M2 Android communication content
Ordinary Channel participation does not require a phone number, email address, or real-name account. Message and supported file content is encrypted on the device for intended recipients, and local history follows the app’s encrypted storage design.
Messaging Gateway
Messaging traffic reaches the M2 v3 Onion Service through embedded Tor, so the Gateway does not receive a direct originating clearnet connection. The Gateway temporarily relays encrypted payloads: authenticated durable receipt initiates deletion, and undelivered ciphertext expires after no more than 48 hours.
Public website on Cloudflare
The Mirage Project website is a public HTTPS service hosted on Cloudflare Pages. Visiting it necessarily sends a network request to Cloudflare and may create standard provider-side connection metadata. The site uses no analytics, advertising pixels, session replay, remote fonts, or behavioral tracking, and it does not set an optional marketing cookie.
Network identity endpoint
/api/network-identity is a first-party HTTPS endpoint used by the current Android connection-status presentation. Cloudflare can observe the requesting public IP at its edge and provides bounded city, region, and country fields. The endpoint returns those fields and the request IP with Cache-Control: no-store; the app keeps the result in memory for the status presentation. M2 does not persist these values in its application database or use them for analytics.
Release service, Firebase, and PayPal
- Release and download Worker
- The dedicated Cloudflare Worker serves the trusted latest manifest and immutable release artifacts. A download request reaches Cloudflare. Artifact integrity is published with SHA-256 values and the Android signer fingerprint.
- Firebase generic wake path
- The service may use a generic wake mechanism to prompt the app to check for available encrypted work. Communication content is not placed in the wake payload.
- PayPal checkout
- When a user chooses the supported purchase path, PayPal processes checkout and payment information under its own service. M2 verifies payment state server-side; a browser return is never treated as proof of payment.
Direct email inquiries
Information voluntarily sent to [email protected] is outside accountless M2 communication. The sender’s email provider and the Mirage Project email service process it as ordinary email. Send only what is necessary for the inquiry.
Practical choices
Do not put invitation material, M2 Codes, or sensitive Channel content into ordinary email. For procurement or institutional evaluation, start with a minimal description and establish an appropriate next step.