AeroNyx App and Protocol Architecture

AeroNyx has three parts. The first is the AeroNyx App, which is closed source. The second is a set of central services operated by AeroNyx. The third is an open-source node network, licensed under AGPL-3.0. Message and attachment content is encrypted end to end. The central services still handle delivery metadata, contact lists, group membership and Nyxi AI conversations, and AeroNyx operates every production node today. This page describes how the parts fit together and where each trust boundary sits.

Components

Wallet identity and chat identity

AeroNyx keeps your wallet identity separate from your chat identities.

Each chat identity is an Ed25519 key pair that your device generates. It is not derived from your wallet, and contacts see it instead of your wallet address. You can hold more than one chat identity. Deleting or rotating one chat identity does not affect your wallet or your other identities.

Messaging

Message content is encrypted and signed on the sender's device and decrypted only on the recipient's devices. The relay never receives chat keys, group keys or attachment keys. For the exact formats, see AeroNyx Chat Relay Client Integration and AeroNyx Chat API Integration Guide.

Default path: the central relay

By default, every message goes through the central chat relay (RelayWS), which AeroNyx operates. The relay handles the following:

• Delivery metadata. It sees sender and recipient public keys, group and message IDs, timestamps, payload sizes, delivery and read state, presence and typing signals, call signalling metadata and connection IP addresses.
• Contacts. It stores your contact list: each contact's public key and the nickname and note you set. These are stored in plaintext so that the list syncs across your devices.
• Groups. It stores group names, descriptions, owners and member lists in plaintext. Group message keys are stored only in encrypted form, once for each member.
• Offline queue. It holds encrypted messages for devices that are offline and deletes them after delivery.

In other words, the central relay cannot read what you write. It can see who you talk to, when you talk, and which groups you belong to.

Optional path: the two-hop privacy route

The app has a setting called Use privacy route first, which is off by default. When it is on, the app sends one-to-one messages through two AeroNyx nodes instead of handing them to the central relay. The app wraps the message, which is already end-to-end encrypted, in one encryption layer for each node. Each node can remove only its own layer and learns only the next hop. The app counts a message as delivered only after it checks a signed receipt from the final node. If no privacy route is available, the message waits on your device. It is sent through the standard relay only if you approve that for the message.

The node software publishes its limits. Paths are two hops long and the network is small, so the set of users you blend in with is small. The design defends against relays that are curious but follow the protocol. It does not defend against an adversary that watches the whole network. See Node Discovery and Encrypted Multi-Hop Relay.

Attachments

Each photo, video, voice message or file is encrypted on the device with its own random AES-256-GCM key. The app then uploads it straight to Cloudflare R2 through a presigned URL that the backend issues. Storage never receives the file key, the file name or the plaintext. The key travels inside the end-to-end encrypted message. The older upload endpoints on the AeroNyx backend remain as a fallback. For endpoints and limits, see AeroNyx Chat Relay Client Integration.

Groups and calls

Group messages are encrypted with a shared group key. When a member leaves or is removed, the group key is rotated. Voice and video calls are signalled through the central relay and carried by a media server that AeroNyx operates. Call audio and video are encrypted end to end at the frame level.

Identity backup (.ayx)

You can export a chat identity as an .ayx file. The file contains the identity seed, encrypted with a key derived from your password with PBKDF2 and a random salt. The seed is never stored in plaintext in the file. Export and import happen only when you start them. AeroNyx does not keep a copy of the file and has no recovery key. If you lose both the device and the backup, the identity cannot be recovered.

Nyxi AI and memory

Nyxi conversations pass through the AeroNyx backend and are stored there. They are not end-to-end encrypted. The backend sends inference requests to models on Phala's confidential-computing (TEE) service. The app does not yet verify Phala's attestation itself.

Nyxi memory is off by default. When you turn it on:

• Memories are extracted from your conversations by an AI model through the backend. Extraction therefore sees the conversation text.
• The memories themselves are stored first on your device, in a local database.
• While the VPN is connected, the app may also upload a sealed, owner-signed copy of each memory to a node. The node stores ciphertext. This copy is best-effort and is not a backup service.

See MemChain and Blind Vault: What They Store and What They Don't.

Commitment ledger status

MemChain includes a signed commitment ledger, an append-only record of commitments to encrypted memory records. It is frozen: no new blocks have been produced since July 2026, and its single coordinator node has since been decommissioned. It is not a blockchain and has no global consensus. See Signed Commitment Ledger: Design, Current Status and Limits.

Privacy network (VPN)

The VPN is a single-node gateway. The app opens an encrypted UDP tunnel to one AeroNyx node, and that node forwards your traffic to the internet. Like any VPN exit, the node sees destination IP addresses and handles your DNS lookups. The app authenticates each connection with a blind-signed voucher and a throwaway client key. The node can therefore check that you are allowed to connect without learning your account. For the full comparison, see AeroNyx Privacy Network vs Traditional VPN.

What nodes are designed to see

The node software is built so that nodes never hold the keys to message content, attachment content or MemChain plaintext. On the chat and storage paths, a node handles only these items:

• ciphertext and its size
• signatures
• the next hop
• timestamps
• replay guards
• rate limits
• aggregate counters

The VPN gateway is the exception. It is an internet exit, so it necessarily sees the destination addresses and DNS lookups of the traffic it forwards.

Nodeboard is the operator console. It shows the people who run a node per-session VPN records for that node: the client key, bytes, start and end times. Operators can end sessions and queue bans for client keys. When the app uses vouchers, that client key is a throwaway key and does not name an account. Public statistics are aggregate only.

What runs centrally today

AeroNyx runs both central services and the decentralized node network, and the decentralized paths do not replace the central ones. Today AeroNyx runs these parts centrally:

• the chat relay
• attachment storage on R2
• APNs push
• the call service
• the AI backend
• accounts and payments
• voucher issuance
• the node directory

AeroNyx also operates every production node. The node software is open source, so others can review it and run it. For the plain-language overview, see What is AeroNyx.

Read next

• What is AeroNyx
• AeroNyx Privacy Network vs Traditional VPN
• AeroNyx Chat Relay Client Integration
• Node Discovery and Encrypted Multi-Hop Relay
• MemChain and Blind Vault: What They Store and What They Don't
• AeroNyx Nodeboard Operator Console Guide

<!-- faq:start -->

Frequently asked questions

Does the central chat relay see who I talk to?

Yes. The central relay sees the public keys of the sender and recipient of each message, along with timestamps, sizes and delivery state. It also stores your contact list and group membership. It cannot read message or attachment content, which is encrypted end to end.

How do I send chat messages without the central relay?

Turn on Use privacy route first in the app's chat settings. One-to-one messages then go through a two-hop route across AeroNyx nodes. If no route is available, a message waits until you approve sending it through the standard relay. The setting is off by default.

Where are encrypted attachments stored?

Encrypted attachments are stored on Cloudflare R2. The app uploads them through presigned URLs that the AeroNyx backend issues. Each file is encrypted on your device with its own key before upload. The key travels only inside the end-to-end encrypted message.

Is the MemChain commitment ledger running?

No. The commitment ledger is frozen. It has produced no new blocks since July 2026, and its single coordinator node has since been decommissioned. Nyxi memory itself still works on your device and does not depend on the ledger.

Does the .ayx backup let AeroNyx recover my identity?

No. The .ayx file is a password-encrypted copy of your chat identity that you export and keep yourself. AeroNyx does not store it and has no recovery key.

<!-- faq:end -->