User Guide

Qendra sign-up is invite-only and deliberately asks for no email address, phone number, or name. There is also no confirmation email — the less linkable data we collect, the less there is for anyone to subpoena or leak.

1. 1Obtain an invite key from an existing user or operator over a trusted channel.
2. 2On the sign-up screen, paste the invite key and continue.
3. 3You proceed straight to recovery-phrase generation (§1). No mailbox, no verification link.

Trade-off: because we don't store an email, there is no "forgot account" flow. Your 24-word recovery phrase is the only way back in.

Qendra generates your cryptographic identity locally. The server never sees your private keys.

1. 1Open the app and choose Sign up.
2. 2You will be shown a 24-word recovery phrase. Write it down on paper and store it somewhere safe — a fire-resistant safe or safety-deposit box is ideal. Do not screenshot it, do not save it in a password manager that syncs to the cloud, and do not type it into any other website.
3. 3Confirm the phrase to continue. This proves you actually saved it.

The recovery phrase is the only way to restore your account. Lose it and your message history is gone — there is no password reset, by design.

The passphrase encrypts your recovery phrase and message history on this device using Argon2id + ChaCha20-Poly1305. Without it, even an attacker with your unlocked phone cannot read the local database.

1. 1After confirming your recovery phrase, choose Encrypt & continue.
2. 2Pick a passphrase of at least 8 characters. Longer and unrelated to your other passwords is best — a 4-word diceware-style phrase works well.
3. 3Confirm it. Your local store is now encrypted at rest.

Instead of typing your passphrase every time, you can use your device's built-in authenticator (Face ID, Touch ID, Android biometrics, Windows Hello). Qendra uses WebAuthn with the PRF extension: the biometric never leaves the device's secure element.

1. 1Open the identity sheet inside the app.
2. 2Toggle Unlock with this device.
3. 3Confirm with your face, fingerprint, or device PIN when prompted.

The passphrase keeps working as a fallback. If biometrics fail or the device is restored, you can always unlock with the passphrase.

Requirements: HTTPS, modern browser with PRF support (iOS 18+, recent Chrome/Edge on Android, Windows, or macOS).

To prevent man-in-the-middle attacks, verify each contact's safety code over a trusted channel — in person, video call, or signed phone call.

1. 1Open a chat and tap the shield icon next to the contact's name.
2. 2You will see a 6-emoji safety code, a numeric safety number, and a hex fingerprint. Compare them with what your contact sees on their side. All three are derived from the same digest, so any one matching means the others will too.
3. 3If they match, tap Mark as verified. A green badge appears next to the contact, and the message input unlocks.
4. 4If the code ever changes, the app will warn you and block sending. Re-verify before continuing — it usually means the contact reinstalled, but it could also indicate a key swap attempt.

Verification is mandatory. Sending and "delete for everyone" are disabled until you verify the contact. This prevents you from accidentally trusting a swapped key.

You can rename any contact to a name only you see. The other side never learns the nickname — it stays in your local store.

1. 1Open a chat and tap the pencil icon (or open the overflow menu on mobile).
2. 2Type a nickname and save. The chat header updates immediately.
3. 3Clear the field to fall back to the contact's chosen display name.

Each conversation has its own self-destruct timer. The expiry is signed inside the encrypted envelope, so neither the relay nor a tampered client can extend it.

1. 1In a chat, open the timer selector in the header (or the overflow menu on mobile).
2. 2Pick a window: 15 seconds, 1 minute, 10 minutes, 1 hour, 8 hours, or 24 hours. The setting is per-conversation and synced end-to-end with your contact, so both sides always agree on the timer.
3. 3New messages you send carry that expiry, signed inside the encrypted envelope so neither the relay nor a tampered client can extend it. Once the timer elapses, the plaintext is purged from your local cache and disappears from the chat view on every recipient device.

Already-expired messages pulled from the relay are dropped without ever being cached locally.

Tap the ⋮ menu on any message bubble.

• Delete for me — removes the message from this device only. Available on every message.
• Delete for everyone — sends a signed, end-to-end-encrypted tombstone to the other side, which removes the original on their device too. Only available on messages you sent, and only when the contact is verified.

The tombstone is itself a sealed message — the relay cannot tell a deletion from any other message.

