Delivery between people

Once you've added someone in People, what you send them arrives by itself, and so does what they send you. There's no server of midden's in between. Each person keeps a mailbox folder in their own Google Drive. You post what you send into yours, and the other person's midden collects it from there. Nobody ever writes into anyone else's Drive.

Delivery needs sync to be set up first.

How it works

Adding someone

First contact is mutual: you scan their card and they scan yours, or you send a card each way. Comparing the safety number on both screens proves each card really came from the other person.
A card carries the person's public keys and the address of their hello folder.
From a card alone you can't send anything to a stranger: midden only accepts messages from people you've added.

The folders

midden mailbox/        private: only you (and midden, through drive.file)
  ├─ hello/            shared by link; its ID is on your card
  ├─ <opaque>/         shared by link; one per contact, its ID handed to them sealed
  └─ <opaque>/

midden mailbox is private. Nobody but you can list it, so nobody can find your other contacts' folders.
hello/ is for first contact. Its ID is on your card.
One folder per contact. When you add someone, midden makes a folder for them, shares it by link, and hands them its ID in a sealed mailbox message (posted in hello/).
- From then on, what you send them goes there, and they read it from there.
- Until they've confirmed the handover, things still go through hello/, so sending right after adding someone works.
Folders are named with a random ID, because a link-shared folder's name is visible to whoever holds the link. A Drive description that only you can see ("midden: Sam") tells you whose is whose.

Sending and receiving

Sending: midden seals the item (see Security) and posts it as one file in the folder you made for that person. The file is named <mailbox>.<message id>.i, where <mailbox> is worked out from both people's keys, so only the two of you can work it out.
Receiving: your midden lists your contacts' folders and fetches what's yours. It does this without signing in, using midden's API key: the folders are link-shared, and the key only identifies midden's Cloud project to Google, not you.
Receipts: once you have an item, midden posts a sealed receipt in your folder for them (<mailbox>.<id>.r.<item id>).
Cleanup: when the sender sees your receipt, they take their copy down. Once their copy is gone, you take your receipt down. Everything clears itself, from listings alone, on whichever device checks first.
- What nobody picks up is taken down after 14 days.
- Removing a contact deletes their folder, and everything in it.

When it runs

Checking: when midden opens or the browser starts, every 10 minutes while the browser is open, and straight away after you send something. Never more than once a minute, except after a send.
Your other devices read the same folders, through your synced contacts. Whichever device adds a contact makes their folder, so there's never a second one.

Security

What protects a message

Each item, receipt and handover is sealed before it leaves the device:

a fresh X25519 key for every message, agreed with the recipient's key, then HKDF;
the result encrypted with AES-256-GCM;
inside, the sender's Ed25519 signature over the header. The signature also covers the recipient's key and the one-time key, so a recipient can't re-seal a message to someone else as if the sender had sent it. The header names the body's hash, so the body is covered too.

Nothing outside the sealed file says who it's from, who it's for, or what it is.

What each party can see

Who	Sees	Doesn't see
Google	your mailbox folders and files: their count, sizes and times; that they're link-shared	anything inside them; your other Drive files are no different from before
midden's Drive access (`drive.file`)	only files and folders midden made	anything else in your Drive
Anyone with your card	your `hello/` folder: how many first contacts and handovers, their sizes and times	who they're from, what they say, anything in your contact folders
A contact	their own folder: opaque names, sizes and times of what you sent them	your other contacts, or anything you sent anyone else
Anyone with midden's API key	what anyone with a link can see: a link-shared folder whose ID they already have	private folders; folders whose ID they don't have

The API key

The key ships inside every build, so it's not a secret, and it isn't treated as one. It only says "this request is from midden's Cloud project". It doesn't sign anyone in, and it doesn't open anything that isn't already shared by link.
It's restricted to the Google Drive API.
The real risk is to quota: someone could use the key for their own Drive API calls, using up midden's quota.

Limits, said plainly

Link-shared means shared: anyone holding a folder's ID can list it and download its files. The protection is that the IDs are hard to guess, are only ever on your card (hello/) or sealed to one contact, and that every file is sealed.
What the files reveal: sizes and times show that you're talking, and roughly how much, to anyone who holds that folder's ID (Google included).
A lost or stolen device holds your keys, so anyone with that device unlocked can read what arrives. There's no remote wipe, and no way yet to replace your card and keys.
Message size: one message carries up to 100 MB. Anything bigger posted into a folder is ignored, not fetched.
No arrival alert on the phone yet: items arrive at the next check, while midden is open.