BuzzioDocs

Changelog

Documentation-oriented release notes. Store “What’s New” text can stay short; this page tracks privacy- and architecture-facing changes.

App version in-repo: 1.1.3+32 (stores may lag or differ).

How to read entries

  • Privacy — sealed surfaces, metadata, retention, subprocessors
  • Product — user-visible features and limits
  • Docs — documentation site source changes

Add new dated sections newest first.

2026-09-24 — Sealed privacy hardening public summary

Privacy / Docs

  • Published Sealed privacy hardening summary on doc.buzzio.dev
  • Hardware-backed key custody — StrongBox/TEE / Keychain AES wrap for mnemonic and private keys (not hardware ECDH)
  • Independent audit page lists the summary; third-party firm report still pending
  • Sender certificate docs reconciled to ECDSA-secp256k1 v2

2026-09-19 — Saved Messages (Premium keep-forever thread)

Product

  • Premium Saved Messages: Settings-tile encrypted thread, unlimited text ciphertext, 200 MB media pool (delete-to-free)
  • Distinct from Note to Self (3-day mailbox, no durable vault) and Private Vault (file locker)
  • Overflow ⋮ Save to Saved Messages from 1:1, Note to Self, permanent groups, communities, and broadcast (hidden on temp groups, Whisper, view-once)
  • Linked web unwraps a stable Saved Messages key on link (does not rotate); session revoke wipes the browser copy

Docs

2026-08-27 — 1-to-1 Vanish Mode removed

Product

  • 1-to-1 chat no longer offers Vanish Mode (mutual after-seen timers from 5 seconds to 6 hours)
  • Incoming Vanish requests from older apps are auto-rejected; leftover sessions are turned off
  • Use once-view messages (swipe up, ~5 seconds after seen) or disappearing messages (24h / 7d / 90d)
  • 1-to-1 Secure View, view-once media, and device Screen security are unchanged

Docs

2026-08-27 — Whisper Secure View and Vanish removed; swipe-up once-view added

Product

  • Whisper private chat no longer offers create-time Secure View or Vanish
  • Each Whisper lane now has the same swipe-up once-view messages tool as 1-to-1 / E2E groups (text disappears ~5 seconds after seen)
  • View-once photos/videos and the session timer are unchanged
  • 1-to-1 Secure View stays as it is; 1-to-1 Vanish is retired (see newer entry)

Docs

2026-08-27 — Group and Community channel Secure View and Vanish removed

Product

  • Temporary E2E groups and Community channels no longer offer a room-level Secure View (screenshot-block) toggle
  • E2E groups and Community channels no longer offer create-time Vanish
  • Screenshot hardening there is the member’s own Screen security Privacy setting, plus view-once media while that item is open
  • 1-to-1 Secure View and view-once capture protection are unchanged; 1-to-1 Vanish is retired (see newer entry)
  • Worker editChannel no longer accepts prevent_screenshots

Docs

2026-08-26 — Bot Interaction Expansion

Product

  • Added public sendChoice with single/multi selection, explicit Confirm/Cancel, expiry, idempotent submit, and choice_answer updates
  • Expanded safe buttons/keyboards, callback replay/rate/ownership checks, regular/multi/quiz/timed polls, developer-mode checklist updates, and collapsible/media/actions rich blocks
  • Added indexed callback and choice interactions for workers in open-history groups and Communities, with membership/channel/install/value/expiry checks and idempotent delivery receipts
  • Payments, checkout, invoices, pay buttons, paid media, Stars, gifts, paid reactions, subscriptions, and bot premium are permanently not offered; method names return 404 and equivalent controls fail validation

Docs

  • Bot API catalog now has 151 public methods and documents the implemented interaction fields, payloads, updates, behavior, and limits
  • See Bot API, Bot API methods, Worker bots, and Bots

2026-08-26 — Premium owned-create cap (200)

Product

  • Premium no longer has unlimited owned creates. Cap is 200 active of each type: Whisper, privacy group, Open History Group, community, broadcast channel
  • Free stays 1 active of each
  • See Premium and quotas

