Changelog

Documentation-oriented release notes. Store “What’s New” text can stay short; this page tracks privacy- and architecture-facing changes.

App version in-repo: 1.1.3+32 (stores may lag or differ).

How to read entries

Add new dated sections newest first.

P1: Community send hot path coalesces parent/roles reads — one early community+channel snap threaded through permission, rate, tags, push
P2/P3: Shared media refcount-safe delete, unique-byte media quotas, global hash index default (shared_media/by_hash/…)
P5: Anonymous ops_cost_metrics counters + daily P4 gate rollup; billing export guidance in docs/OPS_COST_TELEMETRY.md
P4: Redis open-buffer design only (docs/REDIS_OPEN_BUFFER_DESIGN.md) — implement after ~200M msgs/mo or buffer pain
Verify deploy: docs/SHARED_MEDIA_DEDUP_VERIFY.md

Product · Privacy · Docs

Communities / Broadcast / open-history groups: new media uploads are CDN bytes on Bunny under …/by_hash/{sha256}/… with within-room content-hash dedup (lookupOrAllocateSharedMedia / confirmSharedMediaHash)
Text / captions remain server-held DEK ciphertext
Legacy .enc media still downloads with DEK decrypt
Stories / 1:1 / E2E groups unchanged
Docs: Shared media deduplication

Deploy note: Cloud Functions must be deployed for dedup callables before clients rely on hash hits.

Docs

New page: Why delivery still learns the sender — cert-gated sealed delivery kept for block / rate limits; unidentified delivery not claimed for default chat
Cross-links from privacy guarantees, sealed sender, threat model, FAQ, docs home

Privacy

SealedSender.allowLegacyFallback = false — no plaintext-from / peer-keyed control fallbacks on 1:1
RTDB: clients can only delete pending_chats and sealed_controls; creates go through Cloud Functions only
Receipts, Secure View, disappearing, once-view, kept, view-once, session_reset, key_regenerated, retry — sealed-only writes
Inbox parse sealed-only; non-sealed junk deleted (avoids reconnect re-download cost)
Legacy receipt_batches listener not started (real RTDB savings); sealed controls only
Dual-read of legacy message bodies removed — was CPU-only anyway; ship builds are sealed-end-to-end
Sealed 1:1 + conference call invite — deliverSealedCallInvite; no sender_id_hint / binary string on incoming; FCM/VoIP omit caller_id
Conversation-scoped presence — online/typing under presence_conv/{token}/{a|b} (opaque pair token + slots); global presence/{ghostId} no longer publishes s/h
Legacy teardown — receipt_batches client creates denied; 1:1 call map+hint dual-read gated off; optional Admin cleanup script

Docs

Updated sealed-sender status to write-cutover complete
Added Privacy guarantees — promises, ceilings, refusals (no phone discovery, non-custodial restore)
Stale “dual-write period” wording removed from troubleshooting / privacy policy / architecture pages

Privacy

Preferred sealed sender delivery for 1:1 (deliverSealedMessage, from: "sealed", FCM wake without sender_id)
Sender certificates issued by Cloud Functions (~24h TTL)
Dual-write / dual-read period: sealed preferred; legacy plaintext-from fallback still available until cutover
Phase 0 hardening: no plaintext reply_to.snippet on RTDB; opaque typing tokens; Whisper creator mapping isolated; Whisper FCM wake-only; stop growing server messaged_contacts graph

Docs

Product (live pillars useful for first-time readers)

Sealed 1-to-1 with delete-on-delivery design
Encrypted voice / video calls; local Call tab history
Groups: E2E or open-history; permanent or temporary (up to ~30 days)
Communities, Broadcast, Stories (~24h)
Whisper private chat (QR, up to ~7 days) and Whisper Questions (Free 24h / Link Pack 15d)
Buzzio ID + 12-word phrase identity (no personal phone/email required)
Optional encrypted backup with user-controlled recovery key

Freemium defaults documented separately: Premium and quotas.