Encrypted My Room is for teams that want Magic PTT’s radio — and need the operator of the platform locked out. When a net admin turns it on for your room, voice and room chat use a shared passphrase stored only on members’ devices. Nexus carries the bits. We do not get the key.
Who it is for
This is a member-owned My Room feature. Welcome Desk, Magic PTT Home, language nets, and the SHTF repeater stay in the clear on purpose. Encryption is opt-in per private room so we never break captions, hosting, or RF bridges on the rooms that need them.
How a customer would use it
Beta gate: a net admin flips Encrypted room on that My Room (owners do not self-enable yet). The owner generates a passphrase under My Room, copies it or shows a QR. Each member enters it once on that device (or scans the QR on Connect). Look for the Encrypted badge on PTT. Wrong passphrase: no useful voice, no readable chat.
Protected
Voice on that room
Hold to talk as usual. Audio is encrypted on each member’s device before it reaches Nexus. Staff and the voice servers see ciphertext, not speech.
Room chat (text)
Same shared passphrase encrypts chat on the device. Wrong passphrase cannot read the thread.
You hold the key
The passphrase lives on members’ devices — never in the Magic PTT database, never in a Nexus token. Lose every device copy and that room’s history stays locked.
Left in the clear
Public rooms & SHTF
Everyday nets stay clear so hosts, captions, and the repeater path can work. Encryption is a My Room option, not a network-wide cloak.
Photos, captions, AllStar
Encrypted rooms are text chat only. Live captions and AllStar Link are blocked — those paths would need a plaintext copy we refuse to keep.
Direct Messages
1:1 Messages are a separate product. Encrypted My Room does not encrypt DMs.
Honest beta
Today’s key is one room passphrase you share like a club door code. We do not yet rotate it automatically, and we do not issue per-person identity keys. Anyone with the current passphrase can decrypt that room’s voice and text on a device that stored it. Change the passphrase the same way you would change a lock: generate a new one, tell the crew, old devices must update. That is the product we will demo — not a promise of Signal-style ratchets.
What a buyer should ask us
Ask for a walkthrough on a spare My Room: two laptops, one passphrase, prove staff cannot read chat and cannot hear a clear copy on Nexus. If you need default-on encryption on Magic PTT SL (disaster box, no internet CA), that is a separate design — same idea, different box, and rolling keys are a later slice. Everyday Magic PTT encryption stays My Room only.
Magic Tags, Full Duplex, and the AllStarLink3 bridge live on the Rooms tour. Encrypted rooms cannot use that RF bridge — by design.
