What local-first means in EmberChamber
In a centralized messaging model, the server acts as the authoritative repository of your history. If you buy a new device, it downloads the entire archive from the cloud. EmberChamber flips this: your device is the source of truth. The hosted relay only queues encrypted messages temporarily until they are downloaded and acknowledged by the clients in the conversation.
Private message history on the device
Once messages are delivered and decrypted on your local device, they are stored in a local database (such as SQLite on native platforms or client-side indexed storage in the browser). The relay does not keep a permanent copy of your decrypted or encrypted message history. If you close a session or log out of a web companion client without a backup ready, those messages are gone from that client forever.
Device-local private-content search
Because the relay does not store or read the plaintext of your conversations, searching message content must happen entirely on your device. Your client builds a local search index that runs queries locally. Your search keywords never travel over the network to the relay, ensuring that what you look up remains private to your physical screen.
Why this is different from cloud archives
Mainstream messengers build searchable index databases on their servers to make search fast across multiple devices. This means that if their infrastructure is compromised, your complete historical message context can be extracted. EmberChamber prevents this server-side compromise by design: there is simply no central historical archive to steal.
Recovery tradeoffs
A local-first architecture prioritizes security, which introduces key tradeoffs. If you lose all your devices, there is no server-side recovery flow to restore your history. You must configure trusted backup devices or rely on key bootstrap backups. Currently, our trusted-device recovery flow is in active beta testing, and recovery is intentionally restricted to ensure that server operators cannot bypass encryption key controls.
Relay metadata and boundaries
While your messages are local-first, the relay is not empty. The relay still knows when your device connects, which spaces you participate in, and who you exchange ciphertext envelopes with. For a deeper breakdown of metadata visibility, read our Relay Boundary Document and our Privacy Policy.