Underneath the app is a small set of parts, each with a single clear responsibility: an app that does all the encryption, a network of nodes that stores it, a thin service that connects everything, and a separate path for real-time video. Kept apart on purpose, they add up to a system where no single part holds both your content and the keys to read it.
Each part does one job and only that job. The app is the only place your sealed content can be read; everything else exists to store it, move it, or stream it — holding anything private in a form it cannot open.
The app on your device is the trust anchor of the whole system. It creates and holds your keys, and it performs every encryption and decryption right on your device — nothing readable is ever handed to a server.
It is what you actually use: your feed, chats, calls, and live video. And it is the only part of Pixelmine that can turn sealed data back into readable content.
A set of independently operated nodes acts as the network’s memory. Each keeps its own copy of the encrypted posts, messages, and files, and passes changes along to the others so everyone stays current.
Anyone can run a node. Anything private it holds is already sealed, so a node stores, serves, and replicates that content without ever being able to read it — even with full access to its own database. Public posts it serves openly, because those are meant to be seen.
A single lightweight service ties the network together. It registers accounts, helps messages find their destination, hands off the sealed keys that let new contacts reach one another, and delivers notifications.
It is deliberately minimal — holding only the routing details it needs and never any readable content. A sealed key is passed along and then discarded once delivered, so there is little of value gathered in one place.
Live streams and calls have to travel in real time, so they run on their own path tuned for the lowest possible delay — kept separate from where your stored content lives.
It carries video directly between participants where it can, and switches to a broadcast-friendly method when an audience grows large, so a stream stays smooth whether it is a one-to-one call or a room of viewers.
There is no password waiting on a server to be stolen, because there is no password at all. Your identity is something you hold, and everything you publish carries your signature.
Setting up fresh protection for every single post would be slow and wasteful. Instead, Pixelmine does the heavy step once with each contact, then protects each individual post or message with its own quick key.
The first time you connect with someone — a follow is accepted, or a chat begins — your two devices privately agree on a shared key. That agreement happens a single time for the pair and never has to repeat.
Every post or message is locked with its own brand-new key. That key is then sealed individually for each intended recipient using the shared key, and travels alongside the content — so only the right people can open it.
Group conversations refresh their shared key whenever someone joins or leaves, so the record stays with the people who were actually there. And the labels that route a message — who belongs to a conversation, who sent it, who has read it — are locked as well. Only a plain routing tag is left in the open, just enough for a node to carry something without learning what it is or whom it concerns.
Not everything on Pixelmine is a secret — a public post is meant to be read. What matters is that you choose the audience, and anything meant for a limited one is sealed so only that audience can open it.
Open on purpose. A public post is meant for anyone, so the network carries and shows it freely — that is the whole point of posting publicly.
Sealed. Each one is locked with its own key, and that key is wrapped separately for every follower allowed to see it.
Always sealed, for the people in the conversation and no one else — never open, whatever the setting.
If every post carries its own key, opening a feed could mean a small mountain of work before a single word appears. It doesn’t — because the heavy step happens once per person rather than once per post, and keys arrive a page at a time.
Direct messages and group chats share one design. A conversation is stored as a plain routing label plus sealed content — enough for the network to carry messages to the right place, never enough to understand them.
Media follows exactly the same rule as text. A file attached to a sealed post is locked with that post’s key, and only opened on the viewer’s device at the moment they actually look at it.
In one company’s database, deleting means a row vanishes because a single owner controls the only copy. In a network of independent nodes there is no such lever — nobody can reach into every machine and erase something. So deletion has to be designed rather than assumed.
A stored post can take a moment to settle across the network. A live stream or a call cannot — a half-second of delay is the difference between a conversation and a mess. So real-time video runs on a separate path, built for immediacy rather than permanence.
Video travels straight between participants wherever it can, so a call feels immediate instead of being routed through storage first.
Once an audience grows past a handful, a broadcast follows one path out to many viewers at once, so a stream stays smooth as the room fills.
An incoming call reaches your phone through its own notification system, so it rings whether or not the app is running.
No central directory tells nodes what exists or who is online. They work it out by talking among themselves — continuously, and on their own timers — so the network heals itself instead of depending on any single message getting through at the right moment.
A node simply tells the others it is here. Presence travels by word of mouth, so the network learns who is online without anyone keeping a registry.
Every node wakes on its own schedule and reconciles with peers. A message missed now is caught on the next pass, so nothing hinges on perfect timing.
When a node takes something new in, it can prompt its peers to come and look rather than leaving them to wait for their next turn.
A sync runs one direction at a time: a node pulls into itself. Nothing is forced on it, so it always decides what it accepts.
Nodes each hold a copy of the same encrypted content, so they need a way to stay identical without shipping whole databases back and forth. They compare compact fingerprints and keep narrowing down until only the true differences remain, then exchange just those. New nodes catch up the same way, and nodes rely on agreement among several peers rather than trusting any one of them.
Every record has a short fingerprint, and a whole collection has one too — combined so the order things arrived in never matters.
When two fingerprints differ, the data is split into smaller groups and compared again, quickly zeroing in on where the two nodes disagree.
Within a group that differs, individual fingerprints are matched to pinpoint exactly which records are missing or changed.
Just those records are sent. Syncing an enormous store moves only what actually changed — and matching totals confirm nothing was altered in transit.
A node taking data from a stranger cannot simply take its word for it. So every record has to prove itself — and the proof chains downwards until it reaches something that needs no authority to vouch for it at all.
Comparing record by record is fine for a handful of changes, but nodes need a cheap way to ask a blunter question first: are we identical at all? So every collection’s fingerprint rolls up into a single number standing for everything a node holds.
Adding capacity does not require anyone’s permission. A new node finds the others, introduces itself, and begins catching up on the shared record until it holds a complete copy — then it starts helping carry the load.
A new node discovers existing ones and announces itself, as the network continually gossips about who is currently online.
It fills in the shared record using the same fingerprint comparison, pulling only what it is missing until it is completely current.
Rather than believing any single peer, a node checks with several and follows the majority — so one bad actor cannot quietly rewrite history.
Every sync follows the same path. Nodes start from a single fingerprint and keep narrowing until they know exactly which records differ — and nothing is accepted into the record without a valid signature behind it.
The parts each stay in their lane, handing sealed data from one to the next. Here is the same journey described from the components’ side rather than yours.
Your app locks the content and seals a copy of its key for every person meant to receive it — all before anything leaves your device.
The sealed content is handed to the storage network, where nodes keep it and replicate it to one another so it stays available everywhere.
For a contact you are reaching for the first time, the coordination service passes along the sealed key they need — then discards it once it arrives.
Each recipient’s app uses its own key to open the content. Every part in between only ever handled a sealed version it could not read.