What is encrypted?
In the current project, new attachments, voice notes and video messages from the main chat composer are encrypted on the device before upload. This uses AES-256-GCM and key wrapping for recipients. Updated clients and hosts are required.
Old files are not automatically re-encrypted. Avatars, appearance assets, public posts, emoji and stickers remain public by design. Do not assume all Sibrel conversations are end-to-end encrypted.
Keys and recovery
A separate access password is created before the first protected file is sent. Private keys are stored in the device’s IndexedDB; a copy encrypted with the separate password may be stored on the server. Keep a backup and your password safe.
- If key fingerprints change, verify them with the other person through another channel.
- Recipients without the right key cannot read a file; receiving a key later does not guarantee access to old attachments.
- Losing the device, key backup and password can mean losing access.
- Removing a member does not revoke keys or files they already received.
- A malicious client or compromised device can read data before encryption.
Deleting your account
Open Settings → Account and security → Danger zone. Confirm your current password and acknowledge that the action is irreversible.
- Your profile, email, password, sessions, contacts, memberships and personal settings are deleted.
- Messages, replies and attachments remain; the author appears as “Deleted account”.
- Transfer communities you own before deletion, or delete them separately.
- An unavailable linked host during the preflight check may block the operation.
- Copies saved by recipients and operator backups do not disappear automatically.
Contact your home host’s operator with data deletion questions. For the Sibrel project: support@sibrel.net.
Bots, webhooks and third parties
Bots can read permitted channels and process events. Their developers may use separate storage and their own rules. Grant minimum permissions and check what they retain.
Depending on host settings, processing may involve S3, SMTP, LiveKit, Firebase Cloud Messaging and an IP-based country/city lookup service. The operator’s policy should identify the actual recipients.
Reporting a problem
Report vulnerabilities to support@sibrel.net with the subject “Sibrel security”. Include a description, versions and a safe reproduction example. Do not publish other people’s data or active secrets. Do not test other hosts without permission.
Report user behavior through the built-in reporting feature or to community moderators. Include the case identifier and facts when appealing.