Session FAQ

No. Session asks for nothing personal: the app generates a local Session ID. There is no password recovery — you are responsible for backups (export recovery chain, keep your ID safe).

Messages are encrypted on the sender and decrypted on the receiver; servers relay ciphertext only. Key exchange and implementation come from an open protocol, publicly audited — no per-customer "weakened builds" exist.

Share your Session ID (or show the QR code) with your friend; they add it and the encrypted session starts. No phone book lookup, no contact uploads.

Yes. Log the same Session ID on new devices to sync. Full message history depends on your backup strategy — export the backup recovery chain regularly.

Not persistently. Messages dissipate after delivery; they briefly wait in node queues only when the recipient is offline, then vanish from the network. History remains on your device.

The core difference is no account: no phone number, no contact list upload, and therefore no "ban the account" threat. Distributed node routing means no central data source — privacy and censorship resistance are architectural properties.

Encryption-heavy apps often trip generic heuristics. The only criterion: obtain it from official channels and verify signatures/hashes; ignore unverifiable warnings.

Use the built-in "backup recovery chain" to export a backup, then restore it on the new device. Also save your Session ID separately so identity survives even if migration fails.

All code is public: file fixes, contribute translations or audits, self-host nodes, or support the foundation with a donation — details on the official community page.