Posts that fade

Every public post on Withinon has a lifetime: 24 hours, 7 days or 30 days. You choose it when you post, and you can change it later from the post's Edit page. When the lifetime runs out, the post fades: it leaves the feed, and its photos and videos are deleted from our storage at the same time. A post's media never lives longer than the post itself.

Fading does not mean your own memories disappear. When one of your posts fades, your phone keeps a copy for you in Memories, on your device. That copy is yours; it is not on the feed and not on our server.

Why build it this way? Because a post that anyone can find months later is a different thing from a moment shared with people today. Young people already know this: they post less on their main feeds and share more in small, private spaces. Fading gives that feeling back to a public post.

What happens to a photo before it leaves your phone

When you post a photo, your phone seals it first. It is encrypted on the device, uploaded as a sealed box, and the key to open it travels inside the post, so only people who can see the post can see the picture. Our server stores the box. It does not hold a separate copy of the photo it can look at.

Two honest exceptions:

• Captions of public posts are readable. A public post is public: anyone who opens that lane can read the caption, and that includes our server. The app says this on the post's privacy receipt.
• Public videos are uploaded open so they can stream. A video posted for Everyone (or as a Reel or from a Page) is stored unsealed, so it starts playing after the first few bytes instead of downloading whole. Videos for Friends, chosen friends or your Close circle are always sealed and never use this path.

Public media still goes through our safety checks (nudity and child-safety hash matching) before it is published.

Whisper: chats sealed on your phone

Whisper, the chat part of Withinon, is end-to-end encrypted. Each message gets a fresh key, a post-quantum key exchange (ML-KEM-768) is mixed in, every message is signed by the sender, and messages are padded so their length does not give away what is inside. Photos, voice notes and files are sealed the same way.

Our server (we call it the relay) holds a sealed message only until your phone has picked it up, or at most 30 days, and then deletes it. It cannot open what it holds.

What the server can still see

We think it matters to say this plainly:

• Who talks to whom, and when. The relay routes messages, so it sees that two accounts are talking and roughly how often. It does not see what they say.
• Public captions, public videos and the public parts of profiles and Pages, because those are public by design.
• Account basics needed to run the service, such as your username.

We do not track you outside Withinon, and we do not read your chats. Personalised ads are off unless you switch them on yourself, and even then your chats, Whisper and Close circle posts are never used for them.

What is not finished yet

A privacy promise is only as good as its weakest part, so here is ours:

• No forward secrecy for chats yet. If someone recorded encrypted traffic and later stole your long-term key, they could read those old messages. The fix is to rotate keys regularly and delete old ones; it is next on our list.
• Name lookup trusts the relay the first time. The safety number in each chat lets you check you are talking to the right person; we plan to prompt for it and warn when a key changes.
• No independent review yet. The encryption design has not been reviewed by an outside cryptographer. We will do that before we make bigger claims, and we will publish what they find.

Why we write this down

Anyone can say "private". We would rather show how it works, what it costs, and what is still missing, and then fix the missing parts in public. If you find something we got wrong, write to us at support@withinon.com.

You can try Withinon at withinon.com.