Every message is encrypted automatically to the devices in the room, beyond the controller's room key. Private channels and direct messages reach only their members. Public channels and World are open, so anyone who joins can read them, the server included: public channels are controller-readable. Posts from apps and webhooks come from the server and are shown as those apps.

Every message is signed by the device that wrote it and sealed with post-quantum keys that each device replaces daily and deletes after 8 days. A new device can read only messages sealed after it joined. In a direct message, a new device for someone already in the conversation gets nothing until you approve it. Changing a channel to Public does not expose its previously encrypted messages.