Saved Messages
Saved Messages is a Premium keep-forever personal thread: chat-shaped, end-to-end encrypted, stored as ciphertext. It is not Note to Self and not Private Vault.
Open it from Settings. You can also copy a message from another chat with Save to Saved Messages (overflow ⋮). Temporary groups, Whisper, and view-once messages cannot be saved.
Three products (do not mix)
| Product | Job | Key | Server keeps |
|---|---|---|---|
| Note to Self | Scratch pad on your devices | NRK (rotates every web link) | 3-day mailbox only — Note to Self |
| Private Vault | Large private files | Vault recovery / seed wrap | Durable encrypted files — Private Vault |
| Saved Messages | Keep a message forever | Stable SMRK (does not rotate on web link) | Durable ciphertext + 200 MB media pool |
Buzzio cannot read Saved Messages bodies. Operators can see that the account has a store (sizes, timestamps, delete events) — not a zero-metadata 1:1 claim.
Premium
- Write (compose, save from other chats, upload media): Buzzio Premium or gift Premium.
- Read / delete after Premium ends: still allowed. No delayed wipe.
- Text: unlimited ciphertext (rate limits still apply).
- Media: one 200 MB lifetime pool of encrypted stored size. Delete a media message to free bytes.
- Auto-delete: none. We do not expire saved messages.
Free users see the Settings tile. Tapping opens the thread plus an explainer / subscribe sheet. Composer stays locked until Premium.
Encryption
- Phone holds a Saved Messages Root Key (SMRK), wrapped by the account master key from the 12-word phrase. Never uploaded.
- Each message uses a random DEK. The server stores GHSM envelopes only.
- Media files are encrypted; Bunny objects are opaque
.encundersaved_messages/{account}/…. - Restore: seed → unwrap SMRK → pull ciphertext → decrypt locally.
Linked web (`web.buzzio.dev`)
Same class of companion access as Note to Self — not sealed 1:1 in the browser.
- On link, the phone ECDH-wraps SMRK for that browser (context
buzzio-linked-web-smrk-v1). The wrap blob is redeemed once and deleted. - SMRK itself stays stable. Unlink does not rotate it (unlike Note to Self NRK).
- The browser holds SMRK in session storage for the session TTL. Logout / revoke / expiry wipes the web copy.
- Catch-up is
listSavedMessagesSincewith a session token — not a Firestore list-on-open.
Stolen web session can read Saved Messages until you revoke or the session expires. See Why E2E chat is not on the web.