2026-08-26 — Seed-level encrypted storage and shared-room model

Privacy

  • Private Vault and backup can derive separate, domain-separated wrapping keys locally from the account seed behind the 12-word phrase; the phrase is not uploaded
  • A separate 64-character recovery key remains available for each product
  • Open-history groups, Communities, and Broadcast use TLS in transit and store text/media without at-rest encryption; Buzzio can read them
  • Removed server-held DEK / server-side encryption claims for those shared rooms

Docs

Product coverage added

  • Note to Self: account-seed-derived encrypted cloud sync
  • Official Buzzio chat: verified, read-only announcements
  • Public Community search and @handle, hashtag search, protected-chat alert modes, and in-chat privacy notices
  • Hardware-assisted chunk encryption used by backup, Vault, and self-note media where supported

2026-08-23 — Bot premium removed (not offered)

Product

  • No bot premium product: no membership flags, checkout URLs, Get Premium, or grantUserPremium
  • setMyPremium / grantUserPremium / related methods return 404 (same bucket as Telegram invoices / Stars)
  • Buzzio app Premium (Play / App Store) is unchanged

Docs

2026-08-23 — Bot premium is web-only (no in-app buy button)

Superseded the same day by Bot premium removed. Kept for history.

Product

  • Store app: no Get Premium, Get, or checkout button in bot chat (Apple / Google)
  • Membership still worked after the developer called grantUserPremium
  • Developer checkout stayed on their own HTTPS site

Docs

2026-08-23 — Bot premium review + money banner

Product

  • Get Premium stays off for the public until the developer accepts Bot Premium Terms and Forge auto-accepts the offer
  • Bot chat banner links Terms and Privacy on developers.buzzio.dev; checkout confirms Buzzio never handles that money
  • grantUserPremium / revokeUserPremium return 403 until premium is live

Docs

2026-08-22 — Bot API Wave J (Buzzio-native pack)

Product

  • getMyInstalls lists accepted worker rooms; getChatHistory stays inside 7 days / 100 messages
  • reportMessage writes a staff-visible snapshot; resolveUsername never returns a hidden person
  • sendScheduledMessage stores until fire (60s–30 days); retryWebhook redelivers one update_id

Docs

2026-08-22 — Bot API Wave H (bot-owned sticker sets)

Product

  • Bots register a set with HTTPS WebP URLs they host; uploadStickerFile returns bzstk_…
  • sendSticker accepts that file_id or a URL; the Worker never downloads the WebP
  • Worker setChatStickerSet stores a room default pack on the OHG or community

Docs

2026-08-22 — Bot API Wave G (community channels as topics)

Product

  • Worker createForumTopic creates a Community channel that appears in the hub list
  • message_thread_id is the channel id; the general topic is the default channel
  • Close / hide / archive are channel flags (closed topics block member send)

Docs

2026-08-22 — Bot API Wave F (invites + join approval)

Product

  • Worker invite methods create the same https://links.buzzio.dev/join links the app already opens
  • Extra OHG invites (temp_invites) and join-request Updates (chat_join_request)
  • Optional HTTPS Mini App on the join gate

Docs

2026-08-22 — Bot API Wave E (worker rooms)

Product

  • Worker methods now include unpin-all, admin list, member count, room info, sender-chat bans, and default grant ticks
  • New OHG permission: Manage room info

Docs

2026-08-22 — Bot API Wave D (reactions, vanish, getFile)

Product

  • Long-press a bot-chat bubble to react; vanish bubbles (ephemeral) hide after their timer
  • Developers can call getFile for a 7-day signed inbound URL, and sendRichMessage for heading/list/table blocks

Docs

2026-08-22 — Bot API Wave C (rich send)

Product

  • Service-bot DMs can send polls, location, venue, contact, dice, albums, checklists, live photo, drafts, and more URL media types
  • Users can attach a photo in a bot chat; the bot Update includes photo[] with a 7-day file_id (max 2 MB)

Docs

  • Wave C methods and incoming file_id shape on Bot API

2026-08-22 — Bots, sticker API, and feature docs sync

Docs

Product (already in app; now documented)

