Privacy in the Spaces app — what is on, and what you can turn on
This page is about one app: Witbitz Spaces, the multiplayer AI room Witbitz makes. It says what the app protects without you doing anything, what you can switch on for a room or for a device, and where each setting is. What each protection hides, and from whom, is the platform's and is described once, in Privacy tiers. Every app built on Witbitz makes its own choices; these are the Spaces app's.
Always on
Nothing to set, and nothing can turn them off:
- Every room is sealed with a key made on your device. Witbitz stores ciphertext and cannot open it.
- Keys stay in the key worker on your device — in the installed app from app.witbitz.chat, in its vault, so the screen itself never holds a key.
- The app can reach only Witbitz. Its pages carry a locked list of the hosts they may talk to, and the browser refuses anything else.
- What runs is a published release, rebuilt from public source and logged; you can check it.
- On a computer, the device is secured first. Before anything is saved, setup asks for one passkey that encrypts everything Spaces keeps in that browser — it also becomes a backup passkey for your account.
For each new room
When you start a Space, you choose for that room:
| Setting | What it does | Default |
|---|---|---|
| Confidential tier | The assistant runs inside a verified enclave, on an open model; Witbitz cannot read the conversation even while it runs. The room shows an ENCLAVE badge. | Off |
| Verified people | Only allow-listed people (by email or @username) can read or post; the link alone is not enough. |
Off |
| Private assistants | Each person gets an assistant only they can see, beside the shared room; it shares something only when they approve. | On |
| Temporary room | The room is deleted when it is no longer used, and cannot be recovered. | Off |
Make them your defaults in Settings → Preferences → Default room: the choices there start every new room, and sync to your other devices through your encrypted account. Rooms you already have stay as they are.
For this device
| Setting | Where | What it does |
|---|---|---|
| Hide my IP | Settings → Privacy & security | Sends this device's requests through a relay: the relay sees your address but not what you send; Witbitz sees what you send but not your address. Off by default. |
| Face ID lock (Touch ID, Windows Hello) | Settings → Privacy & security → Lock screen | The app asks to unlock before it opens. |
| Also protect this device's storage | the same card, once the lock is on | Everything Spaces keeps on the device stays encrypted until you unlock. On by default on a computer (it is the first step of setup); optional on a phone. |
| Notifications | Settings → Preferences → Notifications | Off until you turn them on. A notification carries no content; your device fetches and shows it. |
| Show message preview | the same place | On shows the sender and first line; off says only that something arrived. |
| Accept new Witbitz builds automatically | Settings → Privacy & security | New enclave builds Witbitz publishes are accepted for you. On by default, for your whole account. |
Not in the app yet
- A browser verifier that checks each release and enforces its locks in your own browser — built, not offered in the app by default.
- Hiding message sizes and timing from the network path — designed, not built.
- Hardware-attested phone apps — the server's checks are built; the native apps are not released.
Their status, with the rest of the platform's: Status.
Read next
- The Spaces guide — every screen of the app.
- Privacy tiers — what each protection hides, and from whom.
- Trust model — why Witbitz cannot read a room.
Machine-readable source: privacy.md · Generated 2026-10-27T07:05:42Z · build f301388c · every doc in one fetch: llms-full.txt (HTML)