The sixteen
asked most

Both, and not one bolted onto the other. A payment here is a kind of message: it arrives in the conversation it belongs to, and it is signed there.

If you never open the wallet, what you have is an end-to-end encrypted group chat with calls, files, folders and voice notes. If you do open it, the money lives in the same rooms as the people who share it.

To send a message, nothing at all.

To share a wallet you need two things. Keep your twenty-four words somewhere safe, and understand one rule: money moves when enough of the group has signed for it. Everything else the application handles — an address you write down once becomes a name, so the box asking who to pay asks for a person rather than for sixty-four characters.

The source is public: every screen on this site is in the repository, and so is the server behind it.

What money costs to move is what the chain charges to move it — the network fee — and none of that comes here. If you run the federation yourself, what you pay for is the machine it runs on.

macOS, iOS, Android, the web and a browser extension. One codebase, drawn the same on all of them — what you learn on the phone is what you already know on the desktop.

Yes. Nothing about the money is compulsory. A group with no wallet in it is a group chat, and it stays one until somebody opens a wallet in it.

Nobody. That is the whole of it.

A group wallet has no owner: every signer’s key was made on their own device and stays there, and the address is built out of all of them at once. Moving money out of it takes as many signatures as the group agreed on — any two of three, any five of nine, whatever was set. Until enough have signed, a payment is a request.

The wallet the money is leaving. What it will cost is not quoted in the signing card — on most chains the fee is not known until the signers prepare the transaction, and a number invented before then would be a guess about somebody’s money. On a chain paying its fee in the coin being sent, sending a whole balance can leave nothing to pay with, and the composer says so where you type the amount.

Bitcoin, Ethereum, BNB, Tron and Solana, along with the tokens on them. They sit in one list under one balance.

Every coin says which chain it is on, and that is deliberate rather than decorative: USDT on Tron and USDT on Ethereum are not the same money, and a list that showed them as one line is a list that eventually sends to the wrong network.

For the conversation: everyone’s keys change at the moment membership does, so a person who has left cannot read what is said next. Not as a rule the server enforces on the words — it cannot read a line of them — but because the key they had stops opening anything. Who is in the room is the part the server does see: membership changes travel in the clear, which is what lets it refuse an append from somebody who is no longer there.

For the money: who signs is part of the rule the group set, and changing that rule takes the same agreement as spending under it.

No, and neither can anybody else here. There is no key held on your behalf, so there is nothing to seize and nothing to press a button on. A payment that has been broadcast is on the chain.

What the group has instead is the step before: a payment that has not reached its quorum has not happened, and any signer can simply decline to sign it.

No. It puts messages in order and it carries calls — and what it carries is ciphertext. The keys that would open it were made on the devices in the room and have never left them.

This is true of the payment requests as well as the conversation around them.

What it does hold is worth saying, because a server that carries anything necessarily holds some of it. Per message: which group it belongs to, which device sent it, the moment it arrived, how large it is, and the ciphertext. It also holds when a device was last connected — presence — and that one you can switch off. None of that is the content, and none of it can be turned into the content.

The catch-up buffer is thirty days by default, and that number is one product decision written down: it is the longest a device may stay offline before it has to join its groups again. Old data leaves a month at a time, by dropping the partition rather than by deleting rows.

A federation’s defaults ship sized for about a hundred people at roughly two devices each, and every one of them is a line in a configuration file rather than a limit in the protocol. A group wallet on Bitcoin takes up to fifteen keys with the threshold anywhere in between; on the other chains the ceiling is the chain’s own.

No. It is MLS, published as RFC 9420, and other messengers use the same standard — which is the point of naming it rather than describing it.

What MLS does that matters for a group is the hard part: when somebody joins or leaves, everybody’s keys change at that moment rather than at the next convenient one.

Your twenty-four words bring back who you are and every address you can be paid at. Install it somewhere else, put the words in, and your identity and your money are yours again.

Your history is a different answer, and it is the uncomfortable one. Conversations move from a device you still have to the new one — not out of the phrase. If the lost device was the only one you had, the history it held is gone. That is a decision rather than an oversight: a backup that the phrase alone could open would be permanent access to everything you have ever said, held somewhere you are not, and revocable by nobody.

The practical answer is to have the application on a second device before you need one.

The service is: the delivery service, the SDK and the wire formats are askucher/compax-core, and it is the same code this deployment runs. That is the half of the claim worth checking — a server nobody can read is a server you are taking on trust, and no amount of encryption in the app makes up for it.

Yes — docker compose up in askucher/compax-core raises the whole thing on your own machine: a company, a community, or one person on a box at home. The steps are here.

Your devices talk to whichever server orders a room you are in, not only to yours. That is the point rather than a leak: your device proves who it is with an attestation any server can check and none can issue, so joining a second one is not a favour the first has to grant — and no pair of servers has to trust each other for you to be in a room at either. Which one somebody joined through does not decide which rooms they can be in, and if a server goes down its people move to another and carry on.