Private messages
One-to-one conversations are end-to-end encrypted on your device, with cryptography resistant to quantum computers — the server carries them, it does not read them.
What "end-to-end" means here
Encryption and decryption happen in your browser. The secret keys never leave the device, and what travels over the network is the already-encrypted text.
This holds for the voice rooms and for the ephemeral rooms too, with the same techniques.
Resistant to quantum computers
The key exchange uses ML-KEM and the sender's signature uses ML-DSA — algorithms chosen because they resist quantum computing attacks, and not only today's attacks. It is a decision about the future of conversations that stay stored.
Automatic translation is the exception, and it warns you
Translating a message automatically means sending its text to a translation service — that is, outside the end-to-end envelope.
That is why text translation ships turned off, and the trade-off is explained at the moment you decide to turn it on. It is not fine print: it is the choice presented where it happens.
Voice messages work differently: they are translated automatically as they are sent, into the recipient's reading language (the language of their app). For that, the audio is opened on the server, transcribed by a speech-recognition service and, when the spoken language differs from the recipient's, translated by a language model — so that voice message leaves the end-to-end envelope at that step, even when the languages match. There is no switch: the recorder says so before you send, and if you would rather it did not happen, type instead of recording. Neither the audio nor the text is kept on the server; the translation travels inside the encrypted message.
Voice messages stay end-to-end, without that step, when the recipient has no known reading language, when the recording is outside the translation limits, and in group rooms. The details are in section 13 of the Privacy Policy.
If messages show up as unavailable
When the message transport is not configured in the environment, the screen says it is unavailable instead of simulating a conversation. A fake transport in an end-to-end feature would be a security lie, and the product prefers to admit the failure.