Privacy · in depth
How CarrierMSG hides who and where
Encryption hides what you write. This is about the rest: who sent a message, and where it came from.
Preview Preview. Sealed sender is being switched on Loft by Loft. Loft hop is built, off by default, and not yet tested between two phones.
Who sees what
With sealed sender and Loft hop on, Hide my IP off.
| Who sees what | Your IP address | That it's from you | What you write |
|---|---|---|---|
| Phone network or Wi-FiIt can tell you use CarrierMSG and which Loft you talk to. | Yes | No | No |
| First LoftOnly a sealed blob and your address. | Yes | No | No |
| Your home LoftIt holds your account and your incoming mail, but a sealed message doesn't say it's from you. | No | Partly | No |
| CarrierMSGOnly what the Loft it runs (the Elder Loft) sees, as a first Loft or a home Loft. | No | Partly | No |
| The person you write toInside the end-to-end encrypted letter. | No | Yes | Yes |
Loft hop covers sending and checking messages. Photos, files, calls and settings still go directly to your home Loft.
Loft hop needs at least two other Lofts that phones can reach directly. Until there are enough, the switch says so and nothing is sent a less private way without asking you.
- Same-size messages · Always on
- Delay sends slightly · On by default
- Messages with no internet at all · Preview · off by default
Planned Planned, not built: a mix network over Lofts, which would also hide when and to whom messages travel.
Questions
Do I need Tor (Hide my IP)?
No. Loft hop already keeps your IP address from your home Loft. Hide my IP sends everything through Tor too, so no server at all sees your address, not even the first Loft. It is the strongest option and slower. Use it if a network observer or the first Loft seeing your address matters to you.
What does a Loft keeper see?
A Loft carries sealed envelopes. As a first Loft it sees the address a request came from and an encrypted blob; as a home Loft it sees its own accounts and where sealed mail goes, but not who sent it, and never what anyone wrote. Keepers’ dashboards show counts only.
Is this Tor?
No. Loft hop is the standard Oblivious HTTP (RFC 9458) between two Lofts run by people. Tor is a separate, optional layer (Hide my IP).
Does it cover everything?
Sending and checking messages. Photos, files, calls and settings still go directly to your home Loft; calls use the call server as before.
No custom cryptography: Signal Protocol, libsignal's sealed sender and standard Oblivious HTTP (RFC 9458). Last checked: October 2026