From 81df22d2364cd82d62959a9806cd8b9f05085611 Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 12:23:58 +0100 Subject: [PATCH 1/9] Add the privacy policy as an unpublished draft --- src/pages/legal/privacy-policy.md | 263 ++++++++++++++++++++++++++++++ 1 file changed, 263 insertions(+) create mode 100644 src/pages/legal/privacy-policy.md diff --git a/src/pages/legal/privacy-policy.md b/src/pages/legal/privacy-policy.md new file mode 100644 index 0000000..f0e2361 --- /dev/null +++ b/src/pages/legal/privacy-policy.md @@ -0,0 +1,263 @@ +--- +title: Privacy policy +description: What data leaves your device when you use Pombo, and who receives it. +draft: true +--- + +# Privacy Policy + +**Effective date:** `[SET ON PUBLICATION: the date this page goes live]` +**Last updated:** `[SET ON PUBLICATION: same date]` + +Pombo is built so that we cannot see your messages, your contacts, or who you +talk to. This document explains what that means in practice, and it is careful +to describe the places where the design has limits. A privacy policy is worth +what it admits, so the limits are stated as plainly as the protections. + +This is the legal statement of what data leaves your device and who receives it. +It is written to be read on its own. If you want to know *how* the protections +work rather than what they cover, the [privacy model](/concepts/privacy-model) +explains the mechanisms and the [threat model](/security/threat-model) sets out +what an attacker can achieve. Where those documents and this one describe the +same thing, this one governs. + +## 1. What this policy covers + +This policy covers the Pombo web application at `app.pombo.cc`, the Pombo +Android application, and the websites `pombo.cc` and `docs.pombo.cc`. + +It does not cover the independent infrastructure Pombo connects to. The Streamr +Network, the Polygon blockchain, storage node operators, and RPC providers are +operated by third parties under their own terms. Where using Pombo causes data +to reach them, this policy says so. + +"Pombo", "we" and "us" in this document mean the project that publishes the +applications and websites listed above. Pombo is an open source project rather +than a company, and it holds no user data of its own. Questions about this +policy, and any request relating to your data, reach the project at the address +in section 11. + +## 2. There is no account + +Pombo does not have accounts. Your identity is a cryptographic key pair +generated on your device. We do not ask for an email address, a phone number, +a name, or any other identifier, and we do not assign one to you. + +This means we have no user database, and no way to look you up. It also means +that if you lose your key and your backup, nobody can restore your identity for +you, including us. + +## 3. What is stored on your device + +The following is held locally and never sent to us: + +- Your private key, in an encrypted keystore protected by the password you set. +- Messages you have sent and received, and the channels you have joined. +- Your contacts and any local names you gave them. +- Channel encryption keys. +- Cached ENS names and avatars. +- Backups you export, until you move or delete them. + +Uninstalling the application, or clearing site data in your browser, erases all +of it. We cannot recover it. + +## 4. What leaves your device, and who can see it + +### 4.1 The peer-to-peer network can see your IP address + +Pombo delivers messages over the Streamr Network, a peer-to-peer network. Your +device connects **directly to other participants**. Message content is +encrypted end to end and those participants cannot read it, but they can observe +the IP address you connect from, as is inherent to any direct connection. + +If your IP address must not be visible to other participants, use Pombo through +a VPN or a network that does not identify you. We do not operate a relay that +would hide it. + +### 4.2 Storage nodes hold encrypted history + +Channels may retain history on storage nodes so that messages are available +after they are sent. What is stored is encrypted and the operator cannot read +it. The operator can see stream identifiers, message sizes, and timing. + +Retention is a property of the channel, chosen by the channel owner, not by us. + +### 4.3 The blockchain is public and permanent + +Creating a channel, joining a gated channel, and paying for access are +transactions on the Polygon blockchain. They are public, permanent, and cannot +be deleted or amended, by us or by anyone. + +Blockchain addresses are pseudonymous, not anonymous. Anyone who links an +address to a person can then see everything that address has done. Payments for +paid channels go directly to the channel owner; Pombo takes no fee. + +### 4.4 Channel discovery + +Browsing channels queries an indexing service, The Graph, over the internet. +That service receives your IP address and the queries you make, which reveals +which channels you look at. You can supply your own API key in Settings, which +changes