Security / What the servers can see
What the servers can see
End-to-end encryption hides content. It doesn't hide who talks to whom, when, and how much. This page lists what each service learns.
| Service | Sees | Never sees | Kept for |
|---|---|---|---|
| ntfy (signal plane) | topic names, times, IP addresses, which IP listens to which topics; messages are a fixed size | content, names, which topic belongs to whom | messages: 12 h |
| Drop API (lookwhatisee.xyz) | identity ids and public keys, sealed cards, who uploads, how many recipients (as hashes), who downloads and when, sizes, IP addresses, browser push subscriptions | images, notes, card contents, names, contact lists | cards until they expire (then an empty tombstone with the owner and version, 2 years); identities until 180 days unused; push subscriptions until 90 days unrefreshed; upload records about a day; daily usage counters 35 days |
| Drop API, share links | when a share link is created and each link opened, how many recipients, sizes, IP addresses, the encrypted replies | the image, the note, the link secrets (hashes of tokens derived from them only), reply text | the capture up to about 30 minutes (90 s after it's opened); link records and replies about an hour |
| Object storage (OVHcloud S3) | encrypted blob sizes, upload and download times, IP addresses | content | until a few minutes after every recipient has fetched it, at most about a day |
| Push services (Google, Mozilla, Apple, your UnifiedPush distributor) | that a device got a doorbell, and when | content (doorbells are encrypted and fixed-size) | provider policy |
| Your contacts | the devices listed on your card | your other contacts, your other activity | on their device |
What someone running the servers could infer
- Who talks to whom. The timing of a group send, the number of recipients of an object and the topics an IP listens to can be combined into a social graph.
- Activity patterns. When you capture, how often, roughly how large.
- Which devices belong together. IP addresses and timing can tie your phone to your computer.
What limits it
- No accounts, emails or phone numbers.
- Random per-contact topics and doorbells, rotated when you block someone.
- Fixed-size messages and doorbells.
- Short retention everywhere.
- Every part can be self-hosted, so the operator can be you. See Self-hosting.
lwis doesn't hide traffic patterns (no mixnet or cover traffic). The web server keeps no access logs.