Knowledge base Privacy
Encryption
Your questions and its answers are end-to-end encrypted, with a post-quantum layer over the classical one. This page is about what that actually protects.
End-to-end by default
There is no setting to turn on. Every message in every conversation is encrypted on your device before it goes anywhere, and decrypted on the other end. The relays that carry it cannot read it, and neither can anything in between.
"The other end" here is the Nymbot service, which has to read your question in order to answer it. End-to-end means nobody else can — it does not and cannot mean the assistant answers something it never saw. Anonymous mode is the answer to the different question of whether it should know who asked.
Gift wraps
Messages travel as Nostr gift wraps. Each one is three layers:
- a rumor — the message itself, unsigned, so it can never be proved to a third party;
- a seal, encrypted to the recipient and signed by the sender, which is how the recipient knows who sent it;
- a wrap, encrypted and signed by a single-use throwaway key, which is all a relay ever sees.
So a relay holding your traffic sees an event from a key that exists only for that message, addressed to a key it cannot connect to anything else, with a random timestamp. Metadata analysis over the wraps gets very little.
A copy of each message is also wrapped to your own key, which is how your history restores on a new device from the relays rather than from any server-side transcript.
Post-quantum hybrid
The classical layer is elliptic-curve. A large enough quantum computer breaks that retroactively — traffic captured today, decrypted years later. So the encryption is hybrid: an ML-KEM key encapsulation is combined with the classical exchange, and an attacker has to break both to read anything.
ML-KEM is the NIST-standardised lattice KEM. Combining rather than replacing is deliberate: if the lattice assumption turns out to be wrong, you still have the elliptic curve, and the other way round.
Nymbot publishes a signed capability announcement carrying its KEM key, so your app can seal to it without a lookup race that would quietly leave a message classical-only. Your app publishes one too, which is how replies come back hybrid.
What the server sees
Being precise about this matters more than being reassuring about it.
| Thing | Normally | In anonymous mode |
|---|---|---|
| Your message text | Read, to answer it | Read, to answer it |
| Which key asked | Your nym's public key | A throwaway key |
| Which key is charged | Your nym | The throwaway key |
| Your conversation title | Never sent | Never sent |
| Your private key | Never leaves the device | Never leaves the device |
| Your git token | Passed per request, never stored | Same |
| Your IP address | Seen by relays and the worker | Same — use Tor or a VPN if that matters |
Conversation titles are generated on your device, which is why they are one of the few things about your usage that never crosses the wire at all.