who your queries are attributed to but not that they are made. + +### 4.5 Blockchain access and ENS names + +Reading gate conditions, estimating fees, and sending transactions use public +RPC endpoints, which receive your IP address and the addresses you query. The +endpoints are listed in the application and can be changed in Settings. + +Looking up the `.eth` name of someone you see in a channel is sent with cover +traffic, so the provider learns that you resolved some address but not which +one. The [privacy model](/concepts/privacy-model) describes how. + +Looking up a name you typed yourself, to start a direct message or send an +invitation, is **not** covered. The provider sees the exact name you asked for, +which reveals who you intend to contact. This is inherent to resolving ENS names +through someone else's node, and the only complete answer is to run your own; +we mention it because most applications leave it unsaid. + +### 4.6 Push notifications + +Push notifications are optional and off until you enable them. + +When enabled, wake signals reach your device through the platform push service +your device already uses: Google's Firebase Cloud Messaging on Android, and your +browser's push service on the web. That service handles delivery and can see +that a message was delivered to your device, but not its content, its sender, or +which channel it came from. + +The Pombo relay that triggers those signals cannot determine the recipient, the +sender, or the channel: it receives an anonymous tag and nothing else. The +[privacy model](/concepts/privacy-model) describes how. + +On Android, the Firebase Messaging component sends an installation identifier to +Google in order to receive messages at all. This is a property of using the +platform's push service and applies whenever notifications are enabled. + +### 4.7 Profile pictures set by other users + +If someone you see in a channel has set an ENS profile picture, your device +loads that image from wherever their ENS record points, which is a server of +their choosing. That server receives your IP address and browser information. +Images stored on IPFS are fetched through a public gateway, which receives the +same. + +This is worth stating plainly: a person can set their profile picture to an +address on a server they control and thereby learn the IP address of everyone +who views their messages. Pombo requires such images to be served over HTTPS, +which protects the request in transit but does not hide who made it. + +You can turn this off. Settings has an **ENS Avatars** control, under Content, +that stops remote profile pictures from loading and shows the locally generated +identicon instead. Turning it off closes the request entirely, everywhere an +avatar is drawn, including the account screens shown before you unlock and the +pictures attached to notifications. It is on by default, because most people +want to see the pictures. + +### 4.8 Embedded video + +If you play a video embedded in a message, it is loaded from YouTube in +privacy-enhanced mode. Nothing is loaded from YouTube until you press play. + +### 4.9 Website hosting + +`app.pombo.cc`, `pombo.cc` and `docs.pombo.cc` are served by GitHub Pages. +GitHub keeps ordinary web server access logs, which include IP addresses, under +its own privacy statement. + +## 5. What Pombo does not do + +- No analytics, no telemetry, no crash reporting, no usage measurement. +- No advertising, no advertising identifiers, no tracking across sites or apps. +- No profiling, and no inference about you from your behaviour. +- No selling or sharing of personal data, because we hold none to sell. +- No server that holds your messages, your contact list, or your keys. + +There is no third-party analytics or tracking code in the Pombo applications. + +## 6. Third parties your use of Pombo reaches + +Most of these are outside the European Economic Area, so using Pombo sends your +IP address to countries whose data protection law differs from the EU's. GitHub +and Google are United States companies. For the rest we cannot tell you where +your data goes, and saying otherwise would be an invention: an RPC or indexing +gateway answers from whichever edge location its network chooses, and the +peer-to-peer network connects you to whoever happens to be carrying the same +channel, anywhere in the world. Each of these parties operates under its own +terms and its own transfer safeguards; we are not a party to that relationship +and cannot vouch for it. + +| Party | What it receives | When | +| --- | --- | --- | +| Other network participants | Your IP address | Whenever the app is connected | +| Storage node operators | Encrypted content, stream ids, sizes, timing | For channels with retention | +| The Polygon blockchain | Your address and transactions, permanently and publicly | On-chain actions | +| The Graph | Your IP address and channel queries | Browsing and opening channels | +| RPC providers | Your IP address and the addresses you query | Gate