Encryption

GlassChat uses two distinct layers of encryption. Knowing which is which is the honest way to talk about privacy.

End-to-end encryption (E2EE)

Available in one-to-one chats, toggled from the chat's details screen. When it's on:

Messages are encrypted on your device using the double-ratchet Olm protocol before they ever leave it.
The server relays and stores ciphertext only. It cannot decrypt your messages — not for features, not for moderation, not for anyone.
Chat-list previews, notifications, and exports are all guarded so ciphertext (or plaintext) never leaks into places it shouldn't be.
Verify your connection any time via the safety number QR in chat details.

> Turning E2EE on posts a system message in the chat, so both sides always know.

Some features can't work on content the server can't read — that's the trade, and we keep it honest:

The AI assistant can't participate in E2EE chats and can never be added to one.
Voice-note transcription is unavailable for E2EE audio.
Editing E2EE messages isn't supported yet; unsending works and wipes the stored ciphertext.

Standard chats and media aren't plaintext on our disks either:

Message text is encrypted at rest with AES-256-GCM under a server-held key.
Uploaded files are encrypted at rest the same way and decrypted only when served to an authorized member.

This protects against storage leaks — it is not E2EE, and we never call it that. For maximum privacy, use E2EE chats.

Group E2EE (sender keys) is on the roadmap and not shipped yet. Group messages today use at-rest encryption.