Encryption in plain language
Who this is for: anyone who wants the mental model before reading protocol pages.
The short version
- Your 12-word phrase creates secret keys on your phone. Buzzio never receives that phrase.
- Private (sealed) chats are locked so that only the people in the chat can read the words and media.
- Servers mostly move locked packages and then delete them after delivery (or after a short wait if the other phone is offline).
- Some products (Communities, Broadcast, open-history groups, Whisper Questions) need the service to operate the room — those are labeled shared and are not the same privacy story as 1-to-1.
Sealed vs shared (one metaphor)
| Mode | Metaphor | Buzzio role |
|---|---|---|
| Sealed | Sealed letter | Blind courier: cannot read the letter; does not keep your mailbox forever |
| Shared | Shared notebook in a clubhouse | Hosts the notebook so late joiners and moderators can use it |
Matrix: Sealed vs shared.
What “sealed sender” adds
Even with locked contents, a courier who always writes “From: Alice” on the outside learns who talks to whom. Sealed sender wraps the outer label so the preferred path does not need a durable plaintext “from Alice” on the undelivered package. The recipient still learns who wrote it when they open the package.
Buzzio still checks a short-lived sender certificate at delivery so block and fair-use limits work. That is not Tor anonymity. See Why delivery still learns the sender.
What encryption does *not* mean
- Your ISP / Wi-Fi / Firebase can still see that you use Buzzio.
- A stolen unlocked phone can show chats already decrypted on the device.
- Shared rooms are not operator-blind.
- Screenshots and second cameras are outside cryptography.
Go deeper
| Level | Page |
|---|---|
| Guarantees | Privacy guarantees |
| Technical stack | Cryptography overview |
| 1:1 sessions | X3DH and Double Ratchet |
| Envelopes | Sealed sender |
| Verify yourself | How to verify |