If you compose a message while offline, Qendra encrypts it locally and queues it. The instant your connection returns (or every 15 seconds in the background), the outbox flushes automatically.

Queued messages are stored in the encrypted-at-rest local database, so a wipe (see §10) destroys them along with everything else.

You can send a date, time, and a map pin inside a normal chat. The whole invite is end-to-end encrypted — date, place, title, and the accept/decline answer are all sealed in the same envelope as your other messages. The server never learns when or where you are meeting.

1. 1In a chat, tap the calendar icon next to the attachment paperclip.
2. 2Pick a date, time, and duration. Tap the map to drop a pin, or use "Use my location" if you want the app to read your current position (opt-in only — never automatic).
3. 3Choose Exact for a pinpoint (~10 cm) or Approximate for a ~100 m circle that hides the precise spot. Add an optional title, note, or place label.
4. 4Tap Send invite. The recipient sees the invite as a chat bubble with the same map, an .ics download button, and three replies: Accept, Decline, or Propose other. Their reply comes back as another encrypted message and updates the bubble.

Map tile caveat. The map tiles are fetched directly from tile.openstreetmap.org by your browser. OpenStreetMap (not Qendra) sees your IP address and the area you are viewing. Pin coordinates and the invite itself stay end-to-end encrypted; only the tile request is visible to OSM. If that is in your threat model, use a VPN or Tor at the network layer.

When you open Qendra, you'll see a lock screen.

• If biometrics are enrolled, the device authenticator pops up automatically.
• Otherwise, type your passphrase.
• After 10 minutes of inactivity, the app auto-locks and wipes keys from memory. You'll need to unlock again.

The eraser icon on the contacts list triggers a full local wipe. Use this if you are crossing a border, handing your phone to a repair shop, or believe the device may be seized.

• Destroys your private keys, the encrypted message cache, and the offline outbox.
• Clears old app caches so the installed app reloads fresh.
• Signs you out and returns to the login screen.
• Server-side messages remain unreadable to anyone — they are sealed to keys that no longer exist.

You will need your recovery phrase to get back in. There is no other way.

Use this when switching phones, after a factory reset, or installing on a second device.

1. 1Install Qendra and choose Restore from recovery phrase.
2. 2Enter the 24 words in order.
3. 3Set a new passphrase for this device (it doesn't need to match the old one).
4. 4Optionally re-enable device unlock. Each device enrols its own biometric — they are not synced.
5. 5Re-verify each contact's safety code. Verification status is per device, so the new install starts unverified.

Note: messages older than 14 days have already been purged from the relay by a server-side cron, so a new device starts with little or no history. This is intentional — it limits what any future subpoena can produce.

What Qendra protects against, and what it does not:

• Hybrid post-quantum encryption with ML-KEM-768 combined with X25519. Even a future quantum computer cannot decrypt past traffic.
• Hybrid post-quantum signing with ML-DSA-65 (Dilithium) alongside Ed25519. An envelope is only accepted when both signatures verify, so authenticity survives a break of either algorithm.
• HKDF key derivation with per-purpose context labels, plus a per-message subkey derived from a monotonic counter — compromise of one message key does not expose others.
• Sealed sender: the server only sees the recipient, not who sent the message. Your identity is encrypted inside the envelope.
• Message padding to fixed buckets and server-side timestamp bucketing prevent length- and timing-based fingerprinting.
• Replay protection: the client rejects duplicate envelopes within a sliding window, and Realtime presence / broadcast channels are disabled to avoid metadata leaks.
• Server-side TTL: messages are auto-deleted after delivery and hard-purged after 14 days regardless of delivery state.
• Encrypted at rest on your device with audited Argon2id (≥ 64 MiB, t ≥ 3) + ChaCha20-Poly1305.
• Signed key-change alerts: when a contact's keys rotate you receive a signed KEY_CHANGED notice and sending is blocked until you re-verify.
• Warrant canary at /canary — if it disappears, assume legal compulsion.
• Security FAQ at /security-faq — honest answers on what is protected vs. not protected, warrants, metadata, and key rotation.

No system is magic. Qendra cannot protect you if your device is compromised by malware, if you screenshot conversations, or if the person you're talking to leaks the chat. Verify safety codes, keep your OS updated, and use biometric or strong passphrase locks.