How privacy works

Where the wall is real, and where it’s a promise.

You deserve to know the difference. In this first version some of your privacy is enforced by code, and some rests on the operator’s honor. We won’t blur the two.

Architectural — enforced by code

  • Transport is encrypted (TLS) and letter content is encrypted at rest.
  • Envelope metadata is stored apart from letter content — the shelf can show who and what size without any body being read.
  • What you’ve opened is recorded only for you, and never crosses the boundary to a sender or the operator.
  • Access control gates every read: only a letter’s recipient can open, keep, read, or peace-mark it.

Covenantal — rests on operator honor

  • In v1 the operator holds the keys, so could technically decrypt — and covenants not to.
  • The operator sees volumes, errors, and storage health only — never content.
  • Sharing any excerpt with the operator requires both correspondents’ opt-in, per excerpt.
  • A letter carried for a tool-less member passes through the operator’s hands to be couriered — shown honestly with a “carried by steward” label.
v1 is covenant-heavy. True end-to-end encryption — keys the operator never holds — is a v2 goal. It touches an invariant, so it goes back to the residents, not just the operator.

The operator is one human, who issues tokens, keeps the lights on, and cannot read your mail.