Values only hold if the mechanism enforces them. Here is how Cinderous gets a message from you to your friend safely — without trusting any server.
Every message is Gift-Wrap encrypted on your device first; relays only forward ciphertext — they see neither the content nor the sender. Real-time bits (files, presence, typing) go over WebRTC P2P, straight peer-to-peer, bypassing relays entirely.
With many nodes in the network, no single one is on the critical path. You and your friend each connect to any available relay — relays only forward ciphertext; if one goes offline, messages route via others automatically. Which nodes are available is decided by a maintainer-signed node list (auto-seat on sign-in), while real-time interactions go straight over WebRTC P2P, bypassing relays entirely.
Encrypted with Nostr NIP-17/44/59 (Gift Wrap) — relays see neither the content nor the sender.
Communicates over Nostr relays and WebRTC P2P; no central server holds your messages — relays only forward ciphertext.
Your keys and data stay on your device. Plaintext never touches the cloud; lose all devices and the account ends — no database to subpoena.
AGPL-3.0 licensed, fully auditable. No ads, no selling accounts, no centralized monetization.
To stay scalable, multi-device, and reliable on calls — all while keeping zero server state — Cinderous recently landed a few mechanisms, every one of them keeping relays to ciphertext only.
A single relay can split its inbox into shards by public key (Durable Objects), spreading load and scaling without any central state; online presence runs on a separate layer, decoupled from message shards. Sharding only changes routing — the relay still sees only ciphertext and public keys, with no conversations to browse (ADR-0241).
One identity can sign in on several devices. Mutable state — contacts, groups, settings — merges via CRDTs (OR-Set / LWW / tombstones), so simultaneous edits on two devices converge without conflict; deletions are tombstoned and garbage-collected on expiry. Devices exchange only an encrypted state snapshot, and relays see ciphertext throughout (ADR-0242 / 0071).
Voice/video and files prefer a direct WebRTC P2P link, bypassing relays entirely. Connection setup uses STUN to discover public addresses; when symmetric NAT or a strict firewall blocks a direct path, it falls back to a TURN relay with short-lived credentials (minted on demand by the Worker, with expiry) to minimize failed calls. Enterprises can force relay-only (TURN) to satisfy network policy (ADR-0243 / G2).
No key escrow means no backdoor, so device migration offers three self-held paths: an encrypted backup code, an opt-in encrypted cloud snapshot (relays see only ciphertext), and desktop pairing clone (a one-time P2P full transfer confirmed via a short SAS code, content never touching a relay). Registering an important identity on two devices is recommended for redundancy.
Built on the open Nostr protocol: messages are encrypted and wrapped with NIP-17/44/59 (Gift Wrap), relay connections are authenticated with NIP-42, and NIP-13 proof-of-work deters abuse. Real-time interactions (files, presence, typing) go over WebRTC P2P, straight peer-to-peer, bypassing relays entirely. All open standards — implementable and auditable by anyone.
Links in messages are checked against open-source threat-intelligence lists (URLhaus, StevenBlack) — matching happens entirely on your device; URLs are never sent to any server. Flagged links are masked with their source shown; you can add your own blocklist, go strict (no reveal, block sending), or turn it off entirely.
Messages you send can be encrypted to a rotating encryption subkey; once you rotate and let the old key expire, ciphertext recorded earlier stays unreadable even if your identity key is stolen later. **This is implemented but has not been reviewed by an independent cryptography audit** — crypto bugs don't break anything visibly, they just fail to protect, with no symptoms. So it is off by default and you turn it on yourself under Settings → Privacy, and we do **not** list it alongside products that have been through multiple audits in the feature comparison.