Your key. Your people. Still Nostr.
Private conversations on your circle's infrastructure. Still part of Nostr.
Vennel connects your apps, signer and circle-owned server. The goal is private delivery, history and recovery you control, without giving up your public connections.
Working previews available. The full profile is still being built.
Why this matters
Encrypted messages protect what you say. Delivery can still reveal a recipient, when traffic arrives and the address connecting to a relay. That address may belong to you or to a transport you use.
For a family, a private working group or a circle of friends, those details matter. So does knowing who keeps your history, who can delete it, and what happens when a phone or a key is lost.
Nostr gives you an identity you can take between apps. Vennel applies that same expectation of control to the private part of your life.
What Vennel changes
A circle is the people you choose to trust. A box is a small server running Bothy, operated by you or someone in that circle.
The full profile routes sheltered traffic through your circle's boxes over privacy carriers. It aims to take outside service operators out of that private delivery path.
Paired-route previewAndroid-to-Bothy chat has been exercised on emulators. The complete carrier and fallback journey still needs acceptance.
A public relay's retention policy should not decide whether your conversations survive. Your box provides a place for your history, with access controlled by its keeper.
History path implementedBounded history import, encrypted local search and archive recovery are implemented in source. Fresh-box and two-phone acceptance, release and circle replication remain open.
A lane label distinguishes public relay delivery, a recognised circle box and an explicitly chosen direct route. An onion address alone does not make a relay trusted.
In web & AndroidLane indicators are implemented. Full downgrade and hold behaviour remains an end-to-end acceptance task.
Your public Nostr key, posts and follows stay compatible. Sheltered features need a compatible client and a participating circle. My Signet provides identity, signing and verification; see how it fits with KithMoot and Bothy.
One identity, different routes
Your app public relay their app
Public posts stay public. Encrypted DMs still expose delivery metadata to the relay.
You circle boxes + carrier your contact
The intended private route. Circle ownership and the actual transport both matter.
Your device their device
Peers may learn network addresses or proximity. This is a different privacy trade-off.
The full design
These are part of Vennel's purpose. Each needs its own implementation and evidence before you can rely on it.
Admission rules distinguish family, mutually verified contacts and people recognised more loosely. Invitations, storage ceilings, expiry and rate limits constrain who can use a box and how much they can store.
That addresses unwanted access and resource abuse. It cannot make an admitted person trustworthy. The complete family-only mode is still to be integrated.
Device credentials let a phone act for an identity and be revoked separately. Pre-committed key succession is designed to give contacts a verifiable path to a replacement identity key.
Device credentials are in the clients; the full pairing and identity recovery experience is unfinished. Recovery needs preparation before the loss.
The design seals older periods of history behind shares held by your circle. Reopening them requires enough participants, a delay and a recovery request they can refuse.
The intended result is a smaller amount of exposed history. This is not yet an integrated box protection, and it cannot erase copies on another device or prevent physical harm.
Quiet mode mixes messages with filler on a regular schedule. Box-owned scheduling is designed to keep that pattern running while your phone sleeps. Anonymous mode adds a fresh persona and forbids a clearnet fallback.
Box-owned quiet cadence awaits controlled activation and device proof. Constrained anonymous rooms are implemented but await release and real Orbot/phone acceptance. MLS still needs integration. Calls are never quiet.
Limits that remain
The useful question is what an attacker can still learn or do after the protections are in place.
A recipient can take a screenshot. Malware on an unlocked device may read what you read. Secure signers and limited history reduce some exposure; they cannot guarantee a safe endpoint.
Carriers and quiet scheduling reduce particular signals. They do not establish invisibility to a powerful observer watching many places over time.
Your circle can make mistakes or become unavailable. Recovery rules can protect an archive and also prevent you reopening it if too few participants remain.
A public profile can identify you. Vennel does not cover other apps' traffic or act as a device-wide VPN. Those need their own controls.
Is it worth the extra work?
You already use Nostr, want more control over private delivery and history, and have someone willing to operate a box. You can adopt and evaluate the preview together.
Your contacts do not all need to move at once. Public Nostr remains the way to reach people outside the sheltered circle.
A box needs supported hardware, power, connectivity, updates, storage and recovery planning. Carriers and cover traffic use bandwidth; quiet scheduling adds delay.
If your priority is a finished messenger with no infrastructure to maintain, the current Vennel preview will not meet that expectation. Not every spare phone is a supported box.
Progress recorded through 15 September 2026
The paired Android-to-Bothy preview has evidence for encrypted chat, scoped access, restart and route retirement on two emulators.
Web and Android clients also have lane indicators, contact cards and device credentials. A second independently hosted relay route has passed Tor and I2P connection and restoration probes. Those probes establish transport reachability; they do not prove message delivery over the full profile.
New source adds bounded history import, encrypted local search and deletion with recorded outcomes. A production-signed Android 0.6.2 artifact is prepared; physical upgrade acceptance and publication remain open. These are dated project records, not a fresh check of live services.
See the evidence and remaining workWhere to start
Choose the conversations and history you want to control. Read how the client, signer and box fit together, then check the preview's limits before trusting it with sensitive conversations.