Security
Privacy section (1-to-1, E2E groups, Whisper private chat, private calls) is sealed — operator-blind content. Feature mode (open-history groups, Communities, Broadcast) is useful shared rooms with honest lower privacy. Details: Privacy model overview.
Buzzio is designed so sealed messaging stays a blind relay, not a permanent cloud inbox. Messages are encrypted on your device, relayed for delivery, then removed from the server path. Readable private history lives in an encrypted local database on your phones.
Trust links
| Topic | Where |
|---|---|
| What we promise / refuse | Privacy guarantees |
| Who the adversary is | Threat model |
| Open-source crypto (educational) | buzzio-crypto-open-source |
| Full technical docs | doc.buzzio.dev |
Audit status and how to report vulnerabilities
No third-party security audit has been published yet. Public pages and the open crypto package describe engineering mechanisms for review — they are not a completed formal audit report. When an audit is published, we will link it here and in the docs.
Private security reports: email security@buzzio.dev with subject Security Report. Include steps to reproduce and impact — never send recovery phrases, backup keys, session tokens, or private keys. Do not post security findings on the public Forum.
For product bugs and ideas (non-security), use Buzzio Forum. General / privacy contact: founder@buzzio.dev.
Also see SECURITY.md and docs Security disclosure (scope + Safe Harbor). Bug bounty is not offered yet.
Keys and recovery phrase
- Messaging keys are derived on-device from a 12-word recovery phrase.
- Buzzio never receives that phrase or your private messaging keys.
- Your Buzzio ID is a separate random address — not calculated from the phrase.
- New-device sign-in needs Buzzio ID + phrase. Losing both devices and the phrase (with no unlockable backup) means those private keys cannot be rebuilt.
Local encrypted history
Private readable chat history is stored in an encrypted database on your device (SQLCipher). Uninstalling removes that local copy. A new phone does not inherit full private history unless you restore an encrypted backup you unlock yourself.
Delete-on-delivery (private 1-to-1)
- Message encrypted on your device before it leaves the phone.
- Servers move an encrypted envelope for delivery.
- When the recipient’s device takes delivery, that relay copy is removed.
- Undelivered envelopes are purged on a short schedule (about 3 days).
Buzzio is designed so staff cannot open your private 1-to-1 message bodies as plaintext.
Zero metadata — the scoped claim
When nothing remains undelivered on a private 1-to-1 conversation, Buzzio aims not to keep a durable server archive of who privately talked to whom for that chat. This does not mean “Buzzio stores zero data.” Account identity, push tokens, blocks/reports, and shared-history features still exist where the product needs them.
Optional encrypted backup
Default = no Buzzio-readable private cloud inbox. If you enable backup, blobs are encrypted and unlock uses a recovery key you control.
Open-source crypto reference
Algorithms and key flow (X3DH, Double Ratchet, sealed envelopes, sender keys) are published as an educational Dart package: github.com/ve-21/buzzio-crypto-open-source (GPL-2.0). That repo is not the production app. Production salts, CA keys, Firebase wiring, and the mobile client remain closed. Verify checklist: Cryptography overview.
Safety tools still exist
Buzzio still supports block and report. Those tools need limited operational records — they are not a license to sell private conversations.
Tips and limits
- Protect the 12-word phrase first.
- “We can’t read sealed chats” is not the same as “shared rooms store nothing.”
- Private call media is not kept as a server recording archive.