  • Service bots (Start / DM), worker bots (OHG / Community), Forge (@forge_bot)
  • Sticker tray + third-party Add to Buzzio (sticker-api.buzzio.dev)

2026-08-15 — Premium perks list + help coverage

Docs

  • Documented the full in-app Buzzio Premium perk list (Smart Inbox, Stealth Stories, auto-translate, schedule, voice-to-text, custom lists, broadcast lists, pins, unlimited creates, 200 MB files, badge) on Premium and quotas
  • Clarified that Premium is separate from backup, Vault, Rocket Drop, and Link Packs

2026-08-15 — 1:1 call screen share + Cloudflare TURN

Product

  • 1:1 voice and video calls can share a screen. While someone shares, both cameras pause and both people see only that screen. One share at a time.
  • Capture continues if you press Home to show another app (Android notification / media projection).
  • iOS full-device share uses ReplayKit: tap share, then Start Broadcast and pick Buzzio.
  • See Encrypted calls

Privacy

  • Call connectivity relay moved to Cloudflare Realtime TURN (pay-as-you-go). Most calls stay peer-to-peer; TURN only when NAT/firewall blocks a direct path.
  • Cloudflare cannot decrypt call media (DTLS/SRTP). Typical TURN metadata: IPs, ports, session timing.
  • See Subprocessors

2026-08-11 — Independent security audit page

Docs

  • Added Independent security audit: current status (none published yet), planned Scope A/B, engagement checklist, public summary template, and future report home on doc.buzzio.dev
  • Expanded with detailed checklists A1–A11, B1–B12, client custody C1–C8, deferred shared D / wallet E, and auditor data-room artifact list
  • Cross-linked from Security disclosure, Cryptography overview, How to verify, Privacy guarantees, docs home, FAQ, and INDEX

2026-08-11 — Transfer plan 10 GB per-file max

Product

  • Rocket Drop / Transfer plan: hard max 10 GB per file (server-enforced); packs remain 100 GB / 400 GB total fuel
  • See Premium and quotas

2026-08-10 — Freemium redesign (unlimited messages)

Product

  • Removed daily message caps (client + RTDB rules + sealed deliver)
  • Free: 1 active Whisper / privacy group / OHG / community / broadcast
  • File send caps: free 50 MB, Premium 200 MB; Transfer plan up to 10 GB per file
  • See Premium and quotas

2026-08-10 — Open-source client reference

Docs

  • Published educational offline client package: buzzio-client-open-source (Phase 1–2: identity stubs + sanitized encryption UI)
  • Linked from How to verify, docs home, crypto overview, and security disclosure
  • Clarified: not the Play/App Store app; cannot talk to production servers

2026-08-10 — Docs audit remediation

Docs

2026-08-09 — Verify zero metadata page

  • Docs: New checklist Verify zero metadata (1-to-1 & Whisper) — how to confirm no durable conversation metadata after 1-to-1 delivery and Whisper expiry
  • Linked from docs home, FAQ, sealed vs shared, scoped zero-metadata definition, and feature pages

2026-08-07 — Shared-room cost cuts (P1–P5)

  • P1: Community send hot path coalesces parent/roles reads — one early community+channel snap threaded through permission, rate, tags, push
  • P2/P3: Shared media refcount-safe delete, unique-byte media quotas, global hash index default (shared_media/by_hash/…)
  • P5: Anonymous ops_cost_metrics counters + daily P4 gate rollup; billing export guidance in docs/OPS_COST_TELEMETRY.md
  • P4: Redis open-buffer design only (docs/REDIS_OPEN_BUFFER_DESIGN.md) — implement after ~200M msgs/mo or buffer pain
  • Verify deploy: docs/SHARED_MEDIA_DEDUP_VERIFY.md

2026-08-06 — Shared media deduplication Phase 1 (source)

Product · Privacy · Docs

Historical note: the text-DEK line below described the August 6 implementation state. It was superseded on August 26, 2026: new OHG / Community / Broadcast text is plaintext at rest with TLS in transit only.

