Solutions · 02
Protect the source, the story, and yourself.
A compelled-production order resolves against ciphertext and opaque identifiers. Your source's name is not in our records, because it never entered them.
01 / THE ORDER — WHAT IT FINDS
Read the order, then read what it yields.
- your messages
- ciphertext only — sealed under ChaCha20-Poly1305 on your device; the relay holds no key
- who you talked to
- sender identifiers are stripped from the stored row (sealed sender); the relay authenticates the sender at send time and holds the conversation roster for routing
- your phone number
- never collected — identity is a keypair (ML-DSA-87) generated on your device
- undelivered queue
- routing metadata under a published retention ladder — stated, bounded, expiring
- group messages, reads without a receipt
- a group message, sealed to each member by default, and a message read with Stealth Mode on or read receipts off are retired without a receipt the relay can match, so their ciphertext stays on the relay until the 30-day horizon
- your photos and files
- each photo, video, file or group voice note you send is sealed on your device and stored apart from its message, with an upload record that names your account, for up to 45 days after upload — unless you delete the message for everyone or a chat timer purges it sooner
- your groups
- group names and descriptions end-to-end encrypted — the relay never receives them; the member roster it delivers to, the admin list and the avatar — held for routing, as row two says
Breaking a recorded session instead would require breaking both X25519 and ML-KEM-1024.
Plan for the day the device leaves your hands
A checkpoint, a raid, a stolen bag — the device is the real attack surface, so the app carries surfaces built for exactly that hour:
-
01
ERASURE
Panic Wipe
One deliberate action erases the local store — deleted, not hidden behind a flag.
-
02
DECOY
Decoy PIN
A second PIN opens a believable decoy surface while your real store stays sealed behind your real credential.
-
03
DURESS
Capture Scenario + Silent Distress
Preconfigured behavior for a coerced unlock, and a quiet signal to someone you trust over the same channel.
-
04
SHIELD
Screenshot and screen-recording shield
A chat's rows show black in a screenshot on this phone, and recordings meet a cover; a photo opened full screen is covered only while a recording runs, and a camera is out of scope.
Follow the path your traffic actually takes
A disappearing message leaves on your schedule, setting the phone's clock back does not keep it, and our relay is never told the timer. The whole stack is keyed post-quantum: hybrid ML-KEM-1024 + X25519 on every session, so a recording of today is not a story about you in ten years. Three-hop onion routing (QLEAP) is in development; nothing on this page depends on it, and the day it arrives this paragraph changes.
04 / THE HARD QUESTIONS
Ask the four a source would ask.
What can QERYX be compelled to produce about me?
Sealed ciphertext, opaque routing identifiers, and — for messages not yet delivered, a group message sealed to each member, and a message read with Stealth Mode on or read receipts off — routing metadata held to a published 30-day horizon. Each photo, video, file or group voice note you send is held too, sealed, with an upload record that names your account, for up to 45 days after upload, unless you delete the message for everyone or a chat timer purges it sooner. Sender identifiers are stripped from the stored message row (sealed sender), though the relay authenticates the sender at send time. There is no plaintext, no contact list, and no phone number on our side to produce.
What if my device is seized and I am forced to unlock it?
That threat is why the Decoy PIN, Capture Scenario, and Silent Distress exist. Be precise with yourself about the limit: a device unlocked with your real credential shows your real data. Once QERYX arrives, rehearse the duress surfaces before you need them.
Can my newsroom verify any of this instead of trusting it?
Yes — that is the point. The claims on this page anchor to the security overview and the evidence in the Trust Center, and a released build will be verifiable against the source via reproducible builds.
What can you not protect?
An endpoint compromised by implant-grade spyware reads what you read. A coerced unlock with your real credential opens your real store. A contact can keep what you send, whatever the timer, with a camera or another phone. And we cannot recover your account if you lose your device and recovery passphrase — there is no key-escrow and no master reset. We name the limits because your safety depends on knowing them.