checks, ENS, transactions | +| Google (FCM) and browser push services | Delivery of an opaque wake signal, device push token | Only if notifications are enabled | +| A user's chosen image host, or a public IPFS gateway | Your IP address and browser information | Viewing anyone with an ENS profile picture | +| YouTube | Standard embedded player data | Only if you play a video | +| Hosting providers | Web server access logs | Loading the sites | + +## 7. Retention, and what we cannot delete + +We hold nothing centrally, so there is nothing for us to retain about you. + +What exists elsewhere is outside our control, and we want to be exact rather +than reassuring: + +- Channel history on storage nodes remains until the channel's retention window + expires. It is encrypted, and we cannot remove it early. +- Blockchain transactions are permanent. They cannot be deleted by anyone. +- Messages already delivered to other people's devices are theirs. We have no + mechanism to reach into them. + +Deleting a message in the application publishes an instruction to hide it, which +compliant clients honour. It is not a guarantee that every copy disappears, and +we do not present it as one. + +## 8. Age + + +Pombo is not directed at children. You must be at least 16 years old to use it. + +We cannot verify your age, and we want to be honest about why: verifying it +would require collecting identifying information about you, which is exactly +what this application is designed not to do. The age requirement is a condition +of use, not something we enforce technically. + +## 9. Your rights + +If you are in the European Economic Area or the United Kingdom, data protection +law gives you rights of access, correction, deletion, restriction, objection and +portability. + +These rights are exercised against whoever holds your data. In Pombo's case, +almost everything is held by you: your messages and keys are on your own device, +and you can export, inspect and destroy them at any time without asking us. + +For the parts we do not hold, we cannot act on your behalf. We cannot delete +blockchain transactions, remove data from storage nodes we do not operate, or +retrieve messages from other people's devices. Saying otherwise would be a +promise we could not keep. + +Where the project itself operates infrastructure, we take responsibility for it. +That is the push relay, which receives an anonymous tag and a proof of work and +holds nothing that identifies you, and the hosting of the websites listed in +section 1. If you believe we hold data about you through either, write to us at +the address below and we will answer. + +We do not claim responsibility for the Streamr Network, the Polygon blockchain, +storage nodes, RPC providers or indexing services. They are independent, they +are not ours to direct, and pretending otherwise would mislead you about who can +actually act on a request. + +## 10. Changes to this policy + +If this policy changes we will update the effective date above. The full history +of every change is public in the repository that publishes this page, so you can +see exactly what changed and when. + +## 11. Contact + +Questions about this policy, and any request relating to your data, go to +**privacy@pombo.cc**. From e78f9fe5fb3f00d142bf3ebf08bf39962bc9f7bc Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 12:32:56 +0100 Subject: [PATCH 2/9] Publish the privacy policy and link it from the docs --- docs/concepts/privacy-model.md | 2 ++ docusaurus.config.js | 1 + src/pages/legal/privacy-policy.md | 5 ++--- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/concepts/privacy-model.md b/docs/concepts/privacy-model.md index e098f5d..7206510 100644 --- a/docs/concepts/privacy-model.md +++ b/docs/concepts/privacy-model.md @@ -8,6 +8,8 @@ description: Ephemeral publisher identities, sealed sender, and what an observer Pombo's privacy design has one organizing idea: **your real account should not be visible on the wire unless the context deliberately makes it so.** +This page explains how the protections work. For the separate question of what data leaves your device and who receives it, see the [privacy policy](/legal/privacy-policy). + ## Ephemeral publisher identities When you join a channel, Pombo generates **one throwaway keypair per channel** and uses it as your network-level publisher identity across all of that channel's streams. It is created on your first publish, never persisted, and discarded when you leave the channel or disconnect. The address the network sees is not your account. diff --git a/docusaurus.config.js b/docusaurus.config.js index bd78f44..4048bae 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -102,6 +102,7 @@ const config = { items: [ {label: 'Website', href: 'https://pombo.cc'}, {label: 'Open App', href: 'https://app.pombo.cc'}, + {label: 'Privacy policy', to: '/legal/privacy-policy'}, ], }, { diff --git a/src/pages/legal/privacy-policy.md b/src/pages/legal/privacy-policy.md index f0e2361..574795e 100644 --- a/src/pages/legal/privacy-policy.md +++ b/src/pages/legal/privacy-policy.md @@ -1,13 +1,12 @@ --- title: Privacy policy description: What data leaves your device when you use Pombo, and who receives it. -draft: true --- # Privacy Policy -**Effective date:** `[SET ON PUBLICATION: the date this page goes live]` -**Last updated:** `[SET ON PUBLICATION: same date]` +**Effective date:** 25 August 2026 +**Last updated:** 25 August 2026 Pombo is built so that we cannot see your messages, your contacts, or who you talk to. This document explains what that means in practice, and it is careful From 642cd4214677998f8202aea31512a1f28317c7dd Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 12:48:29 +0100 Subject: [PATCH 3/9] Say that the relay stores push tokens, instead of implying it stores nothing --- src/pages/legal/privacy-policy.md | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/src/pages/legal/privacy-policy.md b/src/pages/legal/privacy-policy.md index 574795e..27fd037 100644 --- a/src/pages/legal/privacy-policy.md +++ b/src/pages/legal/privacy-policy.md @@ -125,8 +125,17 @@ that a message was delivered to your device, but not its content, its sender, or which channel it came from. The Pombo relay that triggers those signals cannot determine the recipient, the -sender, or the channel: it receives an anonymous tag and nothing else. The -[privacy model](/concepts/privacy-model) describes how. +sender, or the channel. What reaches it is an anonymous tag, one of a small +number shared by many devices, and the [privacy model](/concepts/privacy-model) +describes how that works. + +To deliver anything at all, the relay does have to store your device's push +token, alongside that tag and the times the registration was created and last +refreshed. A push token identifies a device, not a person: it is issued by +Google or by your browser, it carries no name, address or account, and the relay +holds nothing that links it to your Pombo identity or to any channel. It is +still a persistent identifier, so we name it here rather than leave you to +assume the relay stores nothing. Turning notifications off removes it. On Android, the Firebase Messaging component sends an installation identifier to Google in order to receive messages at all. This is a property of using the @@ -240,10 +249,17 @@ retrieve messages from other people's devices. Saying otherwise would be a promise we could not keep. Where the project itself operates infrastructure, we take responsibility for it. -That is the push relay, which receives an anonymous tag and a proof of work and -holds nothing that identifies you, and the hosting of the websites listed in -section 1. If you believe we hold data about you through either, write to us at -the address below and we will answer. +There are three places, and they are the only ones: + +- **The push relay**, which stores the device push tokens described in section + 4.6, for as long as notifications stay enabled. +- **The websites** listed in section 1, whose hosting keeps access logs. +- **This mailbox.** Writing to the address in section 11 means we hold your + message and whatever address you sent it from, for as long as it takes to + answer you and keep a record of having done so. + +If you want any of that removed, ask. For the push token, turning notifications +off in the app is faster than writing to us. We do not claim responsibility for the Streamr Network, the Polygon blockchain, storage nodes, RPC providers or indexing services. They are independent, they From ab1a0b3a183bb4f9989952b360cfbabc7c885b3a Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 12:49:13 +0100 Subject: [PATCH 4/9] Stop claiming we hold nothing, two sections after listing what we hold --- src/pages/legal/privacy-policy.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/pages/legal/privacy-policy.md b/src/pages/legal/privacy-policy.md index 27fd037..6465cb6 100644 --- a/src/pages/legal/privacy-policy.md +++ b/src/pages/legal/privacy-policy.md @@ -177,7 +177,8 @@ its own privacy statement. - No analytics, no telemetry, no crash reporting, no usage measurement. - No advertising, no advertising identifiers, no tracking across sites or apps. - No profiling, and no inference about you from your behaviour. -- No selling or sharing of personal data, because we hold none to sell. +- No selling or sharing of personal data. The little we hold is listed in + section 9, and none of it is passed on to anyone. - No server that holds your messages, your contact list, or your keys. There is no third-party analytics or tracking code in the Pombo applications. From eb937a2d35be40cd2c8e9c6e31376377bc2f6178 Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 13:06:29 +0100 Subject: [PATCH 5/9] Say that the project runs the default storage cluster, on infrastructure it does not own --- src/pages/legal/privacy-policy.md | 62 ++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 18 deletions(-) diff --git a/src/pages/legal/privacy-policy.md b/src/pages/legal/privacy-policy.md index 6465cb6..b131c41 