  • Communities / Broadcast / open-history groups: new media uploads are CDN bytes on Bunny under …/by_hash/{sha256}/… with within-room content-hash dedup (lookupOrAllocateSharedMedia / confirmSharedMediaHash)
  • Text / captions were server-held DEK ciphertext at that time (superseded August 26)
  • Legacy .enc media still downloads with DEK decrypt
  • Stories / 1:1 / E2E groups unchanged
  • Docs: Shared media deduplication

Deploy note: Cloud Functions must be deployed for dedup callables before clients rely on hash hits.

2026-08-06 — Why not unidentified delivery (docs)

Docs

  • New page: Why delivery still learns the sender — cert-gated sealed delivery kept for block / rate limits; unidentified delivery not claimed for default chat
  • Cross-links from privacy guarantees, sealed sender, threat model, FAQ, docs home

2026-08-05 — Sealed sender write cutover (Signal-class envelope writes)

Privacy

  • SealedSender.allowLegacyFallback = false — no plaintext-from / peer-keyed control fallbacks on 1:1
  • RTDB: clients can only delete pending_chats and sealed_controls; creates go through Cloud Functions only
  • Receipts, Secure View, disappearing, once-view, kept, view-once, session_reset, key_regenerated, retry — sealed-only writes
  • Inbox parse sealed-only; non-sealed junk deleted (avoids reconnect re-download cost)
  • Legacy receipt_batches listener not started (real RTDB savings); sealed controls only
  • Dual-read of legacy message bodies removed — was CPU-only anyway; ship builds are sealed-end-to-end
  • Sealed 1:1 + conference call invite — deliverSealedCallInvite; no sender_id_hint / binary string on incoming; FCM/VoIP omit caller_id
  • Conversation-scoped presence — online/typing under presence_conv/{token}/{a|b} (opaque pair token + slots); global presence/{ghostId} no longer publishes s/h
  • Legacy teardown — receipt_batches client creates denied; 1:1 call map+hint dual-read gated off; optional Admin cleanup script

Docs

  • Updated sealed-sender status to write-cutover complete
  • Added Privacy guarantees — promises, ceilings, refusals (no phone discovery, non-custodial restore)
  • Stale “dual-write period” wording removed from troubleshooting / privacy policy / architecture pages

See Sealed sender · Privacy guarantees · Encrypted calls.

2026-08-04 — Sealed sender v1 and metadata minimization (Phase 0–1)

Privacy

  • Preferred sealed sender delivery for 1:1 (deliverSealedMessage, from: "sealed", FCM wake without sender_id)
  • Sender certificates issued by Cloud Functions (~24h TTL)
  • Dual-write / dual-read period: sealed preferred; legacy plaintext-from fallback still available until cutover
  • Phase 0 hardening: no plaintext reply_to.snippet on RTDB; opaque typing tokens; Whisper creator mapping isolated; Whisper FCM wake-only; stop growing server messaged_contacts graph

Docs

  • Public technical docs source expanded under web-doc/ for doc.buzzio.dev

See Sealed sender · Why Buzzio privacy.

2026-07 — Platform pillars (current product baseline)

Product (live pillars useful for first-time readers)

  • Sealed 1-to-1 with delete-on-delivery design
  • Encrypted voice / video calls; local Call tab history
  • Groups: E2E or open-history; permanent or temporary (up to ~30 days)
  • Communities, Broadcast, Stories (~24h)
  • Whisper private chat (QR, up to ~7 days) and Whisper Questions (Free 24h / Link Pack 15d)
  • Buzzio ID + 12-word phrase identity (no personal phone/email required)
  • Optional encrypted backup with user-controlled recovery key

Freemium defaults documented separately: Premium and quotas.

Template (copy for next release)

YYYY-MM-DD — Title

  • What changed (user-facing)
  • Privacy / retention / crypto note if any
  • Limits or prices changed?
  • Android-only / iOS-only?
  • See also: link to feature doc

Buzzio technical docs · doc.buzzio.dev · buzzio.dev · Support · Status · Updates · Developers · Stickers · Forum · All sites · Privacy · Terms