Whisper Private Chat
Topic: Whisper Private Chat
Slug: whisper
Product: Buzzio
Last updated: October 1, 2026
Label: Hardened Whisper Preview — not GA. Do not claim perfect anonymity or “untraceable.”
Meet in private. Leave no lasting trail.
Whisper (Hardened Whisper v3) is Buzzio’s time-limited, QR-started anonymous chat mode — for sealed conversations without adding someone as a permanent contact, and without leaving a lasting “who talked to whom” archive on our servers after the room ends.
In plain terms:
- You create a Hardened Whisper session and share a QR (offline payload — new sessions are not minted on Firebase).
- Session crypto stays on devices; joiners receive material only through that QR.
- Messages are encrypted on-device and relayed over the Tor / onion Whisper relay (keep the app open on Android while the room is live).
- Joiners appear as anonymous slots — not as Buzzio IDs in the chat stream.
- When the timer ends (or you close the session), session data, keys, and relay paths are deleted.
Preview honesty: Global traffic correlation, peer malice, and compromised devices remain risks. We will never market Whisper as “untraceable.” Full Tor embedding and independent audit claims wait for VERIFY PASS + a published report.
Legacy note: Firebase Whisper create and join are retired (Phase E). Hard-delete of legacy Firebase Whisper paths is scheduled after 2026-10-06 UTC (see WHISPER_V3_MIGRATE.md).
We do not sell your data. Never. Not Whisper messages. Not session metadata. Not who scanned your QR.
Legal: WHISPER_PRIVACY.md · PRIVACY_POLICY.md §6 · TERMS_AND_CONDITIONS.md §7 · GA copy draft: WHISPER_V3_GA_COPY.md
Not the same product: Whisper Questions
Anonymous Q&A via share links (for examplewhisper.buzzio.dev) — not the same E2E model as Whisper private chat. This page is Whisper private chat (QR sessions) only.
Why privacy-first users choose Whisper
| Promise | What you get |
|---|---|
| Anonymous by protocol | Labels are creator / scanner — not Buzzio IDs in the chat stream |
| Ephemeral session crypto | Fresh room material per QR — not your long-lived 1-to-1 identity keys |
| We can’t read the transcript | On-device seal; relays carry ciphertext |
| Hard timer | You choose 1 hour → 48 hours; then delete |
| Zero durable Whisper graph after expiry | Session records + relay paths are purged |
| Once-view + view-once media | Swipe up in a lane for once-view text; View Once for photos/videos |
Hook: “Talk face-to-QR. Encrypt everything. Expire everything.”
vs durable anonymous messengers (e.g. BChat-class)
Hardened Whisper optimizes for meet-and-vanish, not lifelong anonymous IDs:
| Hardened Whisper | Typical durable anonymous chat | |
|---|---|---|
| Identity | Ephemeral slots for this room | Often a durable messaging ID |
| Lifetime | ≤48h hard cap | Long-lived threads common |
| Join | Offline QR | Account / ID based |
| Positioning | Short retention + Tor path + honesty | Different tradeoffs (service nodes, wallets, etc.) |
We do not compete by claiming “more masternodes” or absolute untraceability.
How a Hardened Whisper session works (v3)
- Create — Pick duration (1–48h) and limits; optional Maximum privacy route (mixnet when linked).
- Share — Show the QR only (no HTTPS deep-link mint for new rooms).
- Join — Scanner validates the offline payload; gets a private 1:1 lane with the creator.
- Chat — Tor fail-closed + onion hops to the opaque mailbox; constant-rate cover while live.
- Expire / close — Timer or creator End → local wipe + mailbox scrub.
Architecture (current v3)
| Layer | Role |
|---|---|
| Your device | Keys, local messages/media, nicknames; optional Chat Lock vault |
| Tor + onion hops | Entry → middle → mailbox (multi-vendor when configured) |
| Mailbox DO | Opaque sealed cells; TTL scrub; rotating epoch ids |
| Not used for new rooms | Firebase createQrSession, RTDB qr_chats chat path, Whisper FCM |
Compelled disclosure (honest)
| Who | What they can get |
|---|---|
| Buzzio / Firebase | No Hardened Whisper session graph for new rooms — create/join/chat are not minted on Firebase. Legacy Firebase Whisper paths are retired (hard-delete after 2026-10-06 UTC). |
| Hop operators (Fly entry, CF middle/mailbox) | Fixed-size ciphertext cells, timing/volume — not message plaintext, not Buzzio account IDs. Independent vendors reduce single-subpoena hop-key coverage. |
| Still residual | The peer sees chat content; your ISP can see that Tor (or mixnet) was used; a global passive observer may try traffic correlation — we do not claim “untraceable.” |
Chat Lock (at-rest on this phone)
Optional 6-digit Chat Lock puts Whisper data in a separate SQLCipher vault with field-level AEAD (including media under the vault DEK). Unlock needs the PIN and, when available, a live biometric / device-credential presence check. The vault seals when you leave Whisper or background the app (keys zeroed in RAM). Wrong PIN: attempts left + escalating wait; 10 wrong attempts or the optional Fail-safe wipe PIN erase Whisper on this phone with a clear confirmation (panic wipe — not stealth unlock).
Honesty: Chat Lock protects sealed data on a stolen/unlocked phone. It does not stop a live debugger while Whisper is open, and it is not a network “untraceable” claim.
Legacy v1/v2 rooms (until sunset) may still use Firestore/RTDB join plumbing — that path is retired for create.
E2E (short)
- Fresh session material from the QR.
- Per-lane ratchet after join.
- Control plane: encrypted seen only — no delivery / typing / online on the wire for Hardened rooms.
- Details: WHISPER_V3_HARDENED_SPEC.md · crypto notes in-repo under
docs/WHISPER_V3_*.md.
Delete-after-expire
- Creator picks 1–48 hours.
- Joins rejected after
expires_at. - Creator can End session early → scrub mailbox + wipe local.
- Joiners detect closed/expired rooms and wipe locally.
Deleted with the room: relay cells, session keys on device, local messages/media for that Whisper, slot linkage for that room.
Not deleted: your Buzzio account, normal 1-to-1 contacts, unrelated features.
Product surface (still true)
| Feature | Note |
|---|---|
| Creator inbox of anonymous slots | Private lanes with the creator |
| Session name / local nicknames | On-device labels only |
| Once-view / view-once | Per lane |
| Creator block slot / scanner leave | Wipe that lane |
| Freemium | Free: 1 active Whisper; Premium: higher cap |
| Chat Lock / Fail-safe wipe PIN | Optional; Advanced security ⋮ on a Whisper session |
Voice/video calls remain a 1-to-1 story; Whisper is the QR messaging room.
Copy-ready (Preview)
- Anonymous QR private chat — no Buzzio IDs exchanged in the protocol.
- Ephemeral E2E session crypto — built to expire (≤48h).
- Tor / onion relay path for Hardened rooms — fail-closed (no clearnet Whisper).
- Zero durable Whisper graph after expiry.
- We never sell Whisper data.
- Not GA: no “untraceable,” no “audited” until a public report exists.
Learn more: introduction.md · one-to-one-chat.md · https://buzzio.dev · Privacy: founder@buzzio.dev