Private by default,
not by promise.

This is for prototyping and low-stakes apps. Production deployments should self-host to keep sovereign control over message persistence and throughput.

The security model is identical regardless of who runs the relay — the relay receives ciphertext addressed to public keys and never holds the keys to decrypt it.

Logs are public → The relay's connection log is published in the open. Recipient public keys and connection timestamps only — never content, never sender identity.