What we can and can't see
Nadeemi is in public beta. This page describes the code that runs today, not plans. If the code changes, this page changes the same day.
Short version: your private messages, group chats, private Circles and voice notes are encrypted on your device with MLS (RFC 9420), so our servers pass them on without being able to read them. We still label them "end-to-end encryption coming", because no independent expert has audited our encryption yet. Your public posts, profile, groups, stories and events can be read by our servers, because we have to show them to people. Your email address and date of birth are sealed on our servers with a key we hold.
The three kinds of protection on Nadeemi
| Kind | What it means | Who can read it |
|---|---|---|
| Encrypted on your device (MLS) | Scrambled on your phone or computer before it leaves; only the devices in the chat hold the keys | Only the people in the conversation |
| Sealed on the server | Encrypted in our database with a per-account key that our server holds | Our server, when it needs it (for example to send you an email) |
| Encrypted in transit and at rest | HTTPS on the way, encrypted disks at our hosting provider | Our server and anyone you shared it with |
What our servers cannot read
- Private messages (DMs) and group chats. With MLS switched on, the server refuses any message that is not already encrypted on the device. It stores and forwards ciphertext only.
- Private Circles. Posts, photos and voice notes inside a Circle are encrypted on the members' devices.
- Voice notes and attachments in chats. Encrypted on your device; the key travels only inside the encrypted message.
- Your chat history backup, if you set one up. It is locked with a recovery code that only you have.
Why the label still says "coming": the encryption runs, but it is new code (OpenMLS compiled to WebAssembly) that only we have reviewed. We will not call it end-to-end encrypted until an independent audit is published.
What our servers can still see about your private chats (metadata)
Even when message content is encrypted, the server knows who is in a chat, when messages are sent, roughly how big they are, and which devices each account uses. This is needed to deliver messages. We do not sell it and we do not use it for ads, because there are no ads.
What our servers can read
- Public posts, replies, reposts, polls and reactions. They are public by design. They are encrypted in transit and at rest, not end-to-end.
- Your profile: username, display name, bio, profile photo, language.
- Groups and Pages (not Circles), events, lists, bookmarks and scheduled posts.
- Stories. Encrypted in transit and at rest, not end-to-end. We delete them from our servers within about an hour after they expire, unless you switch on your story archive (off by default): then expired stories stay, visible only to you, until you delete them or switch the archive off.
- Who follows whom, friend requests, blocks and mutes.
- Reports you send, including a copy of the reported public content. For a reported private message, you choose to reveal that one message; a cryptographic tag ("franking") lets moderators check it is real.
What is sealed on our servers
- Email address and date of birth. Encrypted with a key unique to your account. A keyed fingerprint of your email lets us find your account at sign-in without storing the email in plain text.
- Password. Never stored; we keep only a salted, peppered hash (PBKDF2-SHA256).
- IP addresses. Not stored in our database. We keep a keyed hash for rate limits (for example, at most 6 sign-ups an hour from one network). Our hosting provider, Cloudflare, processes IP addresses to run and protect the service.
Things we never do
- No ads, no ad trackers, no data selling, no data brokers.
- No AI features, and nothing you write is used to train AI.
- No contact-book upload and no phone number.
- No scanning of private messages on your device or on our servers.
Photos and child safety
Every public or group photo upload (posts, profile photos, group photos, stories) is checked against a list of known child sexual abuse material before it is stored. On a match the photo is never published, the account is suspended, and the case is kept for reporting to the authorities. Photo location data (EXIF) is removed from uploads. Encrypted content is never scanned. Nadeemi is for adults (18+) only.
Web app versus installed apps
The web app at nadeemi.com loads its code from our server each time, so you have to trust that server not to send bad code. That makes the web app the weaker option for high-risk users. Signed installed apps are the stronger option; until they are signed for release, treat Nadeemi as a beta and do not rely on it for anything that could put you in danger.
Payments (the honesty box)
Nadeemi is free. Later we will ask members, on trust, for US$5 a month in crypto. During the beta's welcome period no payment addresses are switched on and nobody is asked to pay. When it starts, each member gets a personal deposit address so we can credit a supporter badge; that means we will know which account paid, how much and when (blockchains are public). Paying or not paying changes nothing else today.
Your controls
- Download your data at any time (Settings, after re-entering your password): your posts, edit history, follows, groups, payments and more, as a JSON file. Encrypted chats live on your devices.
- Delete your account at any time (password + typing DELETE). Your posts are wiped, your photos deleted, your sealed email and date of birth are destroyed with their key, your sessions end and your devices are removed.
Questions or a mistake on this page: info@nadeemi.com. See also our privacy notice and terms.