# Privacy in the Spaces app — what is on, and what you can turn on This page is about one app: **Witbitz Spaces**, the multiplayer AI room Witbitz makes. It says what the app protects without you doing anything, what you can switch on for a room or for a device, and where each setting is. What each protection hides, and from whom, is the platform's and is described once, in [Privacy tiers](https://witbitz.chat/docs/privacy-tiers). Every app built on Witbitz makes its own choices; these are the Spaces app's. --- ## Always on Nothing to set, and nothing can turn them off: - **Every room is sealed** with a key made on your device. Witbitz stores ciphertext and cannot open it. - **Keys stay in the key worker** on your device — in the installed app from app.witbitz.chat, in its vault, so the screen itself never holds a key. - **The app can reach only Witbitz.** Its pages carry a locked list of the hosts they may talk to, and the browser refuses anything else. - **What runs is a published release**, rebuilt from public source and logged; you can [check it](https://witbitz.chat/docs/verify). - **On a computer, the device is secured first.** Before anything is saved, setup asks for one passkey that encrypts everything Spaces keeps in that browser — it also becomes a backup passkey for your account. ## For each new room When you start a Space, you choose for that room: | Setting | What it does | Default | |---|---|---| | **Confidential tier** | The assistant runs inside a verified enclave, on an open model; Witbitz cannot read the conversation even while it runs. The room shows an ENCLAVE badge. | Off | | **Verified people** | Only allow-listed people (by email or `@username`) can read or post; the link alone is not enough. | Off | | **Private assistants** | Each person gets an assistant only they can see, beside the shared room; it shares something only when they approve. | On | | **Temporary room** | The room is deleted when it is no longer used, and cannot be recovered. | Off | **Make them your defaults** in Settings → Preferences → **Default room**: the choices there start every new room, and sync to your other devices through your encrypted account. Rooms you already have stay as they are. ## For this device | Setting | Where | What it does | |---|---|---| | **Hide my IP** | Settings → Privacy & security | Sends this device's requests through a relay: the relay sees your address but not what you send; Witbitz sees what you send but not your address. Off by default. | | **Face ID lock** (Touch ID, Windows Hello) | Settings → Privacy & security → Lock screen | The app asks to unlock before it opens. | | **Also protect this device's storage** | the same card, once the lock is on | Everything Spaces keeps on the device stays encrypted until you unlock. On by default on a computer (it is the first step of setup); optional on a phone. | | **Notifications** | Settings → Preferences → Notifications | Off until you turn them on. A notification carries no content; your device fetches and shows it. | | **Show message preview** | the same place | On shows the sender and first line; off says only that something arrived. | | **Accept new Witbitz builds automatically** | Settings → Privacy & security | New enclave builds Witbitz publishes are accepted for you. On by default, for your whole account. | ## Not in the app yet - **A browser verifier** that checks each release and enforces its locks in your own browser — built, not offered in the app by default. - **Hiding message sizes and timing** from the network path — designed, not built. - **Hardware-attested phone apps** — the server's checks are built; the native apps are not released. Their status, with the rest of the platform's: [Status](https://witbitz.chat/docs/status). ## Read next - [The Spaces guide](https://witbitz.chat/spaces/guide) — every screen of the app. - [Privacy tiers](https://witbitz.chat/docs/privacy-tiers) — what each protection hides, and from whom. - [Trust model](https://witbitz.chat/docs/trust-model) — why Witbitz cannot read a room.