Canonical terms for doc.buzzio.dev. Prefer these names in all public docs.
Identity
Term
Definition
Buzzio ID
Random 12-digit public account address (often shown with dashes). Not derived from the recovery phrase.
12-word recovery phrase
On-device mnemonic that derives messaging keys. Buzzio never receives it.
@username
Optional public handle mapped to a Buzzio ID.
Ghost ID
Legacy / internal field name for the same account address in some code paths. Public docs say Buzzio ID.
Backup recovery key
Optional 64-character key that unlocks an encrypted history backup. You can instead use a dedicated wrapping key derived locally from the account seed behind the 12-word phrase.
Seed-level account encryption
Optional local derivation of dedicated Vault or backup wrapping keys from the account master key. Separate domain labels prevent Vault, backup, and messaging key reuse; the phrase is not uploaded.
Privacy modes
Term
Definition
Sealed
Content keys on devices; servers relay ciphertext; no durable operator-readable transcript; after delivery/expiry, no durable private who↔whom archive on that path.
Shared
Product needs operator-readable data and/or durable history. Open-history groups, Communities, and Broadcast use TLS in transit and plaintext at rest; Stories and Whisper Questions have their own documented models. Still never sold. Shared-room media may use CDN storage + content-hash reuse (dedup).
Zero metadata (scoped)
No durable server archive of who privately talked to whom and what they said on sealed 1-to-1 and Whisper private chat after delivery / expiry. Short undelivered queues and accounts still exist while delivery is in flight. Not “stores nothing” or Tor anonymity. See scoped definition.
Blind relay
Architectural goal for sealed delivery: move ciphertext, delete after delivery (undelivered sealed 1:1 purge ~3 days), do not keep a private cloud inbox.
Delete-on-delivery
Pending sealed envelope removed from the relay when the recipient’s device takes delivery.
Sealed sender
Outer envelope that hides plaintext sender identity from the relay from field and FCM wake; recipient opens with identity key.
Certificate-gated delivery
Delivery Cloud Function verifies a short-lived sender certificate so block and rate limits work. Distinct from unidentified delivery. See Why delivery still learns the sender.
Shared-leaning
Mostly social/ephemeral product data (e.g. Stories audience/views) — not sealed like 1:1 and not a durable shared-room plaintext archive.
DEK
Data encryption key. Sealed surfaces and encrypted storage products use client-held DEKs. Legacy shared-room ciphertext may also contain old DEKs, but new OHG / Community / Broadcast content does not use an at-rest DEK privacy model.
Operator-readable
Buzzio can access content needed to operate a feature. For OHG / Community / Broadcast, text is plaintext at rest and media is CDN-stored without at-rest encryption; this is stronger visibility than merely holding a service-side key.
Cryptography (short)
Term
Definition
X3DH
Asynchronous key agreement used to bootstrap a 1:1 session.
Double Ratchet
Evolving message keys for ongoing 1:1 sessions (forward-secrecy style goals).
Sender keys
E2E group crypto: one ciphertext per group message with member sender chains.
AES-GCM
Authenticated encryption used for payloads and sealed outer envelopes.
SQLCipher
Encrypted local database for readable private history on device.
SenderCertificate
Short-lived cert issued by Cloud Functions so sealed delivery can enforce abuse limits without trusting client-written from.
In-chat privacy tools (do not mix)
Term
Definition
Secure View
Mutual mode in 1-to-1 that hardens screenshot / screen-recording protection while active. Pending 1-to-1 requests expire ~2 hours. Not a group, Community channel, or Whisper setting. (Implementation may say “Secure Mode” — public name is Secure View.)
Vanish
Retired. Older 1-to-1 Vanish / Secure Mode timers are no longer offered. Use once-view messages (~5 seconds after seen) or disappearing messages (24h / 7d / 90d).
Disappearing messages
Chat-level timers: 24 hours / 7 days / 90 days.
Once-view messages
Designed to leave shortly after seen (~5 seconds) with stronger screenshot protection. Used in 1-to-1, E2E groups, and Whisper lanes (swipe up).
View-once media
Photo/video opens once, then leaves the thread experience.
Kept messages
Exempt selected messages from disappearing timers.
Products
Term
Definition
1-to-1 chat
Default sealed private messaging between two people.
Encrypted calls
Voice/video on the 1:1 surface; encrypted signaling; P2P media when possible; no server recording archive.
Whisper private chat
Time-limited QR E2E session; deleted after expiry.
Whisper Questions
Anonymous ask links (whisper.buzzio.dev); owner-readable; not E2EE like Whisper private chat.
E2E groups
Group chat with sender-key E2EE; short catch-up relay (~2 days); no full open archive for late joiners.
Open-history groups
Groups with plaintext shared backscroll so members (including late joiners) can catch up; media as CDN + dedup.
Communities
Discord-style shared spaces with roles, channels, events; plaintext text on Buzzio servers; media as CDN + dedup.
Broadcast channels
One-to-many admin feeds; TLS in transit, plaintext text/media at rest, Buzzio-readable; CDN dedup rolling out; ~30-day posts.
Stories
~24-hour status posts with audience controls (shared-leaning).
Service bot
Third-party bot people search (@…bot), Start, and DM on the 1:1 dashboard. Not E2E — developer webhook receives text.
Worker bot
Room tool for open-history groups / Communities. Installed via admin request + developer Accept. Not in people search.
Forge
Official @forge_bot control bot for creating bots and tokens.
Bot API
Telegram-shaped HTTP API on developers.buzzio.dev for bot tokens (bzbot_…).
Stickers
On-device tray packs; third-party Add to Buzzio via app or web import (sticker-api.buzzio.dev).
Note to Self
Device-first encrypted notes; 3-day mailbox on linked web — not a durable cloud vault.
Saved Messages
Premium keep-forever encrypted personal thread; ciphertext on Buzzio servers; 200 MB media pool; stable SMRK (does not rotate on web link). Distinct from Note to Self and Vault.
Private Vault
Optional client-encrypted personal file locker; unlock with a dedicated seed-derived account key or separate 64-character recovery key. Not chat backup.
Optional Bitcoin wallet
Non-custodial wallet (18+) derived from the same mnemonic when enabled.
