01 · AT A GLANCE
Your words are encrypted before they leave your device.
Matters uses end-to-end encryption for the personal content shared through the app. The server stores encrypted envelopes and cannot read the protected text.
CONTENT
Profiles, Matters and their settings are encrypted for you and the intended friends.
EMOJI REACTIONS
Each reaction is visible only to its sender and the Matter’s author. Recipients cannot see who else received the Matter.
YOUR MESSENGER
Matters has no in-app text chat. One tap opens the messenger choice with the Matter context ready. You complete and send there; that service applies its own privacy and security rules.
PRIVATE VOTES
Individual poll choices stay private; friends receive only aggregated totals.
PRIVATE HISTORY
Archived Matters are encrypted only for their owner.
02 · ENCRYPTED CONTENT
Encryption happens on the device.
The app encrypts content before uploading it and decrypts it only on authorized devices. Supabase stores ciphertext together with neutral placeholders; database rules reject plaintext writes for protected content.
A friend receives access through an individually encrypted circle-key grant. Removing a friend rotates the circle key and re-encrypts current shared content.
TECHNICAL DETAILS
The implementation uses TweetNaCl 1.0.3. Current circle content uses a 32-byte key with XSalsa20-Poly1305 and a fresh 24-byte nonce for every write. Circle-key grants use X25519, and Ed25519 signatures bind the sender and context to each encrypted envelope.
03 · KEYS AND DEVICES
Private keys stay on your device.
Encryption identity material is created on the device and stored with the operating system’s secure storage: iOS Keychain with “when unlocked, this device only” protection, and Keystore-backed SecureStore on Android.
The recovery key is never uploaded. Matters cannot reset it or recover encrypted content without it. The encrypted local cache is tied to the account and project and cannot be opened by another account.
SAFETY NUMBERS
Public keys are pinned locally on first use. If a friend’s key changes later, sharing stops. Safety numbers can be compared through a trusted channel to detect a first-contact key substitution.
04 · WHAT REMAINS VISIBLE
End-to-end encryption does not hide all metadata.
The service can still see account identifiers, public keys, friendships and circle membership, invitations, timestamps, payload sizes, ordering, language, timezone, feature permissions and network metadata.
Emoji reactions use opaque tokens whose emoji mapping is stored inside the encrypted Matter. The service can see the reaction sender, token, timestamps and counts, but not the plaintext emoji mapping. Report reasons and details are readable by moderators when you choose to submit them. Decrypted reported content is not uploaded automatically.
05 · ACCESS CONTROLS
Encryption is one layer, not the only one.
Database row-level security limits which signed-in accounts may request each record. Signed envelopes detect altered content, and the app rejects wrong contexts, unknown key generations and malformed decrypted data.
A publishable API key identifies the application; it is not an encryption key. Private keys and recovery codes are never stored in Supabase.
06 · LIMITS
Clear limits are part of good security.
This is a custom envelope protocol built from established cryptographic primitives. It has not yet received an independent security audit and it is not an implementation of Signal.
The current design does not provide a ratchet, forward secrecy, post-compromise security, key transparency, server-rollback detection or per-device revocation. Removing a friend prevents future access after key rotation, but cannot erase content or keys that person already received.