Security by design
Capsule content is encrypted in the browser before transmission. The server stores the encrypted envelope and only lifecycle metadata required for operation.
Local encryption
MinuteVibe uses Web Crypto, HKDF-SHA-256 and AES-256-GCM with distinct keys and nonces. Reading secrets remain in the URL # fragment.
Private replies
Blocking reasons are encrypted for the emitter with a dedicated reply key. The server does not store these reasons in plaintext.
Limitations
MinuteVibe does not protect against a compromised device, screenshots, deliberate copying by a recipient, or network metadata observation by transport infrastructure.