Whisper private chat (technical)
Whisper private chat is a time-limited, QR-started E2E session designed for conversations that should not become a permanent Buzzio social-graph edge.
Not the same product as Whisper Questions (
whisper.buzzio.dev), which stores owner-readable answers and is not E2EE like Whisper private chat.
Privacy properties
| Property | Status |
|---|---|
| Content E2EE | Yes — session keys on participant devices |
| Durable server transcript after expiry | No — session/relay cleanup |
| Typical lifetime presets | ~1 hour up to ~168 hours (7 days) |
| Scan / join limits | e.g. up to ~50 scans depending on settings |
| Creator mapping | Isolated from public session docs (Admin/CF read) |
| FCM | Wake-only (no embedded ciphertext blob) |
qr_chats access |
Authenticated (auth != null); further membership hardening on roadmap |
How it works
- Creator starts a Whisper session; QR encodes join material for the session.
- Participants derive/store session crypto locally (SQLite / secure local store).
- Messages are encrypted before upload to
qr_chats/{token}/…style relay paths. - Optional Vanish / Secure View apply inside the session.
- On expiry, server session records and relay paths are deleted; local session data is removed per design.
Why it strengthens the privacy product
Whisper attacks the graph problem: many private messengers still leave a durable “you chatted with X” edge even when content is encrypted. Whisper’s product goal is meet → talk → expire → leave no lasting sealed chat archive for that room.
Roadmap honesty
Full sealed-sender treatment for Whisper envelopes (beyond Phase 0 creator/FCM/rules hardening) may still be incomplete relative to 1:1 Phase 1. Public docs should say “E2E session with metadata minimization,” and only claim sealed-envelope parity when that phase ships.