Here's what happens when two of your devices sync through a Velmun app — and what our relay can and can't see.
Your devices share a sync code, exchanged by QR when you pair them. From that code each device derives two things: the encryption key and the address of a mailbox on the internet. One device drops a sealed envelope there; the other picks it up and opens it. The code never leaves your devices — which is why the mailbox can't be opened, not even by us.
Two devices don't find each other on the internet by themselves. They sit behind routers, switch networks, are sometimes off. The mailbox is the one place both can reach.
On the same Wi-Fi, it isn't used — the devices talk to each other directly, encrypted as well.
What every internet connection involves, and so applies here too: the infrastructure provider, Cloudflare, sees the connecting IP address — like any website. We don't log it.
If no new envelope arrives for 30 days, the mailbox deletes itself, contents included. You can also empty it yourself at any time. There is no store at our end that grows.
Because we don't have the key, we can't give it back to you. Lose all your devices and the sync code, and the mailbox stays shut. That is the same property that makes it worthless to an attacker.
In the EU. Operated on Cloudflare infrastructure that creates the mailboxes exclusively in EU data centres.