EnvelopPRIVACY AND DATA LIFECYCLE
Envelop is an experimental messaging system, not an end-to-end encrypted messenger. Use synthetic or non-sensitive text and do not send secrets.
The backend stores anonymous account identity, display name, conversations, message bodies, device queue state, presence heartbeats, bridge leases, compute jobs, and related acknowledgements needed to operate Envelop. Delivery tokens remain session-local in the active bridge.
Human-to-Tomato messages are durable records so they can wait while the nearby bridge is offline. They remain queued until Tomato returns MESSAGE_ACK and the active bridge records it.
The browser keeps the anonymous session and per-conversation read markers in local storage. “Forget this identity” clears local credentials. It does not request deletion of server-side chat records.
“Leave Envelop” requests deletion of the current profile and its related conversations and messages, then clears local session state. Do not rely on closing a tab as a deletion request.
A human online indicator is heartbeat state. Hardware online means an unexpired authenticated bridge lease. Delivered means protocol/backend acceptance—not that a person read the message.
Virtual Tomato runs in the browser and is visibly labeled. It is not sent to physical hardware and is not queued for later hardware execution. Ordinary web hosting and network requests still reveal standard connection metadata to their providers.
The public browser receives only the project HTTPS URL and public publishable key. Secret or service-role keys must never ship in clients. Envelop has no public native-app downloads; the Android bridge is private and the macOS build is an operator/test surface.
This page summarizes behavior in the current repository. It is not a promise that a hosted backend has a particular retention, backup, or deletion revision until deployment is checked. Read the deployment evidence boundary.