Many independent relays in one network
Aphotic relays never talk to each other. Your app does the routing, so hidden senders, end-to-end encryption and anonymous licensing keep working exactly as they do on one relay. This page follows a message from one relay to another.
Addresses
Every account has a home relay
Your home relay is the server that holds your inbox: your public keys and the queue of messages waiting for you. It holds nothing else, and it's the only place where messages for you are ever queued. For most people that's the main relay, and you can move to an operator's relay later from Settings > Network.
Your address on the network is your ID plus your home relay's onion address. The ID is derived from your own encryption key, so it's the same on every relay and nobody else can register it. Your contact QR carries both, and a friend on any relay can reach you with it.
address = your ID + your home relay's .onion
Your app posts straight to their relay
When you write to someone on another relay, your app opens a Tor route to the recipient's home relay itself and posts the sealed message there, the same way it posts to your own relay. The receiving relay can't tell your message from one its own users sent: sealed sender hides the sender, and the license proof is an anonymous token, as it is everywhere else.
Your own relay is off the path. It never sees that the message exists, who it went to, or when. On the receiving side, your friend's app reads its own relay as it always does.
- Tor route, same as a local message
- 1
- connections between relays
- 0
- of it seen by your own relay
- 0
Tor route, same as a local message
connections between relays
of it seen by your own relay
The design choice
Why the relays don't talk to each other
The obvious way to build this is the way email and Matrix do it: your server accepts the message and forwards it to theirs. We looked at that and rejected it, mainly for privacy. If relay B received your message from relay A, it would learn that the sender is one of relay A's users, and on a relay with five users that comes close to knowing who you are. When your app posts directly, relay B only learns that some licensed user sent it, so a hidden sender hides among everyone on the network.
Forwarding has other costs too. Every operator would have to trust every other operator's license checks, a second copy of your message would sit in a queue on a server you never chose, every relay would need an inbound door to defend, and each message would cross Tor twice. Client routing avoids all of that and needed no new infrastructure.
- Your own relay never sees who you write to on other relays
- The receiving relay cannot tell a message from elsewhere from a local one
- No operator has to trust another operator
- One Tor route per message, same as a local one
Groups and Communities
Groups that span relays
A group message is one sealed message per member, and each copy goes to that member's home relay. That's why a group with people on three relays works. The parts the members share, the roster and the settings, live on the relay where the group was created. A Community's message stream lives on its relay the same way.
To take part in a group or Community hosted on a relay that isn't your home, your app registers a guest identity there: the same keys and the same ID as at home, with its own login for that relay and its own separate Tor circuit, so guest traffic never shares a connection with your home identity. Nothing is ever delivered to a guest. Your inbox stays at home, and in the background your app watches exactly one server. A Community hosted elsewhere is only read while you have the app open, and the app tells you so on screen.
Moving, and when a relay closes
Your conversations live on your phones
The encryption state of each conversation exists only on the two phones, which is what lets you move. Settings > Network registers the same identity on a new relay, tells every contact over their own relays that your home has changed, keeps collecting whatever was still waiting at the old relay, and drops the old registration once nothing needs it. Contacts who were offline get the announcement again later, and every chat carries on where it left off.
An operator who is closing down can announce a date, which your app shows as a prompt to move, and switch the relay into a draining mode: it stops taking new messages and keeps handing out the ones it holds. If a relay disappears without warning, you register elsewhere with the same keys and announce the new home from there, with no help from the old relay. You lose at most seven days of queued messages, the same as being offline for a week.
What the mesh means for your privacy
Hidden among everyone: sealed sender hides you among every user on the network, and your own relay learns nothing about the messages you send elsewhere.
Timing: the relay that holds an inbox sees when messages land in it and can line those times up against other activity it sees. Any design where a server holds your inbox has this limit.
Group hosts: the relay hosting a group sees its members' IDs and which relays they live on. The same goes for the relay hosting a Community.
Enforced only by the app: an operator can mark their relay as not accepting messages from other relays. The official app respects that and tells you why a message won't go. The server could only enforce it by identifying senders, and preventing that is what sealed sender exists for.
Choosing a relay: you pick your home relay when you set up the app and can move to another one later from Settings > Network.
One license for any relay, reachable from all of them
Run a relay for your community or pick an existing one. Your friends can reach you either way.