Your words are sealed on your phone, before they ever reach us.
Every message is encrypted on your device with a key made for that one conversation. This page says exactly what that covers, and exactly what it does not.
Debriefs are private, one-on-one messages on LENDZ. Each conversation has its own key, made on a member's device, and every message is encrypted with it before it is sent. The key reaches each of the other person's devices through Olm, an open-source implementation of the Double Ratchet, and a 6-digit PIN protects a recovery copy. The servers store message text only in encrypted form.
What end-to-end means here
When you send a message, your device encrypts it before it leaves. The conversation's key is generated on a member's device, and the text is sealed with it using AES-GCM, a widely used authenticated cipher. What reaches the servers is ciphertext, unreadable without that key. Even the conversation list keeps no preview: the latest message is recorded simply as "Encrypted message".
Photos, videos and other attachments get the same treatment. Each file is encrypted on your device with a key of its own before it is uploaded, and the details needed to open it travel inside the encrypted message. Edits are sealed again the same way.
Every message is also bound to its conversation, its own identity and its sender. A message that has been moved or altered fails that check, and the app refuses to show it: "This message could not be verified and was not opened."
How a message travels
- 01Procedure 01
A key for this conversation
The first time you write to someone, your device generates a key for that conversation alone.
- 02Procedure 02
Wrapped for every device
The key is locked separately for each registered device in the conversation through Olm, so each phone or browser opens it with its own identity. If one of their devices cannot be reached, the app tells you it may not see the message until it reconnects.
- 03Procedure 03
A PIN-locked copy
Your device also locks a copy of the key with a key derived from your PIN. That copy is what lets a new device of yours open your past conversations.
- 04Procedure 04
The message is sealed
The text is encrypted with the conversation key and bound to the conversation, the message and the sender.
- 05Procedure 05
The server stores ciphertext
It records who sent the message and when, and holds the sealed text.
- 06Procedure 06
The other side opens it
Their device unwraps the conversation key with its own identity, or with their PIN, and decrypts the message locally.
The PIN, and what it costs you to lose it
A 6-digit PIN is required to use Debriefs. You set it the first time you open your messages and enter it whenever you unlock them, and it refuses PINs that are too easy to guess, like a run of the same digit or a straight sequence. Your device turns the PIN into an encryption key with a standard, deliberately slow key-derivation function and a random salt kept for your account. That key lives in memory only while you are unlocked, and it is never written to storage.
Read this part twice. When you unlock, your PIN is sent to the server and checked against a stored hash, and repeated wrong guesses lock you out for longer each time. The PIN guards a recovery copy of your keys, so choose one nobody could guess from your life.
There is no forgot-PIN button. Changing your PIN in the app requires the one you have, and if you lose your PIN, your message history is lost with it. There is no recovery service to ask.
The door, from the inside
The first time you open Debriefs, this is what you see, warning included. We would rather you read it once now than learn it later.
What is sealed, and what is not
End-to-end encryption protects what you say. It does not hide that a conversation exists. Here is the complete picture.
| What | Who can read it |
|---|---|
| Message text, edits and attachments | Only devices holding the conversation key |
| Who is in a conversation | The servers |
| When each message was sent, delivered and read | The servers |
| What kind of message it is | The servers |
| A message you choose to report | Moderators, from the copy your app sends with the report |
Who can message you
You decide who can start a conversation with you, and the rule is enforced by the server, not merely hidden in the app. Blocks always win, whatever you choose.
Mutual follows
The default. Someone can message you when you follow each other.
People I follow
Anyone you follow, whether or not they follow you back.
Everyone
Any member, unless you have blocked them.
No one
Your inbox is closed to new messages.
Verified members
For verified accounts: verified members only, or only the verified members you follow.
Sent, delivered, read
Under your newest message you will see Sent once it is stored, Delivered once it has reached their device, and Read once they have opened it. Read receipts are on by default. Turn them off in Settings and you stop sending them; it does not hide anyone else's from you.
The facts, plainly
Encryption
Every message, every attachment, every edit. There is no unencrypted mode.
How keys move
Olm, between devices. Message and file contents are sealed with AES-GCM.
The PIN
6 digits, required, checked by the server, with lockouts that grow.
Recovery
Your PIN is the way back to your history. The app has no reset.
Who can reach you
Mutual follows, unless you change it.
Receipts
On by default, and yours to switch off.
Questions on file
Q01Is this the same as Signal?
No, and we will not pretend it is. Debriefs use Olm, which implements the Double Ratchet algorithm that Signal's protocol is built on. But this is LENDZ's own system, with its own design choices, including a PIN that the server checks.
Q02Can LENDZ read my messages?
Message text, edits and attachments are stored only as ciphertext, and there is no feature for reading them. We can see who you talk to and when. If you report a message, your app sends that message's text with the report, so moderators can act on it.
Q03What happens if I forget my PIN?
The app has no reset. Without your PIN you cannot unlock Debriefs, and the history it protects is lost.
Q04Why is a PIN required at all?
It locks the recovery copy that lets a new phone or browser open your past conversations, and it keeps your messages behind something you know, even on a device that is already signed in.
Q05Who can send me a message?
By default, only people you follow who follow you back. You can open it to everyone, narrow it to people you follow, or close it entirely, and verified accounts can limit it to verified members. Blocks always win.
Q06Are photos and videos encrypted too?
Yes. Each file is encrypted on your device with its own key before it is uploaded, and the details needed to open it travel inside the encrypted message.