Messages & the Record

An Orbit lives in its conversation. RORBT’s messaging is built for that—not for performance. There are no likes, no reactions, no follower counts, no “who’s online” dots. None of the machinery that turns talking into a popularity contest. Just the two things organizing actually needs: a way to talk to everyone, and a way to talk to one person.

Two surfaces

• The whole-orbit stream. A live group chat every member sees. This is where the Orbit thinks out loud—proposals get floated, shifts get covered, the day gets organized. Messages from the same person within a few minutes group together; the newest sits at the bottom, like any chat you already know.
• Direct messages. Private one-to-one threads between two members, listed by person. A DM is visible only to the two of you—never to the rest of the Orbit, no matter what. The server enforces that on every read.

Replies and threads. Reply to any message and it carries a quote of what it answers; tap that to jump to the original. When a message gathers replies, it shows a “N replies” link that opens the whole thread in one focused view, so a side-conversation doesn’t bury the main stream.

Triage, not inbox-rot. Each message has quiet, Gmail-style hover actions: flag something to find later, archive it out of the way, copy it, or hide it for yourself (a local-only action—it removes the message from your view and touches no one else’s record).

The record can’t be quietly rewritten

This is the part that matters most, and the part most “modern” messengers get wrong.

You can edit your own message, and you can retract it—but you can never erase it. “Retract” means withdraw it from the live conversation, not delete it from history. Every version a message has ever had is kept: the original, each edit, the retraction. The whole history is hash-chained—each version links to the one before it—exactly like the transparency log, so a dropped or altered version is detectable, not deniable.

Anyone who could see a message can open its full history—every version, who changed it, when, with a verified-chain badge.

Why so strict? Because the alternative is a trapdoor. Picture a message that reads hello everyone, edited to something vicious, then innocently edited back to hello everyone. In an app with real delete, the ugly middle version simply vanishes and it’s your word against theirs. Here it can’t. For a tool built to outlast bad-faith actors and infiltration, an unrewritable record isn’t a feature—it’s the point.

(Editing is for your own messages only. Removing someone else from the Orbit, or any binding group decision, runs through Proposals & Voting, not the chat.)

Receipts, kept small on purpose

In a direct message, the sender sees a simple “Seen” once the other person has read it—the same quiet courtesy as any 1:1 chat. That’s the whole of it. There are deliberately no read counts on the group stream—no “seen by 12,” no leaderboard of who’s paying attention. Receipts are a 1:1 nicety, never a metric.

What the encryption does—and doesn’t

Be clear-eyed here. Message contents are encrypted at rest under a key unique to your Orbit. They are not end-to-end encrypted today: the server holds that key and decrypts to deliver. It does not index your words or build a searchable archive—keyword search runs entirely in your browser, over messages already delivered to your device—but “won’t read” is a promise on the hosted relay, not yet a guarantee it can’t.

For the full, honest picture of what the server can and can’t see—and the path to the membership-blind “deaf server” we’re building toward—read The Deaf Server. Don’t take the claim on faith; that page is written to be checked.