Buzzio E2E groups

Introduction

Group chat with a sealed lane — not a shared inbox.

Buzzio E2E groups are built for friends, family, private teams, and sensitive circles that need more than a 1:1 thread — without giving Buzzio a readable transcript. Each member seals messages with sender-key crypto before they leave the device. Our servers move ciphertext for short catch-up, then purge. Readable history lives in the locally encrypted database on each member’s phone.

We do not sell your data. Never. Not group messages. Not member lists. Not invite tokens.

Why Buzzio is best for private groups

What you get on the sealed group surface

The same private lane includes permanent and temporary E2E rooms, clear ownership roles, invite gates, and everyday chat tools — while message bodies stay sealed from Buzzio.

• Sender-key E2E encryption
• ~5-day ciphertext catch-up
• Permanent or temporary
• Super Admin & Admin roles
• Invite links & password
• Disappearing messages
• Advanced security
• Restrict sharing
• View-once media
• Up to 500 members

How to choose the right room

At create time you pick two axes: how history works, and how long the group lives. Encryption mode and permanence cannot be switched later — pick the room that matches the job up front.

This page is about the sealed E2E lane. Open-history groups are a separate, honestly labeled product for clubs and onboarding.

How it works

Sender-key crypto on top of 1:1

Buzzio E2E groups use Signal-style sender keys on top of your existing 1:1 Double Ratchet sessions. Each member generates their own sender-key material for that group on device, then distributes it to other members as encrypted control messages — protected by pairwise E2E, not as plaintext on the wire.

1. 1

   Each member makes a sender key

   Chain key + signing keys for that group stay on device.

2. 2

   Distribute over pairwise E2E

   Peers receive the distribution sealed inside 1:1 sessions.

3. 3

   Seal group messages

   Messages use the sender’s chain; peers who got the key can unlock.

4. 4

   New members get future traffic

   Adding someone distributes current keys — not a full old cloud archive.

Blind relay — ciphertext, not a transcript

Servers see encrypted blobs plus the routing needed to reach group members. They never see readable text, photos, or voice content as a durable operator archive. When someone joins later, they get keys for future traffic — not an open cloud backscroll of everything said before they arrived.

About 5 days of encrypted catch-up

Encrypted delivery traffic is retained briefly so offline members can catch up — on the order of about 5 days for E2E group buckets — then purged. We do not keep a durable readable transcript of what E2E group members said. Readable history lives on devices, not in a Buzzio inbox you can search later from our side.

Courier for the circle — not a permanent filing cabinet for the room.

Permanent vs temporary E2E

Temporary is not a soft “maybe delete someday.” It is a scheduled lifetime you choose at create: from 1 hour up to 30 days. When the window ends, the group is deleted by design — server group state cleaned, members notified, local chat wiped.

E2E vs open-history — honest difference

How a group message moves

Offline members catch up from encrypted buckets while they still exist. After the window, there is no durable readable E2E transcript for Buzzio operators to open later.

Roles & invites

Super Admin vs Admin — clear ownership

Super Admin is the creator (ownership can transfer under rules). Admins are listed separately. Members are everyone else. Day-to-day power is membership, roles, invites, pins, and moderation gates — not a post-create free-for-all on encryption mode.

Invite links carry tokens — not keys

Invite links carry group id, invite token, and display name encoding — not encryption keys and not your 12-word phrase. Regenerating the token invalidates old links. Share links like door codes; treat regeneration as the emergency lock change.

• Invites grant membership — they do not bypass E2E key distribution
• Regenerate token to kill leaked links
• Only Super Admin can regenerate the invite token
• Admins and Super Admin can view / share the current link

Password, approval, and bans

Up to 500 members

Each group supports up to 500 members. At larger counts (around 100+), per-message push wake may be batched for scale — members still get messages via normal sync. The privacy model does not flip because of push batching.

Privacy controls

Disappearing messages

Open group info → Disappearing messages. New messages disappear for everyone after the selected time. Messages sent before the timer was set stay in the chat. Countdown options for E2E groups: 5 seconds · 10 seconds · 5 minutes · 24 hours · 7 days · 90 days — or Off.

• Applies to new text and media in that E2E group
• By default, anyone in the group can turn the timer on or change it
• Admins can lock changes to admins only via Advanced security
• Not room-level Vanish — use once-view media or a temporary group when the whole room should end

Disappearing messages are an E2E-group control. Open-history groups do not use this sealed timer path.

Advanced security (admins)

Open group info → Advanced security. These controls apply only to that encrypted group. Only Super Admin and Admin can edit them; members can open the screen to see the current state.

Restrict sharing

From Advanced security → Restrict sharing, admins can stop new messages in that E2E group from being forwarded, shared out, saved to Saved Messages, or saved to the gallery. Messages sent before Restrict sharing was turned on stay unrestricted.

• Admin-only toggle for the group
• Applies to new messages while it’s on
• Keeps sensitive threads inside the room
• Does not create a Buzzio-readable cloud transcript

Use it when the circle’s content should stay in the circle — not wander into forwards and screenshot folders.

Chat tools

Everyday group features

Sealed does not mean sparse. E2E groups still include the tools people expect for real circles — without turning the room into a data shop.

• Replies
• Reactions
• Pinned messages
• Starred (local)
• Forward
• Media gallery
• Read receipts (per-device)
• Lock group (local)
• Report
• Batch remove / ban

View-once media in groups

Groups do not have room-level Vanish or a room-level Secure View toggle. Use view-once media, or a temporary group when the whole room should end. Screenshot hardening follows each member’s own Screen security setting under Privacy.

Group view-once media uses a dedicated viewer with screen security, a short auto-clear open window (~20s class), and no “opened” receipt pinged to the sender the way some 1:1 once-view flows behave — designed to reduce notification side-channels in multi-member rooms.

Admin room controls

What’s not in groups (so we don’t overclaim)

• @mentions as a first-class group feature
• Polls
• Message edit as a first-class flow
• Room-level Vanish (use once-view, timers, or temporary groups)
• Room-level Secure View (use device Screen security)
• Bots — sealed E2E groups stay bot-free

Need Discord-scale roles, channels, and events? That’s the Communities surface. Groups stay the focused small/mid room.

Why it’s secure

The crypto stack — safe to say publicly

Serious private messengers advertise how locks work. Naming sender keys, pairwise Double Ratchet distribution, and short catch-up retention builds trust. It does not hand attackers your account keys. Your 12-word phrase and private messaging keys stay under your control.

Metadata honesty for groups

“Zero metadata” for 1:1 — no durable who-talks-to-whom graph when nothing is undelivered — is a private 1:1 claim. Groups necessarily keep membership and roles so the room can run. That is administration, not a sold social graph for ads.

Owner responsibility

The Super Admin, admins, and members of an E2E group are fully responsible for that space — including who they invite and what they allow. Buzzio cannot read E2E group message bodies. We may still act on reports, membership/admin records, and limited evidence a reporter submits from their device — including restricting or disabling the group — without decrypting the transcript.

What sealed E2E groups do not mean

It does not mean Buzzio stores zero bytes for the room. Groups need membership, roles, invites, and push routing so the product works. Removing a member stops future membership access; this build does not rotate every historical sender key on remove — treat device access and leave/ban as part of group security hygiene.

Open-history groups, Communities, and Broadcast store more by design because those products need shared continuity. E2E groups are the sealed group lane.