100644 --- a/src/pages/legal/privacy-policy.md +++ b/src/pages/legal/privacy-policy.md @@ -25,10 +25,14 @@ same thing, this one governs. This policy covers the Pombo web application at `app.pombo.cc`, the Pombo Android application, and the websites `pombo.cc` and `docs.pombo.cc`. -It does not cover the independent infrastructure Pombo connects to. The Streamr -Network, the Polygon blockchain, storage node operators, and RPC providers are -operated by third parties under their own terms. Where using Pombo causes data -to reach them, this policy says so. +Pombo is a client for open infrastructure that it does not own. The Streamr +Network, the Polygon blockchain, storage nodes and RPC providers are run by +whoever chooses to run them, under their own terms, and this policy does not +cover them. Where using Pombo causes data to reach them, it says so. + +The project does run some of that infrastructure itself, as a service rather +than as part of the application: a storage cluster and a push relay. Section 9 +lists them, and they are covered by this policy like anything else we operate. "Pombo", "we" and "us" in this document mean the project that publishes the applications and websites listed above. Pombo is an open source project rather @@ -70,16 +74,28 @@ encrypted end to end and those participants cannot read it, but they can observe the IP address you connect from, as is inherent to any direct connection. If your IP address must not be visible to other participants, use Pombo through -a VPN or a network that does not identify you. We do not operate a relay that -would hide it. +a VPN or a network that does not identify you. There is no proxy layer between +you and the network that would hide it for you. ### 4.2 Storage nodes hold encrypted history -Channels may retain history on storage nodes so that messages are available -after they are sent. What is stored is encrypted and the operator cannot read -it. The operator can see stream identifiers, message sizes, and timing. +Pombo is a client for open infrastructure. Message history is kept by Streamr +storage nodes, which anyone can run: they are not part of the application, and +the application has no privileged relationship with any of them. + +**We operate one of those nodes, and it is the one a channel uses unless its +owner picks another.** It is a two-server cluster, offered because a network +with no reachable storage is not much use to anyone, and it is a service we run +rather than a component of the app. Channel creation shows the choice, names the +node, and explains how to point a channel at your own cluster or a third +party's instead. -Retention is a property of the channel, chosen by the channel owner, not by us. +Whichever node a channel uses, what is stored is encrypted and its operator +cannot read it. What that operator does see is stream identifiers, message +sizes, and timing. When the node is ours, we see exactly that and nothing more. + +How long history is kept is set by the channel's owner, between one and 365 +days, and it is enforced by the node rather than by us. ### 4.3 The blockchain is public and permanent @@ -198,7 +214,7 @@ and cannot vouch for it. | Party | What it receives | When | | --- | --- | --- | | Other network participants | Your IP address | Whenever the app is connected | -| Storage node operators | Encrypted content, stream ids, sizes, timing | For channels with retention | +| The storage node a channel uses, ours by default | Encrypted content, stream ids, sizes, timing | For channels with retention | | The Polygon blockchain | Your address and transactions, permanently and publicly | On-chain actions | | The Graph | Your IP address and channel queries | Browsing and opening channels | | RPC providers | Your IP address and the addresses you query | Gate checks, ENS, transactions | @@ -209,13 +225,16 @@ and cannot vouch for it. ## 7. Retention, and what we cannot delete -We hold nothing centrally, so there is nothing for us to retain about you. +There is no central store of your messages, your contacts or your identity. What +the project does hold is listed in section 9, and it is small. -What exists elsewhere is outside our control, and we want to be exact rather -than reassuring: +For the rest we want to be exact rather than reassuring: -- Channel history on storage nodes remains until the channel's retention window - expires. It is encrypted, and we cannot remove it early. +- Channel history stays on the storage node the channel uses until its retention + window expires, then the node purges it. It is encrypted throughout. On our + own cluster we can see that a channel's data is there and when it will go, and + we do not remove it early, because doing so would break the guarantee the + channel owner chose. On any other node we have no access at all. - Blockchain transactions are permanent. They cannot be deleted by anyone. - Messages already delivered to other people's devices are theirs. We have no mechanism to reach into them. @@ -245,13 +264,16 @@ almost everything is held by you: your messages and keys are on your own device, and you can export, inspect and destroy them at any time without asking us. For the parts we do not hold, we cannot act on your behalf. We cannot delete -blockchain transactions, remove data from storage nodes we do not operate, or +blockchain transactions, reach into a storage node run by someone else, or retrieve messages from other people's devices. Saying otherwise would be a promise we could not keep. Where the project itself operates infrastructure, we take responsibility for it. -There are three places, and they are the only ones: +There are four places, and they are the only ones: +- **The storage cluster** described in section 4.2, holding the encrypted + history of every channel that uses it, for as long as that channel's retention + window says. This is the largest of the four by far. - **The push relay**, which stores the device push tokens described in section 4.6, for as long as notifications stay enabled. - **The websites** listed in section 1, whose hosting keeps access logs. @@ -259,6 +281,10 @@ There are three places, and they are the only ones: message and whatever address you sent it from, for as long as it takes to answer you and keep a record of having done so. +None of these is a component of the application. They are services the project +runs on open infrastructure, and each of them can be replaced by someone else's +or by your own. + If you want any of that removed, ask. For the push token, turning notifications off in the app is faster than writing to us. From c5e0843932c571097623aac57627ce215952ba18 Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 14:01:52 +0100 Subject: [PATCH 6/9] Qualify every no-server claim, instead of denying servers exist --- docs/concepts/architecture.md | 4 ++-- docs/getting-started/identity.md | 2 +- docs/guides/backup-and-recovery.md | 2 +- docs/help/faq.md | 2 +- docs/security/threat-model.md | 2 +- docs/welcome.md | 6 +++--- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/concepts/architecture.md b/docs/concepts/architecture.md index 57554d8..7f0e1a8 100644 --- a/docs/concepts/architecture.md +++ b/docs/concepts/architecture.md @@ -1,7 +1,7 @@ --- id: architecture title: Architecture -description: How Pombo works without servers — Streamr transport, Polygon permissions, storage nodes, client-side crypto. +description: How Pombo works without a backend — Streamr transport, Polygon permissions, storage nodes, client-side crypto. --- import Tabs from '@theme/Tabs'; @@ -9,7 +9,7 @@ import TabItem from '@theme/TabItem'; # Architecture -Pombo has no message backend — conversations never pass through a Pombo server. The client sits on top of three decentralized layers — transport, persistence, and ownership — and handles all cryptography itself: +Pombo has no message backend: no server receives, routes or authorizes your conversations. The client sits on top of three open layers — transport, persistence, and ownership — and handles all cryptography itself: ``` ┌─────────────────────────────────────────────┐ diff --git a/docs/getting-started/identity.md b/docs/getting-started/identity.md index d9ac9bf..d3f4626 100644 --- a/docs/getting-started/identity.md +++ b/docs/getting-started/identity.md @@ -19,7 +19,7 @@ Your address (`0x…`) is your identity on the network: it's how people DM you, ## There is no "Forgot password" :::danger[Back up your account] -Pombo has no servers, which also means **no account recovery**. No company can reset your password or restore your key. If you lose your device and have no backup, the account — and everything encrypted with it — is gone permanently. +Nobody holds your key. If you lose your device and have no backup, the account — and everything encrypted with it — is gone permanently. Export a backup file as soon as you create your account: see [Backup and recovery](../guides/backup-and-recovery.md). ::: diff --git a/docs/guides/backup-and-recovery.md b/docs/guides/backup-and-recovery.md index 3b4d2ec..cc37321 100644 --- a/docs/guides/backup-and-recovery.md +++ b/docs/guides/backup-and-recovery.md @@ -7,7 +7,7 @@ description: Export a portable, encrypted backup of your account — the only re # Backup and recovery :::danger[The one rule] -Pombo has no servers and no custodians, so there is **no "forgot password", no account recovery, no support ticket** that can bring an account back. Your backup file *is* the recovery mechanism. Make one when you create your account, and keep it somewhere safe. +Nobody holds your key and there is no custodian, so there is **no "forgot password", no account recovery, no support ticket** that can bring an account back. Your backup file *is* the recovery mechanism. Make one when you create your account, and keep it somewhere safe. ::: ## Exporting a backup diff --git a/docs/help/faq.md b/docs/help/faq.md index ae72f46..ffa8266 100644 --- a/docs/help/faq.md +++ b/docs/help/faq.md @@ -38,4 +38,4 @@ Pombo is **pseudonymous with strong wire