spore m³

services host online

Private, end-to-end encrypted messaging whose messages ride the chain and whose bodies ride a courier. This host runs two things for people who do not want to run a server: a hosted mailbox and a blind relay hop. Every key stays on your device — this box holds ciphertext that expires, never a plaintext message and never an identity key.

Endpoints

what	address	what it does
mailbox	`https://mail.sporem3.io/u/<user>`	holds TTL-bound encrypted bodies, serves single-use prekeys, lists pointers. Bearer-token per user; no token, no read.
relay hop	`https://relay.sporem3.io/relay/<cid>`	accepts an opaque body bound for a mailbox (`X-Relay-Dest`), holds it, forwards it. Your mailbox then sees the relay's IP, not yours.
DERO node	`https://rpc.mycoid.net`	the chain node the pointers ride (shared, rate-limited, read-safe).

How a phone uses it

# send (a body through the relay, a pointer on-chain)
printf 'hi\n' | spore msg send -chain dero -rpc https://rpc.mycoid.net/json_rpc \
  -to <friend-dero1...> -identity ~/mb/identity.key \
  -bundle ./friend-bundle.json -pinned-sig FRIEND_SIGNING_KEY_HEX \
  -store https://mail.sporem3.io/u/<you> -store-token <your-token> \
  -state-dir ~/mb/state -state-key ~/mb/state.key -ringsize 16

# receive + decrypt locally (the box never sees plaintext)
spore msg recv-e2 -chain dero -rpc https://rpc.mycoid.net/json_rpc \
  -store https://mail.sporem3.io/u/<you> -store-token <your-token> \
  -identity ~/mb/identity.key -spk ~/mb/spk.key -opk-pool ~/mb/opk-pool.json \
  -state-dir ~/mb/state -state-key ~/mb/state.key

What this host sees — and what it cannot

Cannot: read message plaintext, decrypt bodies, hold your identity key, slice-prekey private key, or ratchet state. Bodies are XChaCha20/ratchet ciphertext; decryption happens in spore msg recv-e2 on your own machine.
Can: see traffic patterns — that some address polls some mailbox, how often, from which IP. Sender identity is blanked from the hosted logs (-privacy), but timing and volume remain visible.
Expiry: bodies are deadline-bound and reaped; a body does not live here forever, and accepting a delivery can burn the on-chain slot.
If metadata privacy matters to you, self-host: a home node plus your own spore mailbox run is the same software, with no third party in the loop.

Relay hop: what it does and does not change

The relay only ever holds content-addressed ciphertext — it fetches and forwards, it never decrypts and never holds a key.
Forwarding is deny-by-default: only mailboxes this operator names are reachable through it, so it is not an open proxy.
It does change who your destination mailbox sees: the relay's address, not yours. Timing correlation between your push and the mailbox's receipt is still possible if the observer sees both sides.
Bodies are quota-bounded, per-IP rate-limited, and deadline-capped.

Free tier vs. hosted

	self-host	hosted here
cost	a box you already own	a small monthly fee — cheaper than a VPS you have to babysit
metadata exposure	none	timing/volume visible to this operator
keys	yours	yours (this host never receives them)
always-on	your problem	this box, monitored

The software is BSD-3 and free forever. What is paid is the convenience of someone else keeping the courier awake. Both tiers run the identical binary.