On most networks, privacy is a policy the operator asks you to trust. On Pixelmine it is a property of the mathematics: the content of your private messages and followers-only posts is sealed on your own device before it leaves, and no node — and not the company — holds the keys to open it.
The messages in direct and group chats, and the content of followers-only posts, are encrypted on your device and can only be opened by the people you intend. The nodes and the coordination service that store and relay them handle that content only as sealed data they cannot decrypt, and there is no master key that opens your conversations. Some details around the content are not encrypted — they are listed further down this page.
Message and post content is encrypted before it is sent, so its plaintext never leaves your phone.
Nodes hold that content only as ciphertext and wrapped keys — meaningless without the right key.
Decryption happens solely on the devices of the people you chose to share with.
Pixelmine’s key exchange and signatures use standards designed to remain secure even against the quantum computers of the future. Each message and post is sealed with its own fresh key, and that key is then wrapped so that only the people in the conversation — or, for a followers-only post, each follower — can open it.
A followers-only post is sealed with a single key, and a copy of that key is wrapped individually for each accepted follower — so exactly those people can read it, however far the post travels. Group chats share one key among their members, delivered to each member individually.
Because the network is made of independently run nodes, authenticity cannot rest on trusting the machine that hands you data. Instead records carry their author’s signature, and nodes check it before accepting data from one another — so a node does not have to take the machine that handed it data on trust.
Your identity is derived from a cryptographic key generated on your own device and never uploaded to anyone. There is no password to phish or leak: what proves a post or a message is yours is the signature your key makes. The company never holds your key, so it cannot reset it or sign anything as you.
Owning your identity means owning its recovery too. Your keys export as a single encrypted file, unlocked by a 12-word recovery phrase, and restore on any device — the company is never in that loop. The keys that unlock your conversations are stored on nodes sealed to your own key, so you can recover them on a new device without exposing them to a node.
An encrypted key file, secured by your 12-word recovery phrase, restores your account anywhere.
There is no reset button we can press, and no key of ours that opens your messages or posts.
Your public and followers-only posts are copied across many nodes, not locked inside one company’s servers.
End-to-end encryption is a strong guarantee, but an honest one is worth more than an overstated one. Here is exactly where the line falls.
Strong privacy is worth stating precisely. Encryption protects the contents of your communication — it does not erase the fact that communication took place, and it is not a cloak of total anonymity.
Pixelmine does not invent its own cryptography. It uses published, standardized algorithms — the same ones being adopted to resist future quantum computers.
A post-quantum key-encapsulation standard (ML-KEM-768, FIPS 203) establishes shared secrets.
A post-quantum signature standard (ML-DSA-65, FIPS 204) authenticates identity and signed records.
AES-256, in CBC mode, seals the actual messages, posts, and files; the signature on each record protects it from tampering.
The content of your private messages and posts rests on keys only you hold and encryption no operator can undo. That is the difference between a promise and a guarantee.