Messages, relays and storage

Your community's posts, votes and settings travel through a relay, a server that passes them between members' devices and keeps them until everyone has caught up. Its files can be kept in storage the community chooses.

The relay is like a post office that sorts sealed envelopes; storage is a chest with two locks.

Relays carry sealed envelopes

• What the relay stores is encrypted. A community's log is encrypted end to end on members' devices before it's sent. The relay never gets the community's secret, so it can't read what's in it.
• What a relay can still see. That a room exists, when things are sent to it, how big they are, and roughly from where. It can't see what they say.
• Private messages are sealed twice. A message to one person is sealed so only they can open it, then wrapped again for the community. A member who carries a message to another relay can't open the inner layer either. Other members can see who is messaging whom, though, but not what.
• More than one relay. A community can use several relays, so it isn't cut off if one goes down. It always needs at least one.

You can run your own relay; see the technical reference.

Storage: your own bucket, two keys

A community can keep its files in its own S3-compatible bucket, rather than on Paramira's servers.

• It needs two custodians before it can be turned on, so a single lost phone can't lock the community out (see Custodians).
• The bucket's details and its access key are sealed separately to each member: the relay passes them on but can't read them.
• A clan can offer its own storage to its families, and a family can choose to use it.