privacy**, not an anonymity network. Yo ### How is this different from Signal? From Matrix? From Farcaster? -Briefly: **Signal** is the gold standard for content encryption, but it requires a phone number — a real-world identity anchor — and runs on central servers you have to trust to stay up and neutral; Pombo asks for no identifier at all and has no servers. **Matrix** federates servers; Pombo has no servers to federate — transport is P2P and state is on-chain. **Farcaster**-style social protocols are public-first; Pombo is messaging-first with E2EE DMs and encrypted channels. Pombo's particular corner is: no sign-up, no servers, creator-owned channels, sealed-sender DMs. +Briefly: **Signal** is the gold standard for content encryption, but it requires a phone number — a real-world identity anchor — and runs on central servers you have to trust to stay up and neutral; Pombo asks for no identifier at all and has no backend to trust. **Matrix** federates servers; Pombo has no backend to federate — transport is P2P and state is on-chain. **Farcaster**-style social protocols are public-first; Pombo is messaging-first with E2EE DMs and encrypted channels. Pombo's particular corner is: no sign-up, no servers, creator-owned channels, sealed-sender DMs. diff --git a/docs/security/threat-model.md b/docs/security/threat-model.md index dcda7cb..3fca64b 100644 --- a/docs/security/threat-model.md +++ b/docs/security/threat-model.md @@ -19,7 +19,7 @@ Privacy tools earn trust by being precise about their limits. This page is the h ## Trusted or centralized components -Pombo has no backend, but it is not free of third parties. Today you are trusting: +Pombo has no backend: no server implements the app, and every piece of infrastructure it touches can be swapped for someone else's. That does not make it free of third parties. Today you are trusting: | Component | What it could learn or do | |---|---| diff --git a/docs/welcome.md b/docs/welcome.md index 57b3729..ba491fa 100644 --- a/docs/welcome.md +++ b/docs/welcome.md @@ -2,7 +2,7 @@ id: welcome title: What is Pombo? slug: / -description: "Pombo is an open-source, permissionless messaging and social media app: peer-to-peer, with no accounts to approve, no servers in the middle, and channels whose creators keep everything they charge." +description: "Pombo is an open-source, permissionless messaging and social media app: peer-to-peer, with no accounts to approve, no server that can read your messages, and channels whose creators keep everything they charge." --- # What is Pombo? @@ -17,9 +17,9 @@ Your account is a cryptographic keypair generated on your device the first time Creating a channel is the same: you register it and it is yours. It becomes your property. Accounts are free and instant, so keeping separate identities for separate parts of your life costs nothing. -## No servers in the middle +## Nothing in the middle can read you -Messages travel peer-to-peer across the [Streamr Network](https://streamr.network). There is no Pombo backend they pass through, so there is nothing to hack, subpoena or switch off. +Messages travel peer-to-peer across the [Streamr Network](https://streamr.network). No server sits between you and the person you are talking to, and the infrastructure that carries and keeps your messages only ever handles ciphertext. History is kept by storage nodes. Pombo runs a default cluster, but a channel's owner can point it at a different node, and [anyone can run one](operators/run-a-storage-node.md). The same is true of the [relay](operators/run-a-relay.md) that delivers push notifications. From 0bbc12ce003d0eb9233c6b3faee121f7a5c535be Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 14:04:46 +0100 Subject: [PATCH 7/9] Title the infrastructure section by what it says --- docs/welcome.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/welcome.md b/docs/welcome.md index ba491fa..f7f89f3 100644 --- a/docs/welcome.md +++ b/docs/welcome.md @@ -17,7 +17,7 @@ Your account is a cryptographic keypair generated on your device the first time Creating a channel is the same: you register it and it is yours. It becomes your property. Accounts are free and instant, so keeping separate identities for separate parts of your life costs nothing. -## Nothing in the middle can read you +## Anyone can run the infrastructure Messages travel peer-to-peer across the [Streamr Network](https://streamr.network). No server sits between you and the person you are talking to, and the infrastructure that carries and keeps your messages only ever handles ciphertext. From 7315cd2bbad347cb360d043f631fdbb2b143527a Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 10:07:27 +0100 Subject: [PATCH 8/9] Say which ENS lookups are covered, and that avatars are fetched from their owner's server --- docs/concepts/privacy-model.