Groups

Groups in TalX work without a server. That means there is no authority holding the member list, checking rights or distributing messages. All of that happens on the devices themselves.

Creating and managing

Via the group icon in the chat list: enter a name – which passes through the same extremism filter as display names – and pick members from your connected contacts. Whoever creates the group gets the creator role.

Role	May
Creator	rename, set and remove the group picture, add and remove members, appoint and demote moderators, transfer ownership, delete the group for everyone
Moderator	remove members
Member	write, leave the group

The creator is untouchable – nobody can remove them, and they cannot leave the group themselves either, because it would be left leaderless. Anyone wanting out transfers ownership first, or deletes the group.

Enforcing rights without a server

Because there is no server checking rights, every device checks for itself on receipt whether the sender holds the role for this change:

• A change to the name, members or roles is only accepted if it comes from the creator.
• A removal is only accepted from the creator or a moderator.
• An “I am leaving the group” may only ever remove the sender themselves.

A tampered app therefore cannot grant itself rights. It can send claims – the other devices simply do not believe them.

The trust model behind this is stated plainly: you trust the creator of the group. Their member list is the truth everyone aligns with.

Encryption in groups

Every member has their own sender-key chain. These chains are distributed over the ordinary encrypted one-to-one channel – no server needed for that either.

Your own chain is rotated in three cases:

1. after every 100 of your own messages,
2. on a time basis, so a rarely used chain does not stand still indefinitely,
3. mandatorily on every membership change.

That gives a compromised chain key a limited window, and anyone who leaves or is removed can no longer read anything new. After a rotation, 16 keys of the old chain remain valid – otherwise messages already in flight at the moment of rotation would be lost.

The content itself is encrypted separately per member and delivered through the outbox with its own confirmation per recipient.

When a chain is missing

If a member lacks our sender chain, they cannot open the first message that falls into the gap and request the chain. The reply contains the current chain state – an earlier iteration cannot be computed backwards from it because of forward secrecy.

Previously the triggering message was lost that way, and the sender repeated the very same blob up to 30 times, which the other side demonstrably could never open. Today everything pending for that member is re-sealed: with a fresh iteration they can derive. The old ciphertext stays dead in the process – no old chain state is handed out, the content is sealed forwards instead. Forward secrecy remains untouched.

Delivered means: by everyone

The tick on a group message appears only once all members have confirmed. Previously the first confirmation from any single member set the tick – which looked like “everyone has it” and hid genuine losses.

The consequence is honest: in a group with a permanently offline member, your message stays on “waiting for delivery” longer than it used to. That is the truth, not a regression.

Leaving, being removed, deleting

• Leaving: the group and its history are cleaned up locally, all members are informed.
• Being removed: the same thorough cleanup happens for the removed member – history, group picture and key material.
• Deleting: creator only. All members remove the group along with its history and key material. Older apps that do not know this command silently ignore it and keep the group locally – backwards compatibility takes precedence here.

Limits

• No very large groups. Every message is encrypted separately per member and delivered separately. That scales well for households and teams, not for hundreds of participants.
• Offline members are served through the relay buffer. Without a relay the message waits until the member shows up again.
• The creator is a trust anchor. They decide who belongs.