03
DURESS
Capture Scenario + Silent Distress
Preconfigured behavior for a coerced unlock, and a quiet signal to someone you trust over the same channel.
-
04
SHIELD
Screenshot and screen-recording blocker
The conversation surface refuses casual capture on-device.
Follow the path your traffic actually takes
Disappearing messages leave on your schedule and leave nothing behind. The whole stack is keyed post-quantum: hybrid ML-KEM-1024 + X25519 on every session, so a recording of today is not a story about you in ten years. Three-hop onion routing (QLEAP) is not in this build; nothing on this page depends on it, and the day it ships this paragraph changes.
04 / THE HARD QUESTIONS
Ask the four a source would ask.
What can QERYX be compelled to produce about me?
Sealed ciphertext, opaque routing identifiers, and — for messages not yet delivered — routing metadata held under a published retention ladder. Sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time. There is no plaintext, no contact list, and no phone number on our side to produce.
What if my device is seized and I am forced to unlock it?
That threat is why the Decoy PIN, Capture Scenario, and Silent Distress exist. Be precise with yourself about the limit: a device unlocked with your real credential shows your real data. Rehearse the duress surfaces before you need them.
Can my newsroom verify any of this instead of trusting it?
Yes — that is the point. The claims on this page anchor to the security overview and the evidence in the Trust Center, and the build can be verified against the source via reproducible builds.
What can you not protect?
An endpoint compromised by implant-grade spyware reads what you read. A coerced unlock with your real credential opens your real store. And we cannot recover your account if you lose your device and recovery passphrase — there is no key-escrow and no master reset. We name the limits because your safety depends on knowing them.
The story is yours to keep.
Ciphertext for them. A messenger for you.