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/concepts/privacy-model.md b/docs/concepts/privacy-model.md index 7206510..c2ac28b 100644 --- a/docs/concepts/privacy-model.md +++ b/docs/concepts/privacy-model.md @@ -46,7 +46,7 @@ Pombo intentionally has **no per-channel "anonymous mode" toggle**. If you want ## Metadata protections that are on by default -- **ENS lookups are decoyed**: each real lookup is mixed with decoy addresses so RPC operators can't tell which one you cared about. +- **ENS lookups are decoyed** in the direction that runs constantly: resolving the name behind an address you see mixes the real lookup with decoy addresses, in shuffled order, so RPC operators can't tell which one you cared about. Resolving a name *you typed* — starting a DM, sending an invite — is not covered, and the provider sees exactly the name you asked for. - **Push notifications carry no content** and use k-anonymity tags so the relay can't tell who a notification is really for — and both wake signals and registrations are published under a fresh throwaway key. See [Notifications](../guides/notifications.md). - **Cross-device sync is sealed to yourself**: state snapshots published to your own inbox are encrypted so only your key can read them, and any payload not authored by your own wallet is rejected. - **Network node IDs are not derived from your wallet.** @@ -62,3 +62,4 @@ Honest limits, in brief — the full list is in the [threat model](../security/t - Membership of contract-backed channels is public blockchain state: who is allowlisted, who is banned, who paid for a subscription and until when. - DM inboxes are enumerable, and their traffic pattern is public: given any address, anyone can find its inbox, and a plain HTTP request to the storage node returns its retained envelopes. When messages arrived and how many is readable by anyone. What that does *not* reveal is who they were from — every message carries a different throwaway publisher and sealed content ([threat model](../security/threat-model.md#visible-metadata)). - Your IP address is visible to network peers, as in any P2P system. For now, use a VPN or Tor if IP privacy matters to you; a proxy-node layer built on Streamr Sponsorships is in development to address this at the protocol level. +- **ENS profile pictures are fetched from wherever their owner points them.** Seeing someone's avatar means your client requests an image from a server *they* chose, which learns your IP address — and someone can point their avatar at a server they run precisely to collect that. Pombo requires HTTPS and routes `ipfs://` avatars through a public gateway, neither of which hides who made the request. The generated identicon is used whenever no ENS avatar is set. From 8f38071b2e849c3dcf89a99079944ac430541b9d Mon Sep 17 00:00:00 2001 From: Ocnrb Date: Tue, 25 Aug 2026 11:50:32 +0100 Subject: [PATCH 9/9] Point at the setting that turns the avatar fetch off --- docs/concepts/privacy-model.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/concepts/privacy-model.md b/docs/concepts/privacy-model.md index c2ac28b..57ab94c 100644 --- a/docs/concepts/privacy-model.md +++ b/docs/concepts/privacy-model.md @@ -62,4 +62,4 @@ Honest limits, in brief — the full list is in the [threat model](../security/t - Membership of contract-backed channels is public blockchain state: who is allowlisted, who is banned, who paid for a subscription and until when. - DM inboxes are enumerable, and their traffic pattern is public: given any address, anyone can find its inbox, and a plain HTTP request to the storage node returns its retained envelopes. When messages arrived and how many is readable by anyone. What that does *not* reveal is who they were from — every message carries a different throwaway publisher and sealed content ([threat model](../security/threat-model.md#visible-metadata)). - Your IP address is visible to network peers, as in any P2P system. For now, use a VPN or Tor if IP privacy matters to you; a proxy-node layer built on Streamr Sponsorships is in development to address this at the protocol level. -- **ENS profile pictures are fetched from wherever their owner points them.** Seeing someone's avatar means your client requests an image from a server *they* chose, which learns your IP address — and someone can point their avatar at a server they run precisely to collect that. Pombo requires HTTPS and routes `ipfs://` avatars through a public gateway, neither of which hides who made the request. The generated identicon is used whenever no ENS avatar is set. +- **ENS profile pictures are fetched from wherever their owner points them.** Seeing someone's avatar means your client requests an image from a server *they* chose, which learns your IP address — and someone can point their avatar at a server they run precisely to collect that. Pombo requires HTTPS and routes `ipfs://` avatars through a public gateway, neither of which hides who made the request. **Settings → Content → ENS Avatars** turns the fetch off entirely and falls back to the generated identicon; it is on by default, and off it holds everywhere an avatar is drawn, including the screens shown before you unlock and the pictures attached to notifications.