sha.chatSecure window
Protected rooms open in a window that the operating system excludes from screenshots, screen recording and casting. On Android this is the platform secure-window flag.
App · operating-system guardMost of this page is still in English. Its Kugg text is being written.
Capture Gate · Live signals
Nothing leaves the screen
until it is approved.
Protected conversations are veiled for anything that tries to record them. Frames and challenges keep changing, so an unapproved capture holds scrambled text and an expired signal.
Capture Gate interactive preview
Lena RuizVeiled
Live signalsPersonal
01 / Human signal
Frame 0000
The glyphs identify this frame. No identity or media fingerprint appears on the public surface.
02 / Machine signal
Participants read normally. In the app, the secure window blocks the operating system's screenshots and recordings while you read.
Validator chain
In this simulation, two of three simulated votes, no veto, room policy and participant consent are required for a demo receipt. A separate camera can still record visible text.
- 01Secure window·
Waiting
- 02Frame and challenge freshness·
Waiting
- 03Space policy · deterministic·
Waiting
- 04AI validator quorum · 2 of 3, no veto·
Waiting
- 05Consent·
Waiting
- 06Decision·
Waiting
Browser demo only. The example runs in this browser and keeps its proof data in page memory. Its proof mechanism is not a product primitive.
Capture receipt
- Frame
- Frame challenge tag
- Approved by
- Validators
- AI quorum ✓ · policy ✓ · consent ✓ · 1 redaction
Capture window closes in 20 s
Captures and end validation
Take a photo of the screen at any moment. It holds what a real photo would hold: the veil, the tornado and the frame challenge. Only an approved capture passes end validation.
How the gate is layered
Five layers,
plus a planned viewer check.
Veil
Text a capture could record is shown as shifting glyphs. Participants read it by holding, while focus and the secure window are present. Losing focus veils it immediately.
App and webLive signals
A human signal (glyph frame) and a machine signal (Z<>W tornado) rotate every few seconds. They carry no identity and no media fingerprint. Only participants' devices can link a frame to a conversation.
Rotating · opaqueValidators
Deterministic checks confirm the frame, challenge and space policy. Three on-device AI validators vote: approval needs 2 of 3, and any veto blocks. They look for sensitive data, third-party content and integrity, and can redact. A person's consent completes the approval.
Quorum + policy + consentReceipt
An approved capture carries a sealed receipt bound to its frame, its challenge and its exact content. End validation checks all of it: a photo without a receipt, or with one character changed, fails.
Bound to one frameWho can see the screen?
Planned for the app. Biometric sign-in checks the participant. A separate, on-device viewer check keeps content veiled if it detects another viewer or camera, loses camera access, or cannot decide.
Planned · REQ-CAP-001What a capture would hold
Without approval,
a capture is noise.
Unapproved capture
- Scrambled glyphs instead of text
- A frame number that has already rotated
- An expired, opaque challenge
Approved capture
- Readable content, with flagged items redacted
- Bound to one frame and one receipt
- Consent recorded for every participant
Honest limits
What software can and cannot stop.
A second camera
Software cannot block a second camera. The planned app can refuse to unveil while one is detected. A camera outside the sensor’s view can still record revealed text. This preview never checks the room.
Browsers
Web pages cannot block screenshots. On the web, the veil and focus rules are the protection; the secure window exists only in the app.
AI validators
Models can miss things or flag too much. That is why a quorum decides, any veto blocks, and approval also needs the deterministic policy and a person.
Delivery status
Capture Gate is a planned capability. It is not in a release build yet and becomes available only after device, privacy and security checks pass.
Cryptography stays where it belongs
Approval does not change
how messages are encrypted.
Chat sessions use the selected profile: PQXDH with ML-KEM-1024 and the Double Ratchet. Capture Gate adds no separate message encryption and no plaintext path.
ML-DSA-87 signs Professional records, such as an Artifact Promotion receipt for an approved capture. It does not encrypt chats or calls.