Design principles

Privacy is not a feature added at the end. It is a property of the architecture, so it has to be decided before anything is built.

1. 1
   Nothing stays still

   Routes, compute and storage locations change on a schedule. Anything persistent can be mapped, so persistence is kept to a minimum.

2. 2
   Reduce the surface

   Collect less, retain less, expose less. Data that does not exist cannot leak, be subpoenaed or be breached.

3. 3
   No persistent network identity

   Participants use short-lived identifiers scoped to one purpose and one time window, not one account that follows them everywhere.

4. 4
   Split knowledge

   No single node or operator should see both who you are and what you are doing. Responsibility is spread so that one compromise reveals only a fragment.

5. 5
   Keys stay local

   Secrets are generated and used on the user's device. The network moves ciphertext and does not need to hold keys.

6. 6
   Familiar to use

   Privacy that is hard to use gets switched off. The products should feel as fast and simple as the tools people already have.

7. 7
   Honest by default

   We document what the system does not protect against as clearly as what it does. See Limitations.

Trade-offs we accept#

• Some latency. Multi-hop, rotating paths are slower than a direct connection. We tune for interactive use, not lowest possible ping.
• More moving parts. Ephemeral infrastructure is harder to operate than static servers. That complexity lives in the orchestration core, not in user-facing apps.
• Less convenience data. Without persistent identities, some familiar features such as server-side